Privacy & Data Sovereignty Policy

The Ektasi platform and the ektasi.io website are operated by Ektasi Technology (OPC) Private Limited, registered office Chiraigaon, Varanasi, Uttar Pradesh 221112, India (“Ektasi”, “we”). Under the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for the personal data described in section 2.1 and 2.4, and a Data Processor for everything you put inside your workspace.

As Data Fiduciary (Controller): we collect the administrative and financial information needed to run your subscription and authenticate access — administrator emails, company details, billing records.

As Data Processor: for all operational data you create within your workspace (contacts, leads, quotes, invoices, content, AI prompts, files, ledgers), Ektasi acts strictly on your instructions. We isolate it at the database level, we do not monetise it, we do not train shared AI models on it, and Ektasi personnel access it only as described in section 4.

2.1 Administrative and financial data: administrator name and email, company name, GSTIN where you give it, secure authentication metadata (hashed passwords, MFA secrets, session records) and billing history. Payment instruments are handled by Razorpay or Stripe through tokenised handshakes; Ektasi never stores raw card numbers.

2.2 Workspace payload data: everything generated or uploaded within your workspace. This data belongs entirely to you and is processed only to provide the service.

2.3 Telemetry and observability data: automated error logs and performance metrics. Our telemetry pipeline scrubs authentication tokens, keys, salts and payload variables from stack traces before anything leaves the server.

2.4 Website visitor data: standard server and edge logs (IP address, user-agent, requested URL, timestamp) kept for a short rolling window for security and capacity; the enquiry you type into a contact or briefing form; and, only if you accept it in the consent banner, pseudonymous analytics events (section 7).

2.5 Purchase-acceptance records: when you buy or upgrade a paid plan, we record the acceptance itself — the email address that accepted, which version of the Terms was accepted, the date and time, the plan, the payment provider, the total price you were shown, and the IP address and browser user-agent the acceptance was sent from. The IP address and browser are recorded because they are what identifies a particular acceptance: in a chargeback, an RBI e-mandate dispute or a consumer complaint about one charge, without them we could show only that somebody accepted at some point, not that this purchase was accepted from this device. We keep the record with the tax invoice for the charge it authorised (section 8), we do not use it for anything else, and it is stated on the checkout box before you tick it. If a purchase is started and never completed there is no charge and no invoice, and the details entered — including the acceptance — stay with the unfinished order; nothing deletes them on a timer today, so write to us and we will remove them.

• To provide the service you signed up for, bill for it and support it — the performance of our contract with you (DPDP Act s.7(a) legitimate use; GDPR Art. 6(1)(b)).
• To meet legal obligations — issuing and keeping GST tax invoices, accounting records, keeping the record of the acceptance behind each charge, responding to lawful orders (DPDP s.7(c)–(d); GDPR Art. 6(1)(c)).
• To keep the platform secure — rate-limiting, abuse detection, audit logging (DPDP s.7; GDPR Art. 6(1)(f)).
• Website analytics and any marketing email to you — your consent, which you can withdraw at any time as easily as you gave it (DPDP s.6; GDPR Art. 6(1)(a)).

We do not sell personal data, and we do not use workspace content for advertising or model training.

Row-Level Security: data is isolated at the PostgreSQL engine level under a database role that cannot bypass it; a query from one workspace cannot return another workspace’s rows.

Encryption: credentials stored in a workspace (integration passwords, OAuth tokens, AI-provider keys) are encrypted with AES-256-GCM. Most are encrypted under a per-workspace key derived via HKDF from a per-workspace salt. Two kinds are encrypted under a platform key instead: the Google and Zoom meeting credentials you enter under Meetings (the client secrets and the Google refresh token), and two-factor authentication secrets. Other workspace data is protected by the database isolation above and by encryption in transit; it is not separately encrypted per workspace.

Personnel access: only designated Ektasi platform administrators can access workspace data, and they use that access only to provide support you ask for, to investigate a security incident or abuse, or where the law requires it.

Our application and database servers are operated by us in India and reached through Cloudflare, which provides TLS and DDoS protection. Authentication tokens are verified at the edge without persisting session data to disk.

We use a small set of third parties to run the service: Cloudflare (network edge); Amazon Web Services (email via SES in Mumbai, and object storage where enabled); Upstash (rate limiting); Razorpay and Stripe (payments); Google (website analytics, only with your consent); Sentry (error monitoring, where enabled); PostHog (product usage events, where enabled); Dropbox (file storage and backup copies, where enabled); 8x8’s public Jitsi Meet service (video meetings, when a workspace uses the default meeting server); and the AI model providers in section 6. The full list — what each receives and where it operates — is maintained at /legal/subprocessors. We notify workspace administrators at least 30 days before a change that affects workspace data.

When someone in your workspace uses an AI feature, the prompt and the content submitted to that feature are sent to the model provider configured for it — by default OpenAI; alternatively Anthropic, Google Gemini, OpenRouter, Stability AI, Replicate (specialised image and video models), or a self-hosted endpoint operated by us — and the response is returned to your workspace. Nothing else is sent, and nothing is sent when AI features are not in use.

We do not train models on your data and have no training or fine-tuning pipeline that reads workspace content. A workspace administrator may bring their own provider API key; requests made with it are governed by your agreement with that provider.

Strictly necessary storage — the signed-in session cookie, your theme preference and your consent choice — is set without asking because the site does not work without it and it identifies no one to any third party.

