Eklo Privacy Policy (0.9 private beta)
Last updated
This policy explains what personal data Eklo handles during the 0.9 private beta, why, and the choices you have. Effective date: November 3, 2026.
1. Who we are and our two roles
Mind Mill Media, LLC, PO Box 2922, Cleveland, TN 37320 ("Eklo", "we") runs Eklo, a workspace app for churches. We play two different roles:
| Data | Our role | Who decides how it's used |
|---|---|---|
| Church data: what a church and its people put into its workspace (members, form submissions, messages, tasks, files) | Processor, acting for the church | The church. Ask your church about its data; we help it answer. Your own Ask Eklo data is the exception (section 9). |
| Account data, sign-in data, beta requests, marketing-site data, and support conversations with us | Controller | Eklo, as this policy describes |
We process church data under our Terms of Service and Data Processing Addendum, and only to provide the service the church asked for. Each church should give its own people a privacy notice that covers what it collects in Eklo.
2. What we collect
| Category | What it includes | Where it comes from | Our role |
|---|---|---|---|
| Account data | Name, email, optional phone and profile image; the workspaces you belong to and your role in each | You or the church admin who invites you | Controller |
| Sign-in data | Sign-in sessions with IP address, browser user agent and the sign-in method used; one-time codes and links (they expire after 5 and 10 minutes); passkeys if you add one; for Google sign-in, your Google account ID and the tokens Google returns | You, your browser, Google | Controller |
| Security records | A record of sensitive actions, with who took each one, when, and their IP address. They cover exporting data, deleting or restoring a workspace, deleting an account, removing a member or leaving a workspace, turning AI on or off, single sign-on and domain changes, a workspace owner's emergency sign-in, deleting someone else's chat message, a file that malware scanning finds harmful, and Eklo staff actions in our support console | Our servers | Controller |
| Church workspace content | Tasks and comments, chat and direct messages, forms and submissions, files and Library media, member and email-audience lists, custom fields, teams and campuses, conversations with Ask Eklo, the AI assistant, and the notes it keeps and images it makes | The church's staff, members and guests | Processor |
| Public form submissions | The answers, a name and email if the form asks, and the submitter's IP address | People who fill in a church's public form | Processor |
| Beta requests | Church name, your name, email, role and weekly attendance range, how you heard about Eklo, anything else you tell us, when you confirmed that the church is tax-exempt, and the IP address you send the request from. If you send the request from our website, also how you found it: the domain of the site that sent you, campaign (UTM) tags, the kind of source (such as search or social) and the first page you opened | You, your browser | Controller |
| Church billing and tax details | The church's legal name, US billing address and, if given, its EIN; the proof of tax exemption the workspace owner uploads (such as an IRS determination letter or a state exemption certificate), with its file name and who uploaded it when; the owner's confirmation that the church is tax-exempt and acceptance of our Terms, with who gave them, when and which version; our staff's review of the proof and any note; and whether we cover the church's plan. Stripe collects payment details itself: we receive the plan, the subscription's status and billing dates, and Stripe's customer ID for the church, never card numbers | The workspace owner; Eklo staff; Stripe | Controller |
| Support conversations | What you write to us in support tickets or by email, and our replies | You | Controller |
| Marketing-site analytics | A random visit ID that lasts only while the page is open, the pages you view, the domain of the site that sent you (not the full address), campaign (UTM) tags, the kind of source (search, AI assistant, social, email, referral, campaign or direct), your country as reported by our CDN, and your browser user agent. This record does not store your IP address, and we discard page views from known bots and automated browsers. | Your browser; country from Amazon CloudFront | Controller |
| Error and diagnostic data | Error messages, stack traces, the page or API route, browser and device type | Your browser and our servers, via Sentry | Controller |
Bot checks. Public forms and the request-access form use Cloudflare Turnstile. It reads signals such as your IP address, TLS fingerprint and browser user agent to tell people from bots.
Cookies. Eklo uses a signed session cookie to keep you signed in, plus short-lived cookies that signing in needs, such as those that protect the Google sign-in redirect and passkey checks. The Eklo app also keeps your current workspace and any pending invitation in your browser's local storage, and our docs pages may store your light or dark theme choice there. We don't use advertising cookies. The marketing site's analytics sets no cookies and stores nothing in your browser.
