Elementor

GDPR overview

GDPR and CCPA compliance are claimed explicitly on Elementor's Trust page. A Data Processing Agreement is published, along with a maintained list of sub-processors, and data protection reviews are carried out annually by third parties. Transfers from the EEA and the UK to Israel rely on adequacy: Israel is recognised by the European Commission and the UK Information Commissioner's Office as offering an adequate level of protection. Standard Contractual Clauses cover transfers to countries without an adequacy decision. The contracting entity follows your billing region: Elementor EU Ltd. (Cyprus) for the EEA, Elementor UK Limited for the UK, Elementor Inc. (Delaware) for the US, Elementor Ltd. (Israel) otherwise. Privacy requests go to privacy@elementor.com. Elementor also sells its own Cookie Consent product, with GDPR and CCPA banners, cookie scanning, script blocking and consent records. No Article 27 EU representative is named on the site.

Who owns the data?

Elementor's AI terms leave you responsible for what you feed in and for what comes out: you are responsible for any Input, as well as the resulting material you generate. Ownership of your content is not transferred, but you grant Elementor the right to host both Input and Output on its platform and to use them to market and improve its products and services. Outputs are generated on a non-exclusive basis and may be provided to other users as well, so what you generate is not guaranteed to be unique to you. Beyond the licence you are granted, you acquire no rights in the AI Products themselves.

Reuse rights

Elementor does not require you to ask permission before using the material you generate; it makes you responsible for it instead, and the Outputs are non-exclusive, so checking them for infringement before publishing is on you. In return, your Input travels. Elementor names OpenAI LLC, Stability AI Ltd., Azure and Anthropic as its Technology Partners and states that the Technology Partners may use such Input to train and improve their services. Elementor accepts no responsibility for what those partners do with it, their own policies apply, and no opt-out is documented. Feedback you send may be shared with them too. On the account side, Elementor collects registration data (email, name, hashed password, phone number), payment data (billing address, last four digits of the card), service usage data (licence key, PHP, MySQL and WordPress versions, server IP) and technical and traffic data. Sub-processors are framed by a Data Processing Agreement and Standard Contractual Clauses.

Data retention & training

Hosting summary

Elementor stores and processes data across several regions of the world, including Israel, the European Union and the United States, on Tier-1 cloud providers, namely AWS and GCP. The Elementor Host product itself runs on Google Cloud with Cloudflare Enterprise, a global CDN and autoscaling. Data is encrypted end to end, in transit, at rest and in backups. Production environments are segmented into separate accounts with multi-factor authentication and strict access control, and the infrastructure is distributed, with backups and business continuity provisions. Penetration testing is managed on a continuous basis by external experts. On jurisdiction, Elementor Ltd. is headquartered in Israel, which the European Commission and the UK Information Commissioner's Office recognise as offering an adequate level of protection for the personal data of EEA and UK residents; transfers on that route rely on adequacy, while Standard Contractual Clauses cover transfers to countries without an adequacy decision. Sub-processors are disclosed publicly and bound by a Data Processing Agreement.