Privacy Policy

Effective Date: 2026-10-27 Version: 1.3

1. Data Controller

The data controller for the processing of your personal data is Ecliptio Ltd, a company registered in Malta (Company Registration Number: C111698), with registered office at Northlink Business Centre Level 2, Triq Burmarrad, Naxxar, NXR 6345, Malta, VAT Number MT31906033.

For privacy-related inquiries: privacy@eclipt.io

2. Data We Collect

2.1 Data You Provide

• Account Data: name, email address, password, avatar image, preferred language
• Profile Data (optional): last name, company name, address (street, city, province, postal code, country), phone, WhatsApp contact, Microsoft Teams webhook, bio, time zone
• Workspace Data: Workspace name, slug, member roles, AI configuration (encrypted credentials at rest)
• Customer Data: any content, code, files, media, secrets, database rows, or other material you upload, generate, or store within the Platform
• Payment Data: processed by Stripe; we store only transaction IDs, amounts, subscription status, and VAT-relevant invoice data. We never store credit card numbers
• Communication Data: messages and attachments sent to our support team

2.2 Data Collected Automatically

• Usage Data: features used, conversation counts, session duration, AI inference token counts (for billing and trial tracking)
• Device Data: browser type, operating system, device type, screen resolution (usage and device data are collected through a cookieless analytics tool that Ecliptio runs on its own servers in Germany)
• Log Data: IP address and browser information of each login (for security and abuse detection), access timestamps, error logs

2.3 Data We Do NOT Collect

• We do not track precise geolocation
• We do not collect biometric data
• We do not aggregate or sell any data to advertisers or data brokers

3. Legal Bases for Processing (GDPR Art. 6)

• Contract Performance (Art. 6(1)(b)): account creation and login, providing the Platform services, processing payments and subscriptions, billing trial credit usage
• Legitimate Interest (Art. 6(1)(f)): Platform security, fraud and abuse prevention, infrastructure monitoring, customer support, product analytics through a cookieless analytics tool that Ecliptio runs on its own servers
• Consent (Art. 6(1)(a)): marketing communications
• Legal Obligation (Art. 6(1)(c)): tax records, anti-money laundering requirements, responding to lawful data access requests

4. How We Use Your Data

• To provide, operate, and maintain the Platform, including AI inference, hosting, storage, and deploys
• To authenticate users and secure accounts (including email verification and password reset)
• To process payments and manage subscriptions via Stripe
• To send transactional emails (verification, password reset, invitations, billing) via our email delivery providers
• To send marketing communications, but only with your explicit opt-in consent (see Section 7); you can unsubscribe at any time
• To improve the Platform through aggregated, non-identifying analytics
• To provide customer support
• To detect and prevent fraud, abuse, and misuse of AI features
• To comply with legal obligations and respond to lawful requests

5. Data Sharing and Transfers

5.1 Third-Party Processors

We share personal data with the following processors, each bound by Data Processing Agreements (DPAs) where applicable. The exact set of processors depends on your AI Configuration and feature usage.

• Anthropic (USA): AI inference, when your Workspace uses Anthropic models. Receives prompt content from Specialists. Transfer basis: EU Standard Contractual Clauses (SCCs)
• OpenAI (USA): AI inference, when your Workspace uses OpenAI models. Receives prompt content. Transfer basis: SCCs
• Google (USA/EU): AI inference (Gemini) when configured. Receives prompt content. Transfer basis: SCCs and adequacy
• OpenRouter (USA): AI router, when the AI model used by your Workspace for a task (by default or as chosen in its settings) is reached through OpenRouter. Receives prompt content. With Ecliptio's account, only providers that do not use the data to train their models are used (Section 11.3). Transfer basis: SCCs
• DeepSeek (Hong Kong / global): AI inference, when configured. Receives prompt content. Transfer basis: SCCs and supplementary measures
• Exa Labs (USA): Web search, when the AI assistant searches the web for a task. Receives the search query written by the assistant, which may contain words from your request. Exa's privacy policy states that it may use search queries to improve its services, including to train its models
• Runware (United Kingdom; services hosted in the USA, Germany and Romania): Image and video generation, when a task uses an image or video model reached through Runware with Ecliptio's account. Receives the prompt and any reference images. Runware's terms do not state whether the prompts it receives for generation may be used to train models
• Pixabay (Germany): Stock image search, when the AI assistant looks for photos for a task. Receives the search query written by the assistant, which may contain words from your request
• Stripe (USA): Payment processing. Receives payment details. Transfer basis: EU-US Data Privacy Framework + SCCs
• mxroute (USA): Email delivery and the Platform's own mailbox, on servers in the USA. Receives recipient email and message content
• Wasabi Technologies (USA, data stored in the EU): Object storage for media and project files, in its EU South 1 region (Milan, Italy), and for the encrypted nightly backup of the Platform (its databases and server files), in its EU Central 2 region (Frankfurt, Germany). The data stays in these regions; Wasabi may access it from other countries to provide its service. Transfer basis: SCCs
• Hetzner (Germany): Hosting infrastructure for the Platform, its database, some files and the search-index model run by Ecliptio (Section 5.5), on servers in Germany. EU-based, no international transfer

