Privacy Policy and Data Disclosures

1. About this Privacy Policy

This privacy policy applies when you visit or use our websites and the services that refer or link to this privacy policy (each, a "Service"). This privacy policy may be supplemented by additional privacy statements, terms or notices provided to you.

Eklipsa LLC ("Provider") owns and administers the Services.

Eklipsa LLC is the controller of personal information about accounts, Professional Pilot applications, billing, support, and use of the websites and app.

Customers may upload brand and project content about their own clients, staff, or other people, and may invite workspace members or client reviewers to see material the customer chooses. For personal information in that customer content, the customer determines what is submitted and who may view it. Eklipsa LLC processes that content to provide the Service.

2. Information Provider Collects

Personal Information: In the course of providing our Services, we may collect the following types of personal information from you:

• Name, email address, and optional profile photo.
• Account credentials. Passwords are handled by our authentication provider, Supabase. Eklipsa LLC does not store plaintext passwords.
• Professional Pilot application details you submit, such as company, website, role, team size, engagement type, project timing, and workflow notes, plus referral and campaign parameters collected with that application.
• Billing contact details. Payment card numbers are collected and stored by Stripe. Eklipsa LLC does not store full card numbers.
• Brand, project, and client content you or your invited users submit, including prompts, files, workshop answers, and messages.
• Comments, feedback, and information you send to support.

Non-Personal Information: We may also collect certain non-personal information about you, such as your operating system, browser type, device information, and IP address.

3. How Provider Uses that Information

Eklipsa LLC processes personal information to provide the Service: to host and store it, to transmit it when you use a feature, to display it to your account and to people you invite, and to send the content you submit to an AI provider when you use that AI feature.

Providing and Improving Our Services: We use the information we collect to provide, maintain, and improve our Services, including to:

• Deliver the services you request and respond to your inquiries.
• Understand how users interact with and use our services to enhance the user experience.
• Develop new features and services.

"Improve" in this policy means operating, securing, and developing the Eklipsa product. Eklipsa LLC does not use your brand data or client content to train, fine-tune, or improve third-party foundation models.

If you start optional visual-style training, the assets you select are sent to fal.ai to train a style model for that brand. That step runs only when you start it.

Client files and brand content are not sent to an AI provider unless you submit that content to an AI feature or start visual-style training.

Communicating with You: We may use your information to communicate with you about your account, to send you updates or notices about our services, and to respond to your requests or questions.

Protecting Our Rights: We may use your information to protect the security and integrity of our services, to enforce our Terms of Service, and to comply with legal requirements.

Analytics: Eklipsa LLC stores product events in its own database to operate the Service, including Professional Pilot application events. Those events are not limited to visitors who accept analytics cookies.

Where required, Eklipsa LLC asks for consent before loading non-essential analytics cookies. Google Analytics 4 and Vercel Analytics load in the browser only after you accept. If Google Analytics 4 is enabled on the server, product events may also be sent to Google Analytics from Eklipsa LLC's servers.

Vercel Speed Insights loads with the site and measures page performance. It is separate from the analytics cookies described above.

Your accept or reject choice is stored in browser local storage under the name eklipsa_cookie_consent_v1. Sign-in uses essential cookies from Supabase Auth.

Eklipsa LLC does not sell your personal information and does not use your personal information for third-party targeted advertising.

4. How Eklipsa LLC Shares Your Information

Service Providers: We may share your information with third-party service providers who assist us in operating and improving our services. See Section 12 below for a list of these third-party service providers.

People you authorize: Eklipsa LLC discloses brand and project content to workspace members and client reviewers according to the access you set. Client reviewers are guests on a customer workspace. Acceptance of a Professional Pilot does not authorize Eklipsa LLC to contact or sell to your client.

Legal Compliance and Protection of Rights: We may disclose your information to government authorities or third parties if required by law or if we believe such disclosure is necessary to:

• Comply with the law or legal process;
• Protect our rights or the rights of others;
• Prevent harm to persons or property; and
• Act on a good faith belief that such disclosure is necessary to protect our interests.

Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, we may transfer your information to the acquiring entity as part of that transaction.

Aggregated and De-identified Information: We may share aggregated or de-identified information that does not directly identify you for industry analysis, demographic profiling, or other business purposes.

5. Your Privacy Rights and Choices

Access, Correction, and Deletion: You have the right to access, correct, or delete the personal information we have collected about you. To exercise these rights, please contact us at the information provided in the "Contact Information" section below. We will respond to your request within 30 days.

You can delete a brand from brand settings and delete your account from profile settings. If a paid subscription is active, cancel it before deleting the account. Canceling a paid plan ends billing at the close of the current period and does not by itself delete brand data.

