Ekaya Cloud Privacy Policy
Version 1.2, effective 2026-10-17.
This Ekaya Cloud Privacy Policy (the "Policy") explains how Ekaya Inc, a Delaware corporation ("Ekaya", "we", "us"), whose address is 1112 Montana Ave #414, Santa Monica, CA 90403, collects, uses and shares personal data about the people who sign up for and use Ekaya Cloud, the hosted service Ekaya operates. This Policy covers Ekaya Cloud only. It does not cover Ekaya Enterprise or any Ekaya software that a customer runs in its own environment.
1. Two kinds of data
1.1 Data about the people who use Ekaya Cloud. Ekaya decides why and how this data is processed, and is its controller. This Policy describes it.
1.2 Customer Content. Customers put data into their Projects: records in Managed Project Databases, connected datasources, approved Requests, application data, and audit records of what happens in the Project. Ekaya processes Customer Content only on the customer's behalf, as its processor, under the Ekaya Cloud Data Processing Agreement. The customer's own privacy notice governs that data. If your personal data is in a customer's Project, please contact that customer; if you contact Ekaya, we will forward your request to the customer where we can identify it.
2. What we collect
2.1 Account data. Your name, email address, and the identifier and profile details your sign-in provider shares with us when you sign in with Google, GitHub or Microsoft; the organization you name, if any; and the Projects and Roles you hold. If you use Microsoft sign-in for an Azure SQL Project, we receive the Microsoft access token you present, exchange it for an Azure SQL access token, and store the Microsoft and Azure SQL access tokens for the session.
2.2 Billing data. The billing contact and any Billing Owner email address on record, the address and tax details you give us, the plans, levels and seats you buy, payment status and invoices. We also keep Billing Invitation Link recipient addresses and redeemers' account identifiers and redemption times. Our payment processor, Stripe, collects payment card details directly; we do not store full card numbers.
2.3 Usage and technical data. Records of key account events (for example signing up, completing a sign-in for a connected client, and creating a Project), per-Project usage counters used for limits and billing, and technical logs of requests to the service, which can include IP address, browser or client type, and timestamps.
2.4 Campaign data at sign-up and Project creation. If you arrive at the Ekaya Cloud console from a link that carries campaign parameters, the console collects them when you sign up and when you create a Project:
- the UTM fields:
utm_id,utm_source,utm_medium,utm_campaign,utm_source_platform,utm_term,utm_contentandutm_creative_format; - the ad click identifiers:
gclid,gbraid,wbraid,gad_source,gad_campaignid,fbclid,li_fat_idandmsclkid; lp(the landing page label the campaign link adds) and the console path the link landed on.
We use this data to attribute sign-ups and Projects to the campaigns that led to them. Your browser keeps a copy in its local storage until you create a Project or sign out, and for 30 days at most. We store the data with the record of your sign-up and with the record of the Project you created and its creator, and do not link it to any other account, to a payment customer record, to an email address or to the state of a Project. We remove the click identifiers 90 days after the event. If you delete your account or the Project, we remove your account identifier and the click identifiers from those records and keep the UTM fields, lp and the landing path only for aggregate campaign counts. When you sign up or create a Project, we send our web analytics only the campaign labels (utm_source, utm_medium, utm_campaign, utm_content, utm_term and lp), never the click identifiers or your account or Project identifiers; Google's analytics tag separately records the address of each page you visit, as Section 2.5 explains. We do not upload the click identifiers collected under this Section to advertising platforms.
The analytics choice in Section 2.5 does not gate the campaign copy that this Section keeps in browser local storage. In the United States this Section is notice. For visitors in the European Economic Area and the United Kingdom, consent comes first: until the console asks for that consent, Ekaya does not direct campaigns at visitors there.
2.5 Cookies and similar technologies. The console uses Google Analytics, which sets cookies, to measure use of the console, linked across ekaya.ai and the console's domains. Google's tag records the address of each console page you visit, including any ad click identifier in the address you arrived at. Our Google Analytics property is linked to our Google Ads account, so Google can tell us which Google Ads clicks led to visits, sign-ups, Projects and the requests in Section 2.8. Google's advertising features for Google Analytics (Google signals and ads personalization) may be on; where they are, Google can associate this data with people signed in to a Google account, across their devices, and use it for advertising. You can manage ad personalization in your Google account's settings, and block Google Analytics with Google's opt-out browser add-on. The console uses browser storage for the campaign copy in Section 2.4 and to keep you signed in.