3. How we use data
For data we control, we use it to:
| Purpose | Legal basis (EU/UK) |
|---|---|
| Create and secure your account, sign you in, and send sign-in codes and links | Contract |
| Run, maintain, debug and protect the service, including bot checks and error monitoring | Legitimate interests |
| Review beta requests and talk to churches about joining | Steps before a contract; legitimate interests |
| Bill churches for paid plans, work out and collect sales tax, and review proof of tax exemption | Contract; legal obligation |
| Answer support requests | Contract; legitimate interests |
| Understand how people find and use our marketing site, and which sources lead to beta requests | Legitimate interests |
| Meet legal obligations and enforce our Terms | Legal obligation; legitimate interests |
We use church data only to provide the service to that church, as its instructions and our DPA allow. We don't sell personal data, and we don't use it for targeted advertising.
4. AI features
Some Eklo features send data to AI providers:
- Ask Eklo. Your message, and the workspace content Ask Eklo looks up to answer it, go to OpenAI or Anthropic, whichever we're using to answer Ask Eklo at the time. That content can include tasks and projects, messages in channels you can read, the people in the workspace (names, titles, roles and managers, and an email address when someone has no name, or shares a name with someone else and no title, team or role of theirs alone tells them apart), its teams and forms, and the requests you've sent or can decide (form name, reference, stage, who sent each and who it waits on or who decided it, but never the answers). Your church's name and time zone, your name and role, and any notes you've asked Ask Eklo to remember go with every question. If you press Summarise on a channel, thread or task, what's in it goes too, such as its messages or comments and who wrote them, and it's read again with each follow-up in that conversation. The names of files you attach go with your message, and a file's contents go when Ask Eklo reads it. The most recent earlier questions and answers in the same conversation, including what Ask Eklo looked up for them, are sent again so it can follow up. Ask Eklo conversations are saved in the workspace, and only the person who had a conversation can see it.
- Ask Eklo web search. While Anthropic answers Ask Eklo, it can search the web and open web pages. Anthropic, not Eklo, runs these searches and opens these pages, so the search words and web addresses Ask Eklo uses, which can include details from your question or your workspace, go to Anthropic.
- Ask Eklo images. When you confirm an image, the description Ask Eklo wrote for it goes to OpenAI, even while Anthropic answers Ask Eklo. That description can include details from your workspace. Only you can see the image, and it's kept for 90 days.
- Library images. The Library isn't available during the beta. Once it is, images you tag with AI will go to OpenAI or Anthropic, whichever we're using for image tagging at the time. AI edit requests are not sent to an AI provider: Eklo saves your request as a note on a new version of the image for your team to review.
Both providers' business terms say they do not train their models on this data by default. When enabled, a sample of Ask Eklo requests (currently about 5%) is traced with Braintrust so we can monitor how AI features perform. Traces carry no user or workspace identifiers. They record the AI model used, tool names, the kinds and sizes of content, token counts, timing and whether a call failed, but not prompts, workspace content or AI output.
Workspace owners and admins can turn AI features off in Settings → General. While they're off, nothing from that workspace is sent to an AI provider, apart from the rest of any answer Ask Eklo was already writing when they were turned off. Turning AI off doesn't delete past Ask Eklo conversations or the notes it remembers.
5. Who we share data with
- Service providers (subprocessors) that host, email, monitor and power Eklo, under contracts that limit their use of the data. The current list, with locations, is in Subprocessors.
- People in your church's workspace, according to the roles and sharing settings the church chooses.
- Eklo staff, only to operate, secure and support the service, or when the law requires. Staff actions in our support console are kept in the security records described in section 2, with the staff member's IP address.
- Authorities or others when the law requires it, or to protect the rights, safety or property of users, the public or Eklo.
- A buyer or successor if Eklo is part of a merger, acquisition or sale of assets, subject to this policy.
6. International transfers
Eklo is hosted by Amazon Web Services in the United States (us-east-1, Northern Virginia), and most subprocessors process data in the US. During the beta, Eklo accepts churches based in the United States only and doesn't offer the service to people in the EEA, UK or Switzerland. If you contact us or visit our website from there, your data is processed in the US. Before we accept a church there, we will put a transfer safeguard in place, such as the European Commission's Standard Contractual Clauses and the UK and Swiss equivalents, and update this policy.
