Who We Are
ElevateIQ is a Windows endpoint privilege-elevation service operated by Tiny Electrons LLC ("we", "us", "our"). The service consists of:
- A Windows agent (the "Agent") deployed on each managed endpoint.
- A Windows credential provider that runs inside the standard UAC prompt.
- A web admin console (the "Admin Console") used by IT administrators.
- A backend API and PostgreSQL data store hosted on our infrastructure.
Together these are referred to as the "Service".
Roles
ElevateIQ is a B2B service. Our customer (typically an IT department or a managed service provider deploying ElevateIQ on behalf of an organization) is the data controller for personal data processed through the Service. Tiny Electrons LLC acts as the data processor on the customer's instructions, governed by a Data Processing Addendum where required.
This policy describes what we — Tiny Electrons LLC — collect, why, and how. It does not replace your employer's or organization's own privacy notice; if you are an end-user on a managed endpoint, your organization is the controller of your personal data.
Data We Collect
From Windows endpoints (via the Agent)
- Device identity: hostname, machine ID, OS version + architecture, serial number, manufacturer, model, agent version, last-seen timestamp.
- User identity (per request): Windows SID, the user-name reported by Windows, and (when present) the email address bound to the Windows account.
- Elevation requests: the path, hash, file name, version, publisher, signature status, and code-signing thumbprint of the binary the user is trying to run; the working directory; the command-line arguments; the parent process; the user's free-text reason; AMSI scan result; AI risk score; ML risk score.
- Access requests (User Settings): which built-in Windows User Setting class the user is requesting (Network, Display, Devices, Printers, Power, Date & Time), the duration requested, the user's free-text reason, MFA proof.
- MFA proof: a signed nonce produced by Windows Hello, a hardware passkey, or a TOTP authenticator. We do not store biometric template data, passkey private keys, or TOTP secrets on our backend — only the cryptographic proof that a challenge was completed.
- Compliance posture (optional, controller-configurable): domain-join state, BitLocker / firewall / antivirus / WDAC state, encryption status, MDM-managed flag.
From the Admin Console
- Account profile of administrators using the console: email, name, role, MFA enrollment status, organization membership.
- Authentication artifacts: signed session cookies (see Cookie Policy), passkey credentials registered for sign-in, TOTP secrets (encrypted at rest).
- Audit log entries: every approval, denial, dismissal, rule change, login, logout, role change, and revocation, with timestamp, actor, and originating IP.
Automatically
- HTTP request metadata (method, path, status code, IP, user-agent) for security and operations logs.
- Device fingerprint: a low-entropy summary (browser, platform, masked IP) attached to admin sessions for anomaly detection.
- Aggregate, non-identifying usage metrics for service health (request counts, queue depth, latency).
What we do NOT collect: keystroke data, screen captures, browsing history, document contents, file contents from outside elevation requests, microphone or camera input, or biometric templates.
How We Use Your Data
- Operate the Service: evaluate elevation and access requests against your organization's rules; route pending requests to administrators; deliver approval/denial decisions back to the endpoint.
- Security: detect anomalous sign-in patterns, throttle abusive endpoints, validate MFA proofs, and rotate session tokens.
- Audit & compliance: maintain a tamper-evident record of every privilege change so your organization can prove who approved what, when, and why.
- Improve the AI risk model (controller-configurable): anonymized features from elevation requests may be used to refine the AI risk-scoring model. This can be disabled per tenant.
- Notify administrators of pending requests, security events, and product updates.
- Billing based on the active endpoint count.
Legal Bases (GDPR / UK GDPR)
- Performance of a contract with the customer — operating the Service the customer subscribed to.
- Legitimate interests — security monitoring, fraud prevention, abuse detection.
- Compliance with legal obligations — tax records, lawful disclosure requests.
- Consent — for optional analytics cookies on our marketing site (the consent banner). You can withdraw consent at any time via Cookie settings.
AI & Automated Decision-Making
ElevateIQ uses an AI model (currently Google Gemini, with the option of a customer-managed alternative) to score the risk of each elevation request and recommend an action. The AI's recommendation is advisory only: a request is not approved or denied automatically based on the score unless your organization has explicitly configured a rule to do so. A human administrator reviews every novel request.
Where the customer has enabled auto-approve for matching rules, the decision is governed by the rule (a deterministic policy your administrators configured), not by the AI. You can request a manual review of any automated decision by contacting your administrator or, if needed, privacy@elevateiq.com.
Sub-Processors
We use a small number of vetted sub-processors to operate the Service:
- Cloud hosting — for the API, database, and static assets.
- AI provider — for the risk-scoring model (Google Gemini by default; customer-managed providers supported).
- Email delivery — for transactional emails (notifications, password reset, MFA enrollment links).
- Payment processor — for subscription billing.
- Error monitoring — for diagnostic stack traces; PII is redacted before transmission.
A current sub-processor list is available on request to privacy@elevateiq.com.
International Transfers
Our primary infrastructure is hosted in the United States. Where personal data is transferred from the EEA, the UK, or Switzerland to the United States, we rely on Standard Contractual Clauses or adequate-decision frameworks where applicable.
Retention
- Active session data: until logout or session expiry (7 days, or 30 days for "Remember me").
- Audit log: retained for the lifetime of the customer's subscription and for 90 days after termination, then deleted unless the customer requests an export.
- Elevation request payloads: retained for 365 days by default; customers can configure shorter retention.
- Security event logs (with full IPs): 90 days.
- Billing records: 7 years for tax/audit compliance.
- Marketing-site analytics (if enabled and consented to): per analytics-provider defaults.
On termination, customers can export their data via the API; data is then deleted from production within 30 days and from backups on the next backup-rotation cycle.
Security
- TLS 1.2+ in transit; AES-256-GCM at rest.
- Argon2 password hashing.
- HttpOnly, Secure, SameSite session cookies (see Cookie Policy).
- Per-elevation MFA proofs signed on the endpoint.
- Hardware-backed certificate verification on every code-signed binary.
- Tenant-isolated database row-level-security policies.
- Annual penetration testing and continuous SAST + dependency scanning in CI.
Your Rights
Subject to applicable law, you may have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request erasure ("right to be forgotten").
- Restrict or object to processing.
- Data portability.
- Withdraw consent (e.g., for analytics cookies).
- Lodge a complaint with your supervisory authority.
Because we process most personal data on behalf of our customer (your employer or IT provider), the most direct route is usually to make the request to them. You can also contact us at privacy@elevateiq.com and we will route the request appropriately.
Children
The Service is not directed to children under 16 and is intended for use in a workplace or managed-IT context. We do not knowingly collect personal data from children.
Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be announced in the Admin Console and via email to account owners. The "Last updated" date at the top of this page reflects the latest revision.
Contact
Tiny Electrons LLC
Privacy inquiries: privacy@elevateiq.com
General contact: hello@elevateiq.com
Effective Date: 2026-05-01