Privacy Policy

Last updated: 16 August 2026

The short version

Your production files never reach us. Every document, image, native file, and load file you select is read and processed inside your own browser. Nothing is uploaded, and we have no technical ability to see, store, or recover any of it.

We hold only what is needed to run an account and a subscription: an email address and a billing record.

1. Who is responsible

Elch Information Technology FZ-LLC, of Dubai, United Arab Emirates, is the data controller for personal data described here. Contact: privacy@elch.live.

2. Production files and evidence

elch runs its entire analysis engine in your browser. When you select a folder or ZIP:

File contents are read locally by JavaScript running on your device.
Hashing, parsing, validation, repair, conversion, and export all happen locally.
No file bytes, filenames, paths, or extracted values are transmitted to us or to anyone else.
Results exist only in your browser tab until you download them.

Because of this, we cannot access your evidence, cannot produce it in response to a legal request, and cannot restore it if you lose it. This is a deliberate design choice for material that is frequently confidential or privileged.

3. What we do collect

Data	Why	Where it is held
Email address, name (if given), authentication identifiers	To create and secure your account	Clerk (authentication provider)
Subscription status, billing history, payment method details	To operate and support your subscription	Paddle (merchant of record)
An identifier linking your account to your billing record	To decide whether your subscription is active	Clerk and Paddle
Standard server logs (IP address, timestamp, request path)	Security, abuse prevention, diagnosing faults	Vercel (hosting provider)

We do not sell personal data, do not use it for advertising, and do not run third-party advertising or analytics trackers.

4. Data stored in your browser

Some features store data locally on your device, not on our servers:

Volume registry — package fingerprints, volume names, Bates ranges, and counts you choose to record. Held in your browser's local storage. Clearing site data deletes it.
Session cookies — set by Clerk to keep you signed in.

5. Legal basis (UK/EU)

Contract — account and subscription data, to provide the service you bought.
Legitimate interests — security logs and abuse prevention.
Legal obligation — retaining transaction records for tax and accounting.

6. Processors we use

Clerk — authentication and account records.
Paddle.com Market Ltd — merchant of record; handles payments, invoicing, and tax. Paddle is an independent controller for payment data it collects.
Vercel — hosting, content delivery, and server logs.

None of these processors receives your production files, because those never leave your browser.

7. International transfers

Our processors may handle data outside your country. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses. Your production files are not transferred anywhere, because they are never sent.

8. Retention

Account data: for as long as your account exists, then deleted within 30 days of closure.
Billing and tax records: retained as long as law requires, typically six to seven years.
Server logs: retained for a short operational period by our hosting provider.
Production files: never retained, because never received.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to it. To exercise any of these, email privacy@elch.live. We will respond within the period the applicable law requires. You may also complain to your local data protection authority.

10. Security

The service is served over HTTPS with a strict Content Security Policy. Billing endpoints are authenticated and rate-limited. Keeping evidence out of our infrastructure entirely is itself the most significant security control we apply: data we never receive cannot be breached from our side.

Note that signed-in pages execute authentication code supplied by Clerk. Treat your browser and Clerk as part of the trust boundary for local processing.

11. Children

The service is not directed to children and we do not knowingly collect their data.

12. Changes

We may update this policy. Material changes will be notified through the service or by email before they take effect.

13. Contact

Privacy questions: privacy@elch.live. Suspected vulnerabilities: security@elch.live.