On the console, the browser's reported time zone chooses whether analytics is consent-first or notice-only; the console does not verify a person's location or use a geolocation service. Consent-first applies to every Europe/* zone, the listed EEA/UK Atlantic zones, France's outermost-region zones, and zones that do not name a place (such as UTC). Because a person can change a browser time zone, this is a heuristic, not location verification.
In the consent-first regime, the console does not load Google's tag or set an analytics cookie until the person selects Accept analytics. On acceptance, the tag starts with Google Consent Mode v2 defaults denying ad storage, ad user data, ad personalization and analytics storage, then grants analytics storage only; the advertising settings remain denied. In the notice-only regime, Google Analytics loads with a dismissible notice that links this Policy.
The Privacy choices control on every console page reopens the choice. A later decline after Google Analytics has loaded updates Consent Mode to deny storage on the current page; when the choice is remembered, Google Analytics does not load on later pages in that browser. That update does not itself prove that no earlier network activity occurred or remove cookies already set on the shared .ekaya.ai domain. The choice and notice dismissal use localStorage keys ekaya.analyticsConsent and ekaya.analyticsNoticeDismissed; if local storage is unavailable, a choice can apply to the current page but is not retained. The ekaya.ai website applies the same two regimes under its own privacy page, but it stores its own choice and notice dismissal for its own origin: the console choice does not govern Google Analytics on ekaya.ai, and the website choice does not govern the console, even though Google Analytics cookies can sit on the shared .ekaya.ai domain. Neither choice governs the campaign copy in localStorage that Section 2.4 describes.
2.6 Support communications. What you send to support@ekaya.ai and our replies.
2.7 Product feedback sent through an MCP client. If an MCP client connected to your Project sends feedback about the Ekaya MCP server, we receive its category, title and description, the name of an Ekaya tool and an Ekaya error code where relevant, the client's name and version, your account and Project identifiers, and the date. We screen the text and refuse content that looks like credentials, web addresses, contact details, query results or database statements, but the screening is not perfect. Your report is shown only to you; other users see an issue only after we have reviewed it and published it in our own words. An Administrator of your Project can switch the feature off. We keep a report until we act on it, and delete it 180 days after it is closed or marked as spam; we may delete it sooner.
2.8 Requests sent through forms on the console's site. If you use a form on the console's site to join a waitlist, to apply as a design partner or to ask about Ekaya Enterprise, we receive your email address; the name, company and use case you give; the product and, where relevant, the Project the request is about; the page you sent it from and the page that referred you; and the campaign fields and ad click identifiers listed in Section 2.4 that the link you arrived from carried. We use the request to answer you and to decide whether it is a qualified lead. If a Google Ads click led to a request we judge qualified, we upload that click's identifier (gclid, gbraid or wbraid), the time of the request and our reference for the request to Google Ads as an offline conversion, so that Google Ads can attribute the request to the ad.
3. How we use personal data, and our legal bases
| Purpose | Data | Legal basis (EEA/UK) |
|---|---|---|
| Create and run your account and Projects, including Billing Invitation Link history; provide Ekaya Cloud | Account, billing, usage and technical data | Performance of the contract |
| Bill for paid plans, levels and seats; keep financial records | Billing data | Performance of the contract; legal obligation |
| Secure the service, prevent abuse and fraud, enforce the Terms | Account, usage and technical data | Legitimate interests |
| Send service messages (sign-in verification, invitations, billing and security notices, including Billing Owner changes described in Section 4.2) | Account and billing data | Performance of the contract |
| Attribute sign-ups and Projects to campaigns | Campaign data (Section 2.4) | Consent in the EEA and UK; notice elsewhere |
| Measure our Google Ads campaigns | Analytics data (Section 2.5); click identifiers of qualified form requests (Section 2.8) | Consent in the EEA and UK; notice elsewhere |
| Answer requests sent through forms and decide whether they qualify | Form requests (Section 2.8) | Legitimate interests |
| Understand and improve the service | Usage data, analytics, feedback | Consent for analytics in the EEA and UK; legitimate interests or notice elsewhere |
| Respond to support requests and legal requests | Support communications; any of the above as needed | Performance of the contract; legal obligation; legitimate interests |
If we send product or marketing email, each message includes a way to opt out.