5.2 Self-Configured Third Parties

If you configure your Workspace to use Bring-Your-Own keys (e.g., your own OpenAI key), an AI subscription of your own connected to the Platform, or self-hosted inference endpoints, prompts and outputs flow through providers and infrastructure of your choosing. Ecliptio is not the data controller or processor for such flows; you are. Your relationship with that provider is governed by their terms.

5.3 International Transfers

Where personal data is transferred outside the EEA, the transfer basis is indicated in Section 5.1 for each processor for which one is in place (EU Standard Contractual Clauses (SCCs), the EU-US Data Privacy Framework or an adequacy decision). Supplementary technical measures include encryption in transit (TLS 1.2 or higher) and, for data stored with Wasabi and for our backups, encryption at rest (AES-256).

5.4 We Do NOT

• Sell your personal data to third parties
• Share your Customer Data, Workspace content, or conversation history with advertisers
• Use your Customer Data for AI model training (ours or third parties'), except that web search queries are sent to Exa, which may use them for training, and that Runware's terms do not state whether it may use image and video generation prompts for training (Section 5.1); when your Workspace uses its own key or connected subscription, that provider's terms apply (Section 5.2)
• Use your data for automated profiling or decision-making that produces legal effects

5.5 Where Your Data Is Processed

• The Platform and its database run on Hetzner servers in Germany.
• AI tasks performed with models that Ecliptio runs itself are processed on computing machines owned by Ecliptio and located in Malta (for example, by default, the assistant's chat, and recognizing the language a message is written in), or on our Hetzner servers in Germany (the search index of your projects' content, also called embeddings). No AI provider receives this data, and these models do not learn from it.
• Media and project files are stored with Wasabi in Italy (Milan), unless your Workspace sets up its own storage. Some other uploads (for example account avatars, logos and brand images) and some older media are stored on our Hetzner servers in Germany.
• The encrypted nightly backup of the Platform (its databases and server files) is stored with Wasabi in Germany (Frankfurt). Data that is deleted can remain in this backup until the backups that contain it expire, within about 6 months (Section 6).
• When the assistant's web search does not go through Exa, it goes through a search service that Ecliptio runs on its Hetzner servers in Germany, which forwards the query to public search engines without any identifier of you or your Workspace.
• When your Workspace uses an external AI provider (Section 5.1), the prompt content is processed by that provider.

6. Data Retention

• Account Data: retained for the duration of your account. Accounts are not yet deleted from the app: to delete your account, write to privacy@eclipt.io from its email address, and we delete it within 30 days of your request
• Customer Data: retained for the duration of your subscription. When the owner deletes a Workspace in the app, the following are deleted immediately and together: its projects and their content in our database, its conversations and members, its AI keys, its connections to other services (Section 14) with their access tokens, its server and database connections, its project API keys, and its mailboxes with their messages. If the deletion cannot be completed, nothing is deleted and the app says so. The following are not yet deleted automatically: the files it stored (media and project files, with Wasabi and on our servers), its activity and planning history, and its design presets; the personal memories of its members belong to their own accounts and are not deleted with it. A personal Workspace cannot be deleted in the app. In these cases, write to privacy@eclipt.io and we delete all the data linked to the Workspace within 30 days of your request. On an account deletion request, Customer Data is deleted within 30 days. In both cases, except where retention is required by law
• Conversation History: retained for the duration of your account; the conversations of a Workspace are deleted with it, and all of them within 30 days of an account deletion request
• Payment and Billing Records: retained for 10 years as required by Maltese tax law
• Log Data: IP addresses and browser information are kept with the login records of your account: older login records are deleted as new ones are created, and all of them with your account. Web server access logs are overwritten within a few days. Application error logs are not yet deleted on a fixed schedule
• Marketing Consent Records: your choice and the date you opted in are kept with your account and deleted with it
• Encrypted API Keys: your own AI provider keys are kept, encrypted, as long as they are saved in your Workspace's AI settings, whatever plan the Workspace is on; they are deleted when you remove them there, when the Workspace is deleted, or within 30 days of an account deletion request
• Backups: data that is deleted, by you or at your request, can remain in our encrypted nightly backups (Section 5.5) until the backups that contain it expire, within about 6 months; after that it is no longer part of any backup. Files deleted from our storage at Wasabi can also remain in its version history, from which older versions are not yet removed automatically; on a deletion request we remove them within 30 days
• One-off maintenance copies: before some maintenance work we also make one-off copies of the database or of stored files, on our servers in Germany. They do not follow the schedule above: they are kept until we delete them, and data deleted from the Platform can remain in them until then (and in the nightly backups for up to about 6 months after that)

