Privacy Policy

Last updated: September 23, 2026

Last reviewed: September 23, 2026

Ekai, Inc. ("Ekai", "we", "us", or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you:

• visit our websites, including https://ekai.ai and related pages;
• use our documentation and other public-facing services;
• request a demo, contact us, or otherwise communicate with us;
• use Ekai-hosted products, evaluation environments, or customer support services; or
• interact with Ekai in connection with a business relationship.

This Privacy Policy does not override any contract we have with a customer, including a master services agreement, order form, or data processing agreement. Where a customer uses Ekai on behalf of its own organization and users, that customer may control certain personal data processed through the service.

1. Who we are

Controller contact details:

Ekai, Inc.
One Broadway, c/o C10 Labs, Cambridge, MA 02142
Email: privacy@ekai.ai

2. Scope

This Privacy Policy covers:

1. Website and marketing data collected when you browse our site, request information, book a demo, subscribe to updates, or contact us.
2. Account and user data collected when users are invited to or use Ekai.
3. Customer content and connected data processed through the Ekai product, subject to the deployment model and customer contract.

3. Personal data we collect

A. Website, documentation, and marketing interactions

We may collect:

• identifiers and contact details, such as your name, work email address, phone number, company name, job title, and country;
• communications data, such as the contents of forms, emails, support requests, meeting notes, and other messages you send us;
• device and usage information, such as IP address, browser type, device identifiers, operating system, referring URLs, pages viewed, timestamps, and similar online activity;
• cookie and similar technology data, subject to your browser settings and any consent choices you make.

B. Account and user administration data

If you or your organization use Ekai, we may collect:

• user profile data, such as name, work email, organization, role, and account status;
• authentication and access data, such as login events, invitation status, SSO or identity-provider details, and related security logs;
• administrative and billing contact data for account owners or designated contacts.

C. Product and service data

Depending on the deployment type and features used, Ekai may process:

• connection and configuration data for supported platforms and model providers;
• metadata from connected data systems, such as schema definitions, table structures, column names, data types, and statistical summaries;
• business requirements text, context documents, prompts, generated diagrams, generated code, documentation, semantic models, validation results, and review feedback;
• usage metrics and operational telemetry, such as user counts, feature usage, execution events, and service health information;
• logs and diagnostics needed to secure, support, maintain, and troubleshoot the service.

Where required to provide the service, Ekai may temporarily process data from connected systems during profiling, generation, validation, or execution workflows. Retention and storage vary by deployment model and contractual arrangement.

D. Data from third parties

We may receive personal data from:

• your employer or organization, when they invite or provision you to use Ekai;
• identity providers and single sign-on providers;
• service providers that help us operate our website, communications, analytics, infrastructure, support, billing, and security functions;
• publicly available sources and professional networking sources, where permitted by law.

4. How we use personal data

We use personal data to:

• provide, operate, secure, and improve our website and services;
• respond to inquiries, book demos, communicate with prospects and customers, and provide support;
• provision accounts, manage user access, authenticate users, and administer organizations;
• analyze connected systems and generate product outputs such as ERDs, semantic models, documentation, code, and related artifacts;
• monitor reliability, site health, performance, bugs, abuse, fraud, and security incidents;
• manage contracts, subscriptions, invoicing, and business operations;
• send service-related communications and, where permitted, product, event, or marketing communications;
• comply with legal obligations and enforce our terms, contracts, and policies.

We do not use customer content or connected data to train, fine-tune, or improve foundation AI models.

5. Legal bases for processing (EEA/UK only)

If EEA or UK data protection law applies, we process personal data under one or more of the following legal bases:

• Contract: where processing is necessary to provide our services or take steps at your request before entering into a contract;
• Legitimate interests: for operating, securing, improving, and marketing our business, provided those interests are not overridden by your rights;
• Consent: where required, for example for certain marketing communications or non-essential cookies;
• Legal obligation: where processing is required to comply with applicable law.

6. How we disclose personal data

We may disclose personal data to:

• service providers and processors that support hosting, cloud infrastructure, analytics, communications, form submission and email delivery, scheduling, billing, customer support, security, and other operational functions;
• AI and model providers or infrastructure providers, where needed to provide Ekai features, depending on the deployment and configuration selected by the customer;
• your organization and its administrators, if you use Ekai through a company account;
• integration partners or connected platforms, at your or your organization’s direction;
• professional advisers, auditors, and corporate transaction participants;
• law enforcement, regulators, courts, or other third parties where required by law or necessary to protect rights, safety, or security.

Advertising, and “sale” or “sharing” under US state privacy laws

We do not sell personal information for money.

If you choose Accept in our cookie banner, Google Ads and LinkedIn may receive identifiers associated with your visit and use them to show you Ekai advertising on their own platforms and on other websites (remarketing). Where you are a LinkedIn member, LinkedIn may associate that visit with your LinkedIn account. Under the California Consumer Privacy Act as amended by the CPRA, and under comparable laws in other US states, this may be treated as “sharing” personal information for cross-context behavioral advertising, and may also be treated as a “sale”.

What happens before you choose depends on where you are. In the EEA, the UK and Switzerland we set no advertising cookies until you choose. Elsewhere they are on by default, and you can turn them off at any time using Keep essential cookies on the banner, or Cookie settings at the foot of any page.

