1. Scope
This Privacy Policy describes how Ekko handles personal information collected through our marketing site (ekkoplan.com) and through the Ekko application. If your organization uses Ekko and you're an individual whose personal information is processed inside its account — a staff member, volunteer, or other Authorized User — our Individual Data & Assessment Notice describes what applies to you specifically, and takes precedence for anything it addresses more specifically than this policy.
2. Who We Are
[Placeholder — legal operating entity name to confirm before this goes live.] Questions about this policy can be sent to privacy@ekkoplan.com.
3. What We Collect
On our marketing site: your name and email address if you request early access or join our waitlist, and standard analytics data (pages visited, browser/device information) via PostHog.
Within the Ekko application, on behalf of the organization using Ekko: account identity (name, email), role and ministry assignment, planning and calendar data, and — where your organization has enabled them — personality and spiritual-gifts assessment results and, for staff, compensation and personnel records.
4. Ekko's Role: Processor, Not Controller
For data your organization enters into or generates within Ekko, your organization is the controller (or, under the California Consumer Privacy Act, the "business") — it decides what to collect and how it's used inside the app, including who within the organization can see it. Ekko acts as a processor (or "service provider"), handling that data only to provide the Services and only per your organization's instructions, as configured in the app.
5. AI Features
Some Ekko features — including assessment-document processing, planning assistance, and whiteboard synthesis — use Anthropic's Claude API. Our agreement with Anthropic prohibits using data sent through the API to train their models without our separate express permission, and requires Anthropic to process it only as we instruct. For the specific mechanics of how Anthropic retains and handles data — which are Anthropic's own operational practices, not ours, and may be updated by Anthropic from time to time — see Anthropic's current data retention documentation.
6. Subprocessors
We use the following subprocessors to provide the Services. For each, our agreement with them governs how they may use data; for the specifics of their own current practices, we link to their own documentation rather than restate it here, since those are their operational details to maintain, not ours.
- Supabase — database and authentication.
- Railway — application hosting.
- Cloudflare — content delivery and hosting for the Ekko web app.
- Anthropic — AI processing for assessment extraction, planning assistance, and collaboration synthesis. See Section 5.
- Resend — transactional email delivery.
- PostHog — product analytics.
- API.Bible — scripture passage lookup for the Teaching Arc feature.
7. Cookies & Tracking
Our marketing site and application use PostHog for analytics, including session recording with sensitive fields masked. We do not sell personal information or share it for cross-context behavioral advertising.
8. Data Retention
We retain Customer Data for as long as your organization's account is active. If your organization removes a person's account or ends its own Ekko subscription, data is retained only as long as needed to support export and then deleted, consistent with our Terms of Service. Ekko's own documents describe what happens as a result of actions taken within Ekko — they do not track or represent your real-world relationship with your organization, which Ekko has no visibility into.
9. Your Rights
If your organization controls the data in question, requests to access, correct, or delete it should generally go to your organization first, since it decides what's collected and how it's used. For personal data you entered about yourself — such as your own self-reported assessment results — you can typically manage or delete it directly within the app. You may also contact us directly at privacy@ekkoplan.com for anything not covered by either path.
10. Children's Privacy
Ekko does not knowingly permit self-service account creation for anyone under 13, regardless of any organization's own settings. Ekko's current scope does not include collecting data about children who are not themselves Ekko account holders (for example, general children's-ministry attendee records).
11. International Users
Ekko is designed for US-based organizations. If you access the Services from outside the United States, your information will be transferred to and processed in the United States.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be reflected in a new "Last updated" date above, and may require re-acknowledgment within the app.