Deletion follows the retention periods in Section 6A. It does not instantly erase every backup.

Data Portability: Upon request to legal@eklipsa.ai, Eklipsa LLC will provide a copy of your personal information in a structured, commonly used, and machine-readable format within 30 days. The product also exports deliverables it already generates, including a Brand Book as DOCX. There is no control that exports every database record for a client workspace in one step. Eklipsa LLC will transmit personal information directly to another controller where that transfer is technically feasible.

Right to Object: You have the right to object to the processing of your personal information for certain purposes, such as direct marketing or profiling. To exercise this right, please contact us using the information provided in the "Contact Information" section.

Cookie Preferences: Most web browsers allow you to manage cookies, including the option to delete or disable cookies. You can find information on how to manage cookies in your specific browser by visiting the browser's support website. Essential sign-in cookies are not optional. Analytics cookies are covered in Section 3. Where required, we ask for your consent before setting non-essential analytics cookies.

6. Data Security

We implement security measures to protect the confidentiality, integrity, and availability of your personal information. Our security practices include:

• Encryption in transit: Visitors reach the site over HTTPS. In production the app sends HSTS and related browser protections. Supabase states that its network traffic uses TLS 1.2 or newer.
• Encryption at rest: Supabase states that disks and backups are encrypted at rest with AES-256. That statement is Supabase's.
• Access controls: Sign-in is handled by Supabase Auth. Organization roles limit who on an account can view or change a brand. Database row-level security separates one account's rows from another's.
• Checks Eklipsa LLC runs: Automated tests cover tenant isolation, privileged database functions, and signed billing webhooks. Those checks are not a third-party certification of Eklipsa LLC. Stripe's PCI DSS Level 1 certification belongs to Stripe. Supabase's SOC 2 Type 2 statement belongs to Supabase.

While we strive to protect your personal information, no security system is impenetrable, and we cannot guarantee the absolute security of your information. In the event of a data breach, we will notify affected users and relevant authorities as required by applicable laws.

6A. Data Retention

Eklipsa LLC keeps account and brand content for as long as the account or brand remains active, unless you delete it or Eklipsa LLC must keep it longer for legal, security, or billing reasons.

Separate operational records are deleted or anonymized on a schedule: AI logs after 90 days, tool runs after 365 days, AI cache after 30 days, tool queue entries after 7 days, and intelligence-bundle telemetry after 30 days. AI feedback is kept for 730 days and the user id is then removed.

Payment records are retained as required for tax and accounting. Supabase documents daily backups on paid plans. Deletion from the live database does not instantly erase those backups.

Prompts sent to an AI provider are also subject to that provider's retention. This policy does not state a zero-retention term for those providers.

7. Compliance with Laws

This Privacy Policy complies with the applicable privacy laws and regulations in the state of Ohio, including the Ohio Personal Information Protection Act (Ohio Rev. Code Ann. § 1349.19), EU's GDPR, California's CCPA, Brazil's LGPD, and other data privacy regulations that may apply around the world.

8. Incorporation with the Terms of Service

This Privacy Policy and the disclosures in Section 12 are one document. That document is incorporated into the Terms of Service, which are also the end user license for the Service. By accessing or using our services, you agree to this Privacy Policy and Data Disclosures and to the Terms of Service.

9. Data Breaches

In the event of a data breach or security incident involving user information, we will:

• Promptly investigate the incident and take necessary measures to contain and mitigate the impact;
• Notify affected users and relevant authorities as required by applicable law. Notice to regulators and notice to users can have different triggers and deadlines;
• Provide affected users with information about the nature of the breach, the types of data involved, and steps they can take to protect themselves; and
• Cooperate with law enforcement and regulatory authorities as required.

We maintain an Incident Response Plan that outlines our procedures for detecting, reporting, and responding to security incidents and data breaches.

10. Changes to the Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you thirty (30) days ahead of any material changes by:

• Posting the updated policy on our website;
• Revising the "Effective Date" at the bottom of this document; and
• Sending an email notification to the address associated with your account.

Your continued use of our services after any such changes constitutes your acceptance of the new Privacy Policy.

11. Contact Information

If you have any questions, concerns, or notices, please contact legal@eklipsa.ai.

Privacy requests, including access, correction, deletion, and portability, go to legal@eklipsa.ai. Eklipsa LLC responds within 30 days.

12. Disclosures

Eklipsa LLC uses the vendors below to provide and operate the Services. You can view an updated list of the third-party sub-processors below:

Third parties to which Eklipsa LLC discloses personal information.