Privacy Policy

1. Information We Collect

Account information. When you sign up, we collect your name, username, email address, and password. Your password reaches our server once, when you sign up, and is passed straight to our authentication provider, which stores it only as a hash. We never store it or write it to a log in plain text.

Signing in with Google. If you choose to sign in with Google, Google sends us your name, your email address, and a link to your profile photo if you have one. We use your name and email to create or sign in to your account, and for nothing else. We don’t copy the photo into your Metis account and it is never shown anywhere in Metis, though our sign‑in provider may keep the link in its own record of your Google sign‑in. That record is deleted with your account.

We don’t ask for or receive access to anything else in your Google account — not Gmail, Drive, Contacts, Calendar, Photos, or any other Google service — and we never post, send, or change anything on your behalf. You can disconnect Metis from your Google account at any time in your Google account settings; doing so stops the sign‑in working and does not by itself delete your Metis account or your foundation.

Business and conversation information. During the guided intake, we collect what you tell the Foundation Builder — details about your business, its history, customers, values, and direction — along with the brand foundation document generated from it, any business name you provide, and your conversations with Eiki afterward.

Personal details in your answers. Each answer you give the Foundation Builder is also read automatically, by the same AI provider, for personal details — health, money trouble, family matters, work history, identity. Any sentence it finds is stored with your answer, labeled with the kind of detail it is, so we can check that nothing written back to you repeats it. The labels are deleted along with your answers.

Documents and graphics you upload. If you send Eiki a document — old brand guidelines, a price list, past copy — we read the text out of it in your browser and store that text. The file itself never reaches us. If you send a graphic, such as a logo or a layout you want checked, we store the image, resized. We use both only to help with your brand: to answer what you ask about them, and to check your work against rules you have written down. Anything you upload is deleted along with everything else when you delete your account, and you can remove any of it yourself at any time.

Usage information. Standard technical data generated by using a web application — things like timestamps, session activity, and basic device/browser information — collected automatically through our hosting and authentication provider.

Invite requests. If you ask for an invite on our home page, we store your name, email address and the type of business you entered, the time you asked, and a scrambled form of your network address that we use only to limit repeat submissions and can’t turn back into the address. We use them to decide on and send your invite, and nothing else — no newsletter, no marketing. A copy of your request is emailed to our own inbox so we see it. We keep a request until you ask us to remove it; to have yours removed, email contact@eikira.com from the address you used, and we’ll delete it.

Questions. If you send us a question from our home page, your name, email address and message are emailed to our own inbox so we can reply; we don’t store them in the Service. To limit repeat submissions we keep the time you wrote and the same scrambled form of your network address, and delete those after a day.

Analytics. We use Vercel Analytics to count page views and see which pages are visited. It sets no cookies. Visitors are counted using a short‑lived identifier generated from the request, which is reset every day — it can’t be used to follow you to other sites or across days, and the data is aggregated rather than tied to you or your IP address.

Payments. When you buy a plan, Stripe processes the payment. We never see or store your card number. Stripe tells us your name, email address, billing country and postal code, your card’s brand, last four digits and expiry date, and the status of your plan.

2. How We Use It

• To run the guided intake conversation and generate your brand foundation document.
• To answer your questions about documents and graphics you upload, and to check them against rules you have on file. We don’t use them for anything else, and we don’t use them to train AI models. Anthropic, which processes them for us, doesn’t train its models on them either.
• To maintain your account, authenticate you, and let you resume a conversation in progress.
• To respond to support requests and messages you flag for our review.
• To maintain, secure, and improve the Service.
• To send you account‑related communications (like password resets) and, where relevant, platform updates.

3. Who We Share It With

We do not sell your personal or business information to third parties. We share information only with the service providers (“subprocessors”) that help us run the Service, under agreements that limit their use of it to providing that service to us:

• Anthropic — your conversation with the Foundation Builder, your conversations with Eiki, any documents and graphics you upload, and your brand foundation are sent to Anthropic’s Claude models, which run the Foundation Builder and Eiki and write your foundation. When Eiki looks something up on the web for you, that search runs through Anthropic too. This is the core of how the Service works. Anthropic keeps what we send it for up to 30 days, for safety and security, and then deletes it — unless it is flagged as breaking Anthropic’s usage policy, which it can keep longer.
• Supabase — our database, authentication, and hosting infrastructure provider, which stores your account, conversation data, and the documents and graphics you upload on our behalf.
• Stripe — our payment processor, when you buy a plan. It handles your card details directly and keeps billing records as the law requires, which can include records that outlast your account.
• Vercel — our application hosting provider, which serves the Service and provides the analytics described above.
• ElevenLabs — when you press play to hear a Foundation Builder message read aloud, the text of that message is sent to ElevenLabs to turn it into speech.
• Resend — delivers our account emails, such as sign‑up codes and password resets, so it receives your email address and the message we send you. It also delivers the copy of an invite request to our own inbox, so it receives the details you entered in that form, and a copy of any feedback or support message you send from inside Metis, so it receives your email address and what you wrote.
• Google — if you sign in with Google, Google handles that sign‑in (see section 1).Tester feedback sent before September 24, 2026 went through a Google Form and is stored by Google; feedback now comes straight to us.

