Eleven

Privacy Policy

Last updated: 26 October 2026

Eleven ("Eleven", "we", "us") is an AI personal finance assistant that works inside WhatsApp, Telegram and iMessage. It helps you track spending, get reminded before bills are due, and manage subscriptions. This policy explains what data Eleven collects, how we use it, who we share it with, and the choices you have. It applies to the Eleven website at heyeleven.tech, the Eleven chat assistant, and the Eleven web app.

1. Data we collect

• Account and contact data: your name, phone number or messaging-app ID (WhatsApp, Telegram or iMessage), and email address.
• Messages you send Eleven: the chat messages, files and bank statements you send to the assistant.
• Gmail data (only if you choose "Connect Google"): with your permission, Eleven uses the Gmail API read-only scope (https://www.googleapis.com/auth/gmail.readonly) to read emails in your inbox. We look for financial emails such as bank debit and credit alerts, card transaction notifications, receipts, invoices, bill reminders and subscription renewals. From them we extract transaction details: amount, currency, date, merchant or counterparty, bank or card, and transaction type. Eleven cannot send, delete, or modify your emails.
• Financial data derived from the above: transaction history, categories, recurring bills and subscriptions, and balances you share.
• Waitlist data: if you join the waitlist, your name, email or phone number, and the details you enter in the form.
• Technical data: basic logs (IP address, device or browser type, timestamps, errors) needed to run and secure the service.

2. How we use your data

• To provide Eleven's features: building your spending summary, categorising transactions, detecting bills and subscriptions, sending reminders, and answering your questions about your own money.
• To carry out actions you ask for and confirm in chat, such as paying a bill.
• To secure the service, prevent fraud and abuse, and fix problems.
• To contact you about your account, or about the waitlist if you joined it.

We do not sell your personal data. We do not use your data for advertising, and we do not use it to make credit or lending decisions.

3. Google user data and Limited Use

• We use Gmail data only to provide and improve the user-facing features described above: detecting your transactions, bills and subscriptions, and showing them to you in Eleven.
• We do not transfer Gmail data to others except as needed to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
• We do not use Gmail data to serve advertisements, including retargeting, personalised or interest-based ads.
• Humans do not read your Gmail data unless you give us explicit permission for specific messages (for example, when you ask for support), it's needed for security purposes such as investigating abuse, it's needed to comply with applicable law, or the data has been aggregated and anonymised for internal operations.
• We do not sell Gmail data, and we do not use it, or let anyone else use it, to train generalised AI or machine-learning models.
• Emails that aren't financial are not stored. We keep only the transaction details we extract, plus a reference to the source email.

4. AI processing

Eleven uses large language model (LLM) providers to read statements and emails and to understand your messages. These providers process data on our behalf, only to return a result to Eleven, under terms that prohibit them from using it to train their models. We send only the minimum content needed for each request.

5. Who we share data with

• Service providers that help us run Eleven: cloud hosting (Cloudflare), messaging platforms (WhatsApp, Telegram, Apple iMessage), AI model providers, and banking and payment partners when you ask Eleven to make a payment.
• Legal requirements: when required by law, regulation or a valid legal request.
• Business transfers: in a merger or acquisition, with notice to you.

6. Security

• All data is encrypted in transit using HTTPS and TLS.
• Google OAuth refresh tokens are encrypted at rest with AES-256-GCM, and access is restricted to the systems that need them.
• We request only the read-only Gmail permission. We never ask for, or store, your bank, email or card passwords.

7. Retention and deletion

• We keep your data while your account is active.
• You can disconnect Gmail at any time by emailing [email protected], or yourself at myaccount.google.com/permissions. When you disconnect, we revoke our access, delete your stored Google tokens straight away, and delete Gmail-derived data within 30 days unless you ask us to keep your transaction history.
• You can ask us to delete your account and all associated data by emailing [email protected] or messaging Eleven. We complete deletion within 30 days, except where the law requires us to keep certain records.

8. Your rights

Under the Nigeria Data Protection Act 2023 and other applicable laws, you can ask to access, correct, delete or export your personal data, object to or restrict processing, and withdraw consent at any time. You can contact us to do any of these, and you can also complain to the Nigeria Data Protection Commission.

9. Children

Eleven is not intended for anyone under 18, and we do not knowingly collect their data.

10. Changes

We'll update this page when our practices change, and we'll tell you in Eleven before any material change takes effect.

11. Contact

Eleven · Lagos, Nigeria · [email protected]