Privacy Policy

Last updated: May 2026 · Ektie Inc.

1. What we collect

We collect the minimum necessary to run the product. Here's what that means in practice:

  • Account information. Your name, email address, and company name when you sign up. If you invite teammates, we collect their emails too.
  • Workspace data. Everything you create or import inside Ektie — CRM records, contact lists, sequences, agent activity logs, AI Studio content, ad campaigns. This is your data. We don't look at it unless you ask for support.
  • Usage data. Pages visited, features used, button clicks, and session duration — collected in aggregate and anonymised. We use this to understand how the product is being used, not to profile individual users.
  • Billing information. Payment processing is handled entirely by Stripe. We never see or store your card number, CVV, or full card details. We do store your billing address and subscription tier for invoicing purposes.

2. How we use your data

We use your data to do one thing: run and improve Ektie for you. More specifically:

  • To operate the product. Serving your workspace, running agent tasks, syncing CRM data — the day-to-day mechanics of the platform.
  • To communicate with you. Transactional emails like trial expiry notices, invoices, password resets, and critical product announcements. We don't send marketing emails unless you opt in.
  • To provide support. If you open a support ticket, we may access your workspace data to diagnose the issue. We'll always tell you if we do.
  • To improve the product. We analyse aggregated, anonymised usage patterns to decide what to build next. We never analyse individual activity for advertising purposes — full stop.

3. Data sharing

We don't sell your data. We never have. We never will. We share data only with the sub-processors required to run the product:

  • DigitalOcean — cloud infrastructure and storage. Data is hosted in DigitalOcean's managed data centres.
  • Stripe — payment processing and billing. Governed by Stripe's own privacy policy and PCI DSS compliance.
  • Resend — transactional email delivery (invoices, trial notifications, password resets).
  • OpenAI / Anthropic — AI model inference powering agent tasks. When an agent processes a task, the relevant workspace context is sent to the model API. This data is never used to train models for other customers, and is never shared with any other Ektie workspace. We use zero-data-retention API agreements where available.

A full sub-processor list is available on request — email privacy@ektie.com.

4. Google API Services

Ektie's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data accessed

When you connect a Google account, Ektie may access the following data depending on which features you enable:

  • Google Profile & Email (userinfo.email, userinfo.profile) — Your name and email address, used solely to identify your connected account inside Ektie.
  • Gmail — Send (gmail.send) — Used to send outbound sales and marketing emails that you compose inside Ektie on your behalf.
  • Gmail — Read (gmail.readonly) — Used to display received email conversations inside your Ektie inbox so you can view replies from prospects without leaving the CRM.
  • Google Calendar (calendar.events) — Used to create and display calendar events for meetings you schedule or log within Ektie.
  • Google Analytics (analytics.readonly) — Used to display read-only website performance metrics from your connected GA4 property inside your Ektie dashboard.
  • Google Search Console (webmasters.readonly) — Used to display read-only search performance data from your verified Search Console property inside your Ektie dashboard.
  • Google Ads (adwords) — Used to read and manage campaign performance data for your connected Google Ads account (Search, Display, Performance Max, Demand Gen campaigns only).

Data usage

Google user data is used exclusively to provide the features you have explicitly activated:

  • Gmail data is used only to send emails on your behalf and to render your email conversations inside the CRM. We do not scan, analyse, or process email content for any other purpose.
  • Calendar data is used only to create and display events that you initiate inside Ektie.
  • Analytics and Search Console data is rendered as read-only dashboards for your own property. We do not write to or modify your Analytics or Search Console data.
  • Google Ads data is used only to read campaign metrics and apply campaign changes that you explicitly request inside Ektie.
  • Google user data is never used for advertising, profiling, or any purpose unrelated to operating the features you have enabled.

Data sharing

Google user data is never sold, rented, or shared with any third party for advertising, marketing, or any other purpose. It is shared only with the infrastructure providers (e.g. cloud hosting) strictly necessary to operate the service, under data processing agreements that prohibit any other use.

We do not allow humans to read your Google user data except with your explicit permission (e.g. if you ask our support team to diagnose an issue) or where required by law.

Data storage & protection

  • OAuth access tokens and refresh tokens obtained from Google are stored encrypted at rest using AES-256.
  • All data is transmitted over TLS 1.3.
  • Access to token data is restricted to authenticated, authorised system processes only and is never exposed in logs or error messages.

Data retention & deletion

  • Google OAuth tokens are retained only while your connected account remains active.
  • When you disconnect a Google account (Settings → Connected Accounts), all associated tokens are immediately and permanently deleted.
  • When you delete your Ektie account, all Google tokens and any cached Google data are permanently deleted within 30 days.
  • To request expedited deletion, email privacy@ektie.com — we will action it within 5 business days.

6. Data retention

Your workspace data is retained for as long as your account is active. If you cancel:

  • You have 30 days to export everything — CRM contacts, sequences, agent logs, AI Studio assets. Your dashboard remains accessible during this window.
  • After 30 days, your data is queued for deletion and fully removed within 60 days of cancellation.
  • Anonymised, aggregated usage analytics (no personal data) may be retained beyond that window for product improvement purposes.

If you need an expedited deletion — for example, to meet a regulatory deadline — email us at privacy@ektie.com and we'll action it within 5 business days.

7. Your rights

You're in control of your data. From your account settings you can:

  • Access all data associated with your account.
  • Correct inaccurate information at any time.
  • Export a full data dump in standard formats (CSV, JSON).
  • Delete your account and all associated data.

For formal GDPR or CCPA requests — including right-to-erasure, data portability, or opt-out of processing — email privacy@ektie.com with the subject line "Privacy Request." We respond to all requests within 30 days.

If you're in the EU, you also have the right to lodge a complaint with your local data protection authority if you believe your rights have been infringed.

8. Cookies

We keep cookies minimal and purposeful. Here's what we use:

  • Session cookies. Required to keep you logged in. Without these, the app cannot function.
  • Preference cookies. Small cookies that remember things like your UI settings so we don't ask again every session.

What we don't use: advertising trackers, third-party analytics cookies (Google Analytics, Meta Pixel, etc.), or any cookies that follow you across sites. There are none.

You can disable cookies in your browser at any time. Just be aware that session cookies are required for the app to work — without them you won't be able to sign in.

9. Security

Security is a first-class concern, not an afterthought. The short version:

  • Encryption in transit: All data between your browser and our servers is encrypted using TLS 1.3.
  • Encryption at rest: All stored data is encrypted using AES-256.
  • Workspace isolation: Every Ektie workspace is isolated at the database level. Your CRM data, agent logs, and AI Studio content are never commingled with another customer's data — even at the query layer.
  • Access controls: Production data access by Ektie employees requires multi-factor authentication, is logged, and is audited quarterly.

For a detailed breakdown of our security architecture, certifications, and responsible disclosure process, see our Security page.

10. Changes to this policy

We'll update this policy as the product evolves. When we make changes that matter — new data types collected, new sub-processors, changes to retention periods — we'll let you know.

For material changes, we'll send an email to the address on your account and show an in-app notice at least 14 days before the changes take effect. Minor clarifications or wording fixes may be made without notice.

The "Last updated" date at the top of this page always reflects the most recent revision.

11. Contact us

Questions about this policy? Something doesn't look right? Reach out:

We're a small team and we read every message. If something in this policy is unclear or confusing, tell us — we'd rather fix the policy than leave you guessing.