We may also disclose information if required by law, or to protect the rights, property, or safety of EIKIRA LLC, our users, or others.

4. Cookies

We use only the essential cookies our authentication provider sets to keep you signed in. We don’t use advertising or third‑party tracking cookies.

5. Data Retention

We keep your account and the data in it for as long as your account is active.

If you delete your account, we delete your brand foundation, the whole intake conversation behind it, the document generated from that conversation, everything with Eiki — your conversations, Tracked items, notes, the dates she holds and anything you uploaded — and the account itself. That includes any earlier foundations you’d discarded and started over from — nothing is left behind waiting to expire. This happens immediately, and it can’t be undone: we don’t keep a copy to restore for you.

Backups. We keep backup copies of the database, taken before any change to it and about once a week. Something you delete is gone from the Service right away, but it can remain in a backup copy until that copy is deleted.

If you discard a foundation and start a new one, the old one is kept for 30 days and then permanently deleted. That window exists so you can ask us to bring it back if you discarded it by mistake.

Some things outlive a deletion, and we’d rather name them than leave them under a general exception:

Reports, feedback and support messages. If you ever used “Flag this” to report something Eiki said, or sent us feedback or a support message, we keep it for 24 months so we can review and fix the problem. When you delete your account, the report stays but your account is no longer attached to it.

To be specific about what that means: we keep the text of the message you flagged, and we keep anything you typed yourself — the note explaining what felt off, or the body of your feedback or support message. That text is not deleted when your account is. What we remove is the link between it and you: no name, no email, no account.

Server logs. Our hosting provider keeps runtime logs for 1 day. Those logs record which requests happened and whether they worked — not your answers, your foundation, or anything you wrote. They age out on their own and we can’t delete them individually. Our database and sign‑in provider, Supabase, keeps its own request and sign‑in logs, which can include your email address and IP address; they also age out on the provider’s schedule.

A record of account events. Our sign‑in provider keeps an audit record of account events — signing up, signing in, password resets, and the deletion itself — with the email address they belong to. That record stays in our database after your account is deleted.

Copies held by the companies in section 3. What we send them is kept under their own retention terms. Deleting your account deletes what we hold; it doesn’t reach into their systems.

Emails you send us. Anything you write to our support address stays in that mailbox. Ask, and we’ll delete it.

An unsent message on your device. If you start typing to Eiki and don’t send it, the text is saved in that browser so it isn’t lost. It never reaches us, and deleting your account doesn’t clear it; clearing the browser’s data for this site does.

An exit survey, if you fill one in. When you delete your account we ask why, and you can skip it. If you answer, we keep the reason you picked and anything you typed in the box — with nothing linking it back to you: no name, no email, no account, not even a reference to the account that was. We can’t remove it later for the same reason, because there is nothing to look it up by. The box says so above it, before you type.

6. Your Choices & Rights

You can review and download your brand foundation document at any time from within the Service. You can delete your account and everything in it yourself, from your settings page — you don’t need to ask us. You can also request access to or correction of your personal information by contacting us. Depending on where you live, you may have additional rights under applicable data protection law (such as the right to data portability or to object to certain processing) — contact us to exercise them.

7. Security

We use industry‑standard measures — including encryption in transit, access controls, and row‑level data isolation — to protect your information. No method of transmission or storage is completely secure, so we can’t guarantee absolute security.

Who on our side can see your content. Row‑level isolation keeps your content away from other users. It does not keep it from us: whoever administers the database can technically read what is stored in it. We don’t read an account’s content unless you ask us to, for example by flagging a message, or unless fixing a problem you’ve reported requires it.

8. International Data Transfers

Our service providers may process and store data in countries other than your own. Where this happens, we rely on those providers’ own safeguards for cross‑border data transfer.

9. Children’s Privacy

The Service is intended for business owners and professionals aged 18 and older. We don’t knowingly collect information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we’ll update the “Last updated” date above and, where appropriate, notify you through the Service.

11. Contact

Questions about this policy, or want to exercise a data right? Reach us through Contact Support in Settings when you’re signed in, or write to EIKIRA LLC at contact@eikira.com.