Summary
- We use the data from accounts you connect only to show you your messages, alert you, and draft or send replies you ask for.
- We don't sell your data and we don't use it for advertising.
- Access tokens are encrypted at rest. Each workspace's data is isolated from every other workspace.
- Message content sent to our AI provider is not used to train AI models.
- Disconnect a channel and the data we indexed from it is deleted. Delete your workspace and everything goes.
What we collect
Account information
Your name, email address, username and password (stored only as a salted hash), and the workspace and team you belong to, including roles and invitations.
Data from connected platforms
When you connect a platform — for example Gmail, Outlook, Microsoft Teams, Slack, WhatsApp Business, Telegram, Discord, Instagram, Facebook Messenger, LinkedIn, Google Calendar, Jira or Calendly — we access the data needed to provide the features you use: messages and email (sender, recipients, subject, body and attachments metadata), chats and channel messages, calendar events and meeting links, and items such as Jira issues or Calendly bookings. We also store the access tokens that let us act on your behalf.
Usage and device data
Log data such as IP address, browser type, pages visited and timestamps, used for security, debugging and understanding how the product is used.
Information you send us
Contact and demo requests (name, email, company, team size and your message) and newsletter sign-ups.
How we use it
- To provide Ekam: show your unified inbox, deliver alerts, draft replies, run the automations you set up, and send messages you approve.
- To keep the service secure, prevent abuse and fix problems.
- To communicate with you about your account, and — only if you subscribe — product updates.
- To meet legal obligations.
We rely on performance of our contract with you, our legitimate interests in running a secure service, your consent (for example, newsletters) and legal obligations as our legal bases where the GDPR applies.
AI processing
To draft a reply, summarise a thread or answer a question in AI Brain, we send the relevant content to our AI provider (currently OpenAI) through its business API. Under the provider's terms, data sent through the API is not used to train its models. AI output is a suggestion: replies are sent only when you approve them, or when you have switched on an auto-reply rule for that channel.
Google user data
Ekam's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the user-facing features described above; we do not use it for advertising, do not sell it, do not use it to train generalised AI models, and humans do not read it except with your permission, for security purposes, or to comply with law.
Who we share it with
We share data only with service providers that help us run Ekam, under contracts that limit their use of it:
- Cloud hosting and database providers — to store and process data.
- AI provider (OpenAI) — to generate drafts, summaries and answers.
- Email delivery and, if you use calling features, telephony (Twilio).
- The platforms you connect — when you send a message through them.
We may disclose data if required by law, or as part of a merger or acquisition, in which case this policy continues to apply.
Security
Connections use HTTPS. Access tokens and API keys are encrypted at rest with Fernet (AES-128 with HMAC). Workspaces are isolated from each other, webhooks are verified with per-workspace secrets, and access within a workspace follows each member's role. No system is perfectly secure; if you find a vulnerability, please email security@ekam.io.
Retention & deletion
We keep data while your account is active. When you disconnect a platform, its tokens and the content indexed from it are deleted. When you delete your workspace or account, we delete its data within 30 days, except where we must keep limited records for legal reasons. Backups roll off within a further 30 days.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to withdraw consent. Email privacy@ekam.io and we'll respond within 30 days. You can also complain to your local data-protection authority.
Cookies & storage
We use strictly necessary cookies for sign-in sessions and form security (CSRF). Your browser's local storage remembers preferences such as light or dark theme and alert sound. If analytics are enabled on our public pages we use a privacy-friendly, cookieless provider that doesn't track you across sites.
Contact
Questions about privacy: privacy@ekam.io. We may update this policy; if a change is significant we'll tell you by email or in the app before it takes effect.