7. Marketing Communications and Opt-In

We will only send you marketing communications (e.g., product updates, feature announcements, newsletters) if you have explicitly opted in by ticking the dedicated checkbox at signup or in your account settings. Opt-in is not a condition of using the Platform.

You can withdraw consent at any time by:

• Clicking the "Unsubscribe" link in any marketing email
• Disabling marketing emails in your account settings
• Replying to any marketing email with "unsubscribe"

Withdrawing consent does not affect transactional emails (such as verification, password reset, invoices, security alerts), which are sent on the basis of contract performance and cannot be opted out of while you have an active account.

8. Your Rights (GDPR Art. 15-22)

As a data subject under GDPR, you have the following rights:

• Right of Access (Art. 15): request a copy of all personal data we hold about you
• Right to Rectification (Art. 16): correct inaccurate or incomplete data
• Right to Erasure (Art. 17): request deletion of your data ("right to be forgotten")
• Right to Restriction (Art. 18): restrict processing in certain circumstances
• Right to Data Portability (Art. 20): receive your Customer Data in a structured, machine-readable format
• Right to Object (Art. 21): object to processing based on legitimate interests
• Right to Withdraw Consent (Art. 7(3)): withdraw consent at any time without affecting prior processing
• Right to Lodge a Complaint: with the Office of the Information and Data Protection Commissioner (IDPC), Malta, or your local supervisory authority

To exercise any of these rights, contact: privacy@eclipt.io. We will respond within 30 days as required by GDPR.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit (TLS 1.2 or higher); encryption at rest (AES-256) for files stored with Wasabi and for our backups. The database and the files on our Hetzner servers are protected by access controls but are not encrypted at rest
• Passwords stored as bcrypt hashes (never in plaintext)
• AI provider API keys encrypted with AES-256-GCM before storage
• Workspace-level multi-tenant isolation enforced by the application
• Security reviews of the Platform's code and of the software it depends on
• Role-based access controls limiting employee access to personal data on a need-to-know basis
• Secure API authentication for all third-party integrations
• Limits on repeated login and password-reset attempts

Customer Data and Workspace content are tagged with their Workspace ID in the database, and the application gives access to them only to the members of that Workspace. We do not access Workspace content except where strictly necessary to provide support (e.g., when you submit a support ticket and reference specific data) or to investigate abuse.

10. Children's Privacy

The Platform is not intended for use by anyone under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that a user is under 18, we will promptly delete their account and associated data.

11. AI-Specific Privacy Provisions

When you use AI-powered features, prompts and (where relevant) attachments are sent to the AI provider configured for your Workspace.

11.1 Data Sent to AI Providers

When you use AI features, the following may be transmitted to your configured AI provider:

• The text of your prompt or instruction
• Conversation context selected by the Specialist (which may include prior messages, attached files, project metadata)
• Skill configuration metadata
• Where image generation or vision is used: image data

11.2 Data NOT Sent to AI Providers

The following are NEVER included in AI provider requests by Ecliptio:

• Your email address, account ID, or other identifiers of your account (beyond what you may have voluntarily included in a prompt). Your name as written in your account and your role in the Workspace are included, so that the assistant knows who it is talking to
• Your password or authentication credentials
• Payment information
• Other Workspace members' private content unless explicitly attached by you to the conversation

Content that reaches your Workspace through a connected account, such as a comment and the name of the person who wrote it, is sent to the AI provider only as described in Section 14.7.

11.3 AI Provider Data Handling

We rely on AI providers' published policies for their handling of API requests. Most providers (e.g., Anthropic, OpenAI, Google) state that API inputs are not used for model training and are retained only transiently for trust and safety monitoring. We recommend reviewing your chosen provider's data use policy.