Where you have turned them off, and where your browser sends a Global Privacy Control signal, we do not set advertising cookies and we do not share personal information for advertising.

You can change or withdraw your choice at any time using Cookie settings at the foot of any page. We also treat a Global Privacy Control (GPC) browser signal as a valid opt-out, and will not set analytics or advertising cookies where one is present.

7. Cookies and similar technologies

We use cookies and similar technologies for essential site functionality, analytics, and marketing.

When you first visit this website you will see a consent banner. What it does depends on where you are. In the EEA, the UK and Switzerland, nothing beyond strictly necessary cookies is set until you choose. Everywhere else, analytics and advertising cookies are on by default and the banner lets you turn them off.

In either case, choosing Keep essential cookies means we set no analytics or advertising cookies, and a single cookie records that choice so that we do not ask again.

You can change or withdraw your choice at any time using Cookie settings at the foot of any page — withdrawing consent is as straightforward as giving it. We also treat a Global Privacy Control (GPC) browser signal as a valid opt-out. You can additionally control cookies through your browser settings; disabling some cookies may affect site functionality.

The providers below may set cookies in your browser, or receive personal data such as your IP address, when you use this website. Each is engaged for the purpose described:

• HubSpot — customer relationship management, website visitor analytics, capture of forms you submit, and delivery of our email newsletter if you subscribe. Sets cookies that recognise a returning browser, so a form submission can be associated with earlier visits. Analytics and marketing.
• Google Analytics — aggregate measurement of how the site is used, such as pages viewed and referring source. Analytics.
• Google Ads — measurement of advertising conversions and audience remarketing. Marketing.
• LinkedIn — measurement of advertising conversions and audience remarketing through the LinkedIn Insight Tag. Sets cookies that allow LinkedIn to recognise your browser, and, where you are a LinkedIn member, to associate your visit with your LinkedIn account. Loaded only after you choose Accept, never before. Marketing.
• Hotjar — session replay and heatmaps. Records interactions with the pages you visit — such as mouse movement, clicks, scrolling, and the pages and elements you view — so that we can understand how the site is used. Analytics.
• Cloudflare Turnstile — distinguishing human visitors from automated traffic when a form is submitted. Strictly necessary.
• Web3Forms — delivery of contact form submissions to our team. Strictly necessary.
• Google Firebase Hosting — hosting and delivery of this website, including server logs that contain IP addresses. Strictly necessary.

8. AI and model providers

Ekai may use third-party AI or model infrastructure providers to deliver features. The information sent to such providers may include metadata, statistical summaries, business requirement text, prompts, or generated outputs needed to perform the requested task.

We configure our services to avoid sending raw credentials, secrets, or unnecessary data for these purposes, and we do not use customer content to train foundation models.

9. International data transfers

Your personal data may be processed in countries other than the country where you reside. Where required by law, we use appropriate safeguards for cross-border transfers, such as contractual protections or other recognized transfer mechanisms.

For customer-controlled deployments, data location and transfer patterns may depend on the customer’s chosen environment and configuration.

10. Data retention

We retain personal data for only as long as necessary for the purposes described in this Privacy Policy, including to provide the services, maintain security, comply with legal obligations, resolve disputes, and enforce agreements. Our retention periods generally follow these principles:

• Sales, demo, and contact requests: retained for the time needed to respond and manage the relationship, typically up to 12 months unless a longer business relationship exists.
• Marketing communications data: retained until you unsubscribe or we determine the data is no longer needed.
• Account and user records: retained for the duration of the account and for a limited period afterward, typically 90 days, unless longer retention is required for security, audit, billing, or legal reasons.
• Security and operational logs: retained for 45 days or longer where necessary to investigate incidents, prevent abuse, or comply with legal obligations.
• Billing and contract records: retained as required by applicable law and standard recordkeeping obligations.
• Customer content and connected data: retained according to the applicable contract, customer instructions, and deployment model. In customer-controlled deployments, much of this data remains in the customer’s environment.

11. Your privacy rights

Depending on your location and applicable law, you may have the right to access, correct, delete, or port personal data, object to or restrict processing, withdraw consent, and opt out of marketing communications.

To exercise your rights, contact us at: privacy@ekai.ai. We may need to verify your identity before fulfilling a request. If your personal data is processed by Ekai on behalf of a business customer, please direct your request to that customer first; we support our customers in handling such requests where required.

EEA/UK residents

You may also have the right to lodge a complaint with your local supervisory authority.

California residents

You may have the right to know, correct, delete, and obtain a copy of certain personal information we hold about you, and to opt out of certain disclosures where applicable under law. We will not discriminate against you for exercising applicable privacy rights.

12. Security

We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure, including access controls, encryption in transit, logging, monitoring, least-privilege practices, and vendor/security review processes. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Children’s privacy

Ekai’s website and services are not directed to children under 16, and we do not knowingly collect personal data from children under 16.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" and/or "Last reviewed" date at the top of this page.

15. Contact us

For privacy questions or requests, contact:

Ekai, Inc.
One Broadway, c/o C10 Labs, Cambridge, MA 02142
privacy@ekai.ai

For security issue reporting, you may also contact: security@ekai.ai