7. How long we keep data
| Data | How long |
|---|---|
| Sign-in codes and links | Expire after 5 minutes (codes) and 10 minutes (links) |
| Account data | While your account is active. Deleted as soon as you delete your account in Settings → Profile, along with your personal task templates and the conversations, attached files, notes and reminders you have in Ask Eklo; anything else you added to a church's workspace stays with that church, shown as from "Deleted user" |
| Church data, including form submissions | Until the church deletes it or deletes its workspace. A deleted workspace can be restored for 30 days, then it is permanently deleted |
| Ask Eklo conversations | Deleted by a daily job 90 days after their last message, or sooner when the person who had one deletes it, deletes their account, leaves or is removed from the workspace, or the church deletes its workspace. Turning AI off doesn't delete them |
| Files attached to Ask Eklo | Deleted by a daily job 30 days after they're attached, or with their conversation; the conversation keeps the file's name. Files attached but never sent are deleted after a day |
| Images Ask Eklo makes | 90 days, or sooner if the person who asked for one deletes its conversation or their account, leaves or is removed from the workspace, or the church deletes its workspace |
| Notes Ask Eklo remembers for you | Until you delete them (in Settings → Profile or by asking Ask Eklo), delete your account, leave or are removed from the workspace, or the church deletes its workspace. Once one is deleted, exact copies of it in the conversation that saved or forgot it are replaced |
| Reminders Ask Eklo sets for you | Until you cancel one, delete your account, leave or are removed from the workspace, or the church deletes its workspace. A daily job deletes a reminder 30 days after it's sent; the notification it sent stays with your other notifications |
| Workspace exports | Deleted 7 days after they're ready to download |
| Ask Eklo data downloads | Deleted 7 days after they're ready to download |
| Security records | Kept for as long as we run Eklo, including after a workspace or account is deleted, so we can investigate misuse |
| IP addresses on public-form submissions and beta requests | Deleted by a daily job 30 days after collection |
| IP addresses on sign-in sessions | Deleted by a daily job once the session expires |
| Backups | Overwritten within 40 days |
| Application logs | 30 days in AWS CloudWatch. The server also keeps a size-capped copy: for the app until the next release, and for its web proxy and database until they're next replaced. They don't contain client IP addresses. |
| Firewall (AWS WAF) logs | 30 days. For security, they record the IP address of requests the firewall blocks or flags. |
| Error reports | 30 days |
| Church billing and tax details, including proof of tax exemption | For the life of the church's workspace. They are deleted when the workspace is permanently deleted, 30 days after the church deletes it. Stripe keeps its own records of invoices and payments, as the law requires of it |
| Beta requests | 6 months after we decide on the request |
| Marketing-site analytics | 6 months |
Our rate limits count requests against your IP address in short-lived counters that expire within an hour.
We may keep data longer where the law requires it or to resolve disputes.
8. Security
We protect data with measures including:
- encrypted connections (HTTPS) between your browser and Eklo;
- files stored in private storage buckets that block public access and are encrypted at rest;
- the production database stored on an encrypted disk volume;
- no passwords: sign-in uses short-lived email codes or links, passkeys or Google;
- church data kept separate by workspace, with access limited by workspace membership and role; and
- bot checks and rate limits on public forms.
Our Security page describes these measures in more detail. No system is perfectly secure; tell us at privacy@eklo.io if you find a problem.
9. Your rights
Church data. Contact your church first; it decides how your data is used. If you contact us, we will pass your request to the church and help it respond. Your Ask Eklo conversations, attached files, notes and reminders are the exception: only you can see them, so the church can't act on them. You can download a copy of them in Settings → Profile; each download is ready for 7 days. You can delete notes and reminders in Settings → Profile, and a conversation, with its files, from Ask Eklo's page while AI features are on in your church (while they're off, a workspace owner or admin can turn them back on, or you can email privacy@eklo.io). Otherwise conversations and files are deleted on their own after 90 and 30 days, when you leave or are removed from the workspace, or when you delete your account (a workspace owner first hands over or deletes the workspace). For any other request about them, email privacy@eklo.io and we will act on it as our Data Processing Addendum allows.
Data we control. Depending on where you live (for example under GDPR, UK GDPR or US state laws such as California's), you may have the right to access, correct, delete or receive a copy of your data, to object to or restrict some uses, and to withdraw consent. Email privacy@eklo.io. We aim to respond within 30 days and may need to verify your identity. You can delete your account yourself in Settings → Profile.
You can also complain to your local data-protection authority.
10. Children
Eklo is not directed at children under 13, and we don't knowingly collect their personal data for our own purposes. A church may record information about children that a parent, guardian or staff member provides, for example on a registration form. The church is responsible for any parental consent the law requires. If you think a child under 13 has given us personal data directly, contact privacy@eklo.io and we will delete it.
11. Sensitive information
Church data can reveal religious belief, and sometimes health (for example prayer requests). Many laws treat this as sensitive. We process it only for the church that collected it, under its instructions. Churches should collect only what they need.
12. Changes and contact
We will post changes here and update the effective date. For material changes we will also notify account holders by email or in the app.
Questions or requests: privacy@eklo.io, or Mind Mill Media, LLC, PO Box 2922, Cleveland, TN 37320.
How Eklo protects church data, in plain words, is on the Security page.