When a request goes through OpenRouter with Ecliptio's account, we ask OpenRouter to use only providers that, according to OpenRouter, do not use the data to train their models (OpenRouter's data_collection: deny setting). This does not mean that those providers keep no copy: each of them retains requests according to its own policy, for example for abuse monitoring. OpenRouter does not offer this setting for its image and video generation endpoints, which Ecliptio Studio does not use for data received from connected accounts. If your Workspace uses its own OpenRouter key, the privacy settings of your OpenRouter account apply.

If you use Bring-Your-Own keys, an AI subscription of your own connected to the Platform, or a self-hosted inference endpoint, the data handling of those flows is governed by the provider you have chosen, not by Ecliptio.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will inform registered users of material changes by email before they take effect. The effective date of the latest revision is always indicated at the top of this document.

13. Contact and Supervisory Authority

Data Controller: Ecliptio Ltd, Northlink Business Centre Level 2, Triq Burmarrad, Naxxar, NXR 6345, Malta Company Registration: C111698 | VAT: MT31906033 Privacy Contact: privacy@eclipt.io

Supervisory Authority: Office of the Information and Data Protection Commissioner (IDPC) Level 2, Airways House, High Street, Sliema SLM 1549, Malta Website: https://idpc.org.mt

14. Connected Accounts (Google, YouTube, Meta, LinkedIn and Other Services)

Ecliptio Studio lets a business connect its own accounts on third-party services (for example Google, YouTube, Meta's Facebook, Instagram and Threads, LinkedIn, Mailchimp). Connecting is optional and is done by a Workspace member from Settings › Connectors; each service asks for your consent on its own screen, and you can see there exactly what is requested.

14.1 What we access and why

• Google: only the Google Drive files you explicitly select with the Google file picker, and read-only Google Analytics 4 reports of the properties you have access to. We use them only to show you your own data and to let the in-app assistant read it when you ask.
• YouTube (YouTube API Services): for a channel you connect: the channel name, uploading the videos you choose to publish (with the title, description and visibility you set), and reading the comments on videos published from Ecliptio Studio and posting the replies you approve. Ecliptio Studio uses YouTube API Services: by connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's use of your data is described in the Google Privacy Policy.
• Meta (Facebook Pages and Instagram professional accounts): the list of Pages and linked Instagram accounts you manage, so you can choose where to publish; publishing the posts you have approved; reading the comments, and the replies to them, on posts published from Ecliptio Studio in the last 90 days (text, time, and the author's name and ID on Facebook or username on Instagram), every 5 minutes and when you open the Inbox, and posting the replies you approve; and the profile analysis described in Section 14.6.
• Meta (Threads profiles): your profile's ID, username and name; publishing the posts you have approved (text, one or more images, or a video); reading the replies, and the replies to them, to threads published from Ecliptio Studio in the last 90 days (text, any images or videos, the author's username and the time), every 5 minutes and when you open the Inbox, and posting the replies you approve; and, in Marketing › Profiles, your profile and the list of your own latest Threads posts (Section 14.6), visible only inside your Workspace.
• LinkedIn (Company Pages): publishing the posts you have approved and reading their comments and engagement.
• Telegram and Discord: publishing the posts you have approved to your channel, through the Ecliptio Studio Telegram bot that you add as an administrator of your channel (or a bot of your own), or through your Discord channel's webhook. Comments on these channels are not read.
• Other services: only the data needed for the feature you use, as shown on the service's consent screen.

Nothing is published or answered on your behalf without your approval.

14.2 What we never do

• We do not sell data obtained from connected services, and we do not use it for advertising.
• We do not use data obtained from Google APIs to develop, improve or train general-purpose AI models. We do not use data obtained from the Meta Platform (Facebook, Instagram, Threads) to train any AI model, and the AI providers that process it on our account do not train on it: the models Ecliptio runs itself do not learn from it (Section 5.5), through OpenRouter only providers that do not use data for training are used (Section 11.3), and Anthropic's commercial terms do not allow it to train on our requests. If your Workspace uses its own key or a connected AI subscription of its own for a task, that provider's terms apply (Section 5.2).
• We do not share it with third parties, except the processors needed to provide the feature you asked for (Section 5.1 and Section 11), under contract.
• Ecliptio staff do not read it, unless you ask us to for support, for security reasons, or where required by law.

14.3 Google API Services User Data Policy

Ecliptio Studio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

14.4 Storage

Access tokens for connected services are stored encrypted. Content read from a service is kept only as part of the conversation or work in which you used it, and is deleted together with it (Section 6). Comments and replies read from Facebook, Instagram and Threads, the replies suggested for them, and the profiles and profile analyses of Section 14.6 are kept in the project of your Workspace they belong to, so your team can work on them (for images and videos in comments and replies we keep only their web addresses); they are deleted with your Workspace (Section 6) or on a deletion request (Section 14.5).