4. How we share personal data
4.1 Providers and platforms. Personal data may be handled through Google (cloud hosting, sign-in, the console's database, analytics and our email), Stripe (payments), Twilio SendGrid (service email, including survey thank-you delivery), and Microsoft (Entra ID sign-in and the Azure SQL On-Behalf-Of token exchange). Microsoft receives or is involved with Microsoft account identifiers and profile data, Microsoft access tokens and Azure SQL access tokens in that flow. The current list, with what each provider touches and where, is at https://ekaya.ai/cloud/subprocessors.
4.2 Within your Project. The Administrators of a Project you belong to can see your name, email address, Role and the Project's audit records of your actions. If you are a Project's Billing Owner, its Administrators can see your email address, when one is on record, even if you are not a Member. In Billing Invitation Link history, the Project's Administrators and Ekaya staff can see any recipient address an Administrator entered and each redeemer's current account email, when on record, beside the redemption time. This remains visible after the redeemer stops being Billing Owner, whether or not they are a Member. After the Billing Owner changes, where the outgoing Billing Owner has an email address on record, we attempt to send a notice to that address with the Project name and the new Billing Owner's email address when one is on record.
4.3 Legal reasons. We disclose personal data when law, a court order or a valid legal process requires it, or to protect the rights, property or safety of Ekaya, our customers or others.
4.4 Business transfers. If Ekaya is involved in a merger, acquisition or sale of assets, personal data may transfer to the successor, which remains bound by this Policy for data collected under it.
4.5 Advertising measurement. Google receives the data Sections 2.5 and 2.8 describe, through our Google Analytics property, which is linked to our Google Ads account, and through the conversions we upload, so that we can measure our Google Ads campaigns.
4.6 No sale. We do not sell personal data for money.
5. Where we process personal data
Ekaya Cloud's control plane, which holds account and Project records, runs in Google Cloud in the United States (us-central1). The providers and platforms described in Section 4 process data in the United States and in other countries where they operate. If you are outside the United States, your personal data is transferred to the United States.
6. How long we keep personal data
| Data | Retention |
|---|---|
| Account data | While the account exists, and afterwards for as long as needed to meet legal, tax and security obligations and to resolve disputes |
| Billing data and invoices | As long as tax and accounting law requires. Stripe also keeps customer, invoice and payment history under its own retention after an account is deleted |
| Campaign data | As Section 2.4 states |
| Product feedback | As Section 2.7 states |
| Waitlist signups | 730 days after createdAt, unless an existing Ekaya account has the same email address; then kept while that account exists |
| Readiness assessments | 730 days after createdAt, unless an existing Ekaya account has the same email address; then kept while that account exists |
| Survey responses | 730 days after createdAt, unless an existing Ekaya account has the same email address; then kept while that account exists |
| Click identifiers on waitlist signups | Removed 90 days after the signup's createdAt |
| Survey thank-you Trigger Email outbox records | Separate from the survey response. The mail record holds the recipient address and message content. Ekaya does not currently delete these records automatically, and they are not subject to the survey response's 730-day period. |
| Other form requests | As long as needed to answer the request and follow up with the people who made it |
| Technical logs | As long as needed to operate and secure the service |
| Support communications | As long as needed to answer the request and to keep a record of it |
| Residual copies in backups | The control-plane database keeps point-in-time recovery copies, which expire at the end of its recovery window |
7. Your rights and choices
7.1 Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict some processing, and to withdraw consent at any time without affecting earlier processing. In the console, you can reopen Privacy choices to withdraw analytics consent. You can update your account details in the console.
7.2 To make a request, or to delete your account, write to support@ekaya.ai. We will verify your identity before acting on a request, and answer within 30 days. If we decline a request, we will say why and how to appeal. You may also complain to your data protection authority.
7.3 For personal data in a customer's Project, see Section 1.2.
8. Security
We protect personal data with the measures described in Annex II of the Ekaya Cloud Data Processing Agreement. No system is perfectly secure. Report a security concern to security@ekaya.ai; we acknowledge security reports within 2 business days.
9. Children
Ekaya Cloud is for people who are at least 18 years old. It is not directed to children, and we do not knowingly collect personal data from children.
10. Changes to this Policy
We may update this Policy by publishing a new version with a new effective date. For a material change, we will notify account holders by email or in the console before it takes effect. Prior versions are kept at https://ekaya.ai/cloud/privacy/archive.
11. Contact
Ekaya Inc, 1112 Montana Ave #414, Santa Monica, CA 90403. Email: support@ekaya.ai (privacy requests, questions and complaints).