Google Analytics 4, loaded through Google Tag Manager, is optional. It runs only after you click “Accept analytics” in the banner, never on the signed-in dashboard, and it sets cookies and sends pseudonymous usage data (truncated IP, pages viewed, device class) to Google. Declining changes nothing about how the site works. Where a deployment is configured with our first-party, cookieless page counter instead, that counter sets no cookie and needs no consent.

You can change your choice at any time here or from “Cookie choices” in the footer. If you had accepted, declining removes the Google Analytics cookies from your browser and reloads the page.

• Workspace payload data — for as long as the workspace exists; kept at least 90 days after a cancellation or lock so you can export or resume, unless you ask for erasure sooner; then erased as below.
• Account and authentication data — for the life of the account, then deleted within 30 days of closure.
• GST tax invoices we issued, and the record of who accepted the Terms for each charge (section 2.5) — eight financial years: CGST Act s.36 (seventy-two months from the due date of that year’s annual return) and Companies Act, 2013 s.128(5). These are kept even if the workspace is erased, and they are not anonymised: the GST rules require the buyer’s name, address and GSTIN on the invoice itself, and an acceptance that does not identify who accepted answers nothing. DPDP Act, 2023 s.8(7) permits retention that is necessary for compliance with law.
• Audit ledger of administrative actions — retained, append-only, as the compliance record of the workspace.
• Server and edge logs — a short rolling window, then discarded.
• Analytics data — per Google’s retention setting for our property, and only for visitors who consented.

Erasure of a workspace: on termination or a verified administrator request we delete every table that holds the workspace’s data from the live database, in one transaction — if any step fails nothing is deleted, so there is no partial erasure — and destroy the workspace’s key salt, so credentials keyed to the workspace can no longer be decrypted from the live system. Two records are kept, because the law requires us to keep them: the GST tax invoices we issued for the workspace, and the record of who accepted the Terms for each charge (section 2.5), including the IP address and browser it came from. Both are kept for eight financial years under CGST Act s.36 and Companies Act, 2013 s.128(5), which DPDP Act, 2023 s.8(7) permits because the retention is necessary for compliance with law. Nothing else survives: the billing profile, the tax profile, your consent and data-request records, and every other table carrying the workspace’s identifier are deleted. Copies in our backups are not altered; they are deleted as those backups expire under our rolling retention schedule, and until then are used only to recover the service after an incident. A content-free tombstone and the append-only audit ledger record that the erasure happened. The step-by-step is at /legal/data-deletion.

The database and application servers are in India. Some sub-processors operate outside India — Cloudflare’s edge is global; Stripe, Google, Sentry, Upstash, PostHog, Dropbox, 8x8 and the AI providers are US-headquartered — so metadata in transit, payment records for non-INR billing, rate-limiting keys (IP addresses and workspace identifiers), analytics and product usage events, files and backup copies where Dropbox is enabled, and AI prompts may be processed there. We rely on each provider’s contractual data-protection commitments, and for visitors in the EU/UK on the applicable standard contractual clauses. Enterprise clients needing strict in-country processing can specify it under an MSA.

Under the DPDP Act, 2023 (and, for EU/UK residents, the GDPR) you have the right to:

• Access — a summary of the personal data we hold about you, the processing we do and the parties we have shared it with.
• Correction and completion — fix inaccurate or incomplete data. Workspace administrators can edit account details directly in Settings; anything else, ask us.
• Erasure — have your personal data deleted where we no longer need it for the purpose or for a legal obligation. Two things we must keep: a GST tax invoice we issued, and the record of the acceptance behind a charge (sections 2.5 and 8). Everything else goes (section 8 and /legal/data-deletion).
• Withdraw consent — for analytics via “Cookie choices”; for any marketing email from us via the unsubscribe link it carries or by writing to support; either takes effect immediately and is as easy as consenting was.
• Nominate — name another person to exercise these rights for you if you die or are incapacitated (DPDP s.14). Write to us with their name and contact details.
• Grievance redressal — section 12.
• For EU/UK residents additionally: portability, restriction, and objection to processing based on legitimate interests.

To exercise any of these, email support@ektasi.io from the address on your account. We verify the request, act within 30 days and tell you what we did. There is no charge unless a request is manifestly unfounded or repetitive.

If a business that uses Ektasi holds your personal data — because you are their customer, lead or invoice recipient — that business is the Data Fiduciary and we are its processor. Direct your request to them; if you cannot reach them, write to us and we will forward it and confirm that we have.

The platform is a business tool and is not directed at anyone under 18. We do not knowingly process a child’s personal data without verifiable parental consent, and we do not track children or target advertising at them. If you believe a child has given us data, tell us and we will delete it.

Our Grievance Officer under the DPDP Act, 2023 and the Information Technology Rules, 2021 is Rajan Singh, reachable at rajan@ektasi.io or by post at Sandaha, Varanasi, Uttar Pradesh 221007, India. The Grievance Officer acknowledges a grievance within 24 hours of receipt and resolves it within 15 days. If you are not satisfied with the response, you may complain to the Data Protection Board of India; EU/UK residents may also complain to their local supervisory authority.

If a personal data breach occurs we notify the Data Protection Board of India and each affected Data Principal in the manner and time the DPDP Act and Rules require, and tell workspace administrators what happened, what data was involved and what we did about it.

We update this policy when our processing, providers or the law change. Material changes are posted here with a new “last updated” date and notified to workspace administrators by email. Continued use after the effective date is acceptance of the updated policy; where a change needs fresh consent, we ask for it.