14.5 How to disconnect and delete your data

• Disconnect: in Settings › Connectors, delete the connection. We immediately delete the stored access tokens. You can also revoke access from the service itself: for Google and YouTube, at any time from the Google security settings page (Google Account › Security › Third-party connections); Facebook › Settings › Business integrations; Threads › Settings › More settings › Website permissions › Active › Remove; LinkedIn › Settings › Data privacy › Permitted services. When you remove Ecliptio Studio on Facebook or Threads, Meta informs us and we switch off the connection and delete its access tokens.
• Delete your data: write to privacy@eclipt.io from your account's email address with the subject "Data deletion request". Within 30 days we delete all data obtained from the connected service and confirm by email. Deleting your Workspace deletes the comments, replies, profiles and analyses obtained from it, together with its connections and their access tokens.
• Deletion request through Meta: if you ask Facebook or Threads to have Ecliptio Studio delete your data, Meta forwards the request to us. We switch off the connection, delete its access tokens and stored details, and delete the data received through it: the comments and replies read (with the replies suggested and sent), the in-app notices, translations and Inbox contacts made only from them, and the profiles with their daily counts and analyses. Your posts stay, because your team wrote them in Ecliptio Studio; on Threads we remove from them the identifiers of your profile, and a post still scheduled to it is marked as not published. Notifications already shown on your team's devices are not affected. Meta receives a confirmation code and the address of a page where you can check the status of your request.

After a deletion request, copies in our encrypted backups remain until those backups expire, within about 6 months, and copies can remain in one-off maintenance copies until they are deleted (Section 6).

14.6 Profiles and profile analysis

In Marketing › Profiles a business sees how its own Facebook Pages, Instagram professional accounts and Threads profiles are doing.

• When you open Profiles, we read each profile of the project: name, username, description or biography, website, category (Facebook), profile picture, followers and, for Instagram, accounts followed and number of posts. We keep one record per day of the follower and post counts, so you can see how they change. For Threads we read the name, username, picture and biography, and, when you open the Threads profile, its latest posts (text, images or videos, date and link), which are read each time and not saved. Profile details that are read are kept in the server's memory for at most 10 minutes, so they are not requested again at every click.
• When you click Analyze (Facebook and Instagram), we also read the profile's posts of the last 90 days: text, date, type, image or thumbnail, link, and the number of likes or reactions, comments and shares. Ecliptio Studio counts posts per week, formats, times and interactions, and shows the most and the least liked posts with their text, image and link. The AI assistant then writes an assessment and suggestions: the profile data and the posts' text, date, type and interaction counts are sent to the AI model your Workspace uses for this task (Section 11). The analysis is saved in the project, so you can compare it over time.
• Profile pictures: to tell you whether your profiles use the same picture, we download each profile picture for a moment and compute a small fingerprint of it (8×8 pixels) to compare them. The picture itself is not saved: we keep only its web address as provided by Meta, and the fingerprint stays in memory for at most 6 hours.

14.7 Suggested replies, translations and notifications

• Suggested replies: when a comment or reply arrives, the AI assistant labels it (question, complaint, compliment, spam, other) and suggests a reply in the commenter's language (if the comment is too short to tell, in the language of the commented post or of your project). For this, the text of the comment and the name of its author, together with the text of the commented post and your business's name, description, website and brand voice, are sent to the AI model your Workspace uses for comments (Section 11 and Section 5.1). The language of the comment is recognized by a model running on Ecliptio's own machines (Section 5.5). If the comment contains images or videos, the model is only told how many there are; they are not sent to it. Nothing is posted until a member of your team clicks Reply or sends the suggestions.
• Translation: when you click Translate on a message, its text is sent to the AI model your Workspace uses for this task. The translation is saved, so it is not requested twice.
• No training: data received from Facebook, Instagram and Threads is not used to train AI models, neither by Ecliptio nor by the AI providers that process it on our account; if your Workspace uses its own key or connected subscription, that provider's terms apply (Section 14.2).
• Notifications: when a new comment or reply arrives (written in the last 24 hours and not spam), the members of your Workspace's team who have turned on notifications on a device receive a notification with the author's name, the project and the first 160 characters of the text. Its content is encrypted end to end: the push service of the device's browser (for example Apple, Google or Mozilla) delivers it but cannot read it.