Privacy Policy

Overview

This Policy explains how we handle personal data when you visit our website, create an account, or use Eyeleven OS. It applies to data we handle as a controller for our own purposes.

Where we process personal data on behalf of a customer — for example, the contacts and conversations flowing through a customer's Omni Forces — we act as a processor, and the customer is the controller. That processing is governed by our Data Processing Addendum, not by this Policy.

Who is responsible

Eyeleven Inc. is a corporation incorporated in the State of Delaware, United States, and is the contracting party for the Service (“Eyeleven”, “we”, “us”, or “our”). EYELEVEN LLC, a Wyoming limited liability company, is an affiliate within the same corporate group. Eyeleven™ is a trademark of the Eyeleven group. Unless a document expressly states otherwise, your agreement is with Eyeleven Inc., and is the controller for the processing described in this Policy.

Our data protection contact is [email protected]. We have not appointed a statutory Data Protection Officer; if we do, this Policy will be updated with their details. The Service is not currently directed at individuals located in the European Economic Area or the United Kingdom. We will designate an EU and UK representative under Article 27 of the GDPR and UK GDPR and publish their details in this Policy before offering the Service to EEA or UK data subjects.

Controller: Eyeleven Inc., a Delaware corporation, United States
Group affiliate: EYELEVEN LLC, a Wyoming limited liability company, United States
Primary processing location: United States
Privacy contact: [email protected]

Personal data we collect

Account data: name, business email, password hash, workspace and role, locale
Billing data: plan, billing contact, transaction records and the last four digits of a payment instrument — full card numbers are handled by our payment processor and never reach our servers
Configuration data: the instructions, knowledge sources, and approval rules you set for your Omni Forces
Usage and telemetry data: pages viewed, features used, agent runs, timestamps, approximate location derived from IP
Technical data: IP address, browser and device type, operating system, referring URL
Support data: messages, attachments, and diagnostic detail you send us
Communications data: messages exchanged with our agents where you contact us through a messaging channel

Where the data comes from

Directly from you, when you register, configure, subscribe, or contact support
Automatically from your device, through cookies and similar technologies as described in the Cookie Policy
From connected platforms you authorise, such as a messaging channel or business account
From our payment processor, in the form of transaction and status records

How we use personal data

Provide, operate, secure, and support the Service
Authenticate users and protect accounts against fraud and abuse
Process payments, manage subscriptions, and issue invoices
Diagnose faults, monitor errors, and improve reliability and performance
Communicate service, security, and billing notices
Send product and marketing communications where permitted, subject to opt-out
Comply with legal obligations and enforce our Terms and Acceptable Use Policy

Legal bases (EEA, UK, and Switzerland)

Where the GDPR or UK GDPR applies, we rely on the following legal bases.

Contract: to provide the Service you have subscribed to and to administer your account
Legitimate interests: to secure the Service, prevent abuse, analyse aggregate usage, and communicate with existing customers about closely related services
Consent: for non-essential cookies and for marketing where consent is required — withdrawable at any time
Legal obligation: to retain accounting records and respond to lawful requests

AI and automated processing

Content you or your contacts submit may be sent to third-party model providers to generate responses and perform the tasks you configure. Those providers act as our sub-processors and are listed in the Sub-processor List.

We do not use your content, or your contacts' content, to train foundation models for our general benefit or for the benefit of other customers. Where a model provider offers a zero-retention or no-training configuration for API traffic, we seek to use it.

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you without human involvement. The platform provides approval controls so that consequential actions taken by an Omni Force can require human confirmation, and customers are contractually required to maintain meaningful supervision.

Messaging channels and WhatsApp

When a customer connects a messaging channel, messages exchanged between that customer and their contacts pass through our platform so an Omni Force can process and respond to them. For that traffic the customer is the controller and we are the processor.

Messaging platforms impose their own rules — including opt-in requirements, template approval, and messaging windows — and they process the same messages under their own terms as an independent controller or processor. Customers are responsible for obtaining a valid lawful basis and any required opt-in from their contacts before messaging them.

Sharing and disclosure

We do not sell personal data, and we do not share personal data for cross-context behavioural advertising.

Sub-processors that host, secure, and operate the Service, under written contract and limited to our instructions — see the Sub-processor List
Professional advisers, auditors, and insurers, bound by confidentiality
Authorities, where compelled by valid legal process, after review and, where lawful, notice to the affected customer
An acquirer or successor in a merger, acquisition, or asset sale, subject to this Policy continuing to apply

International data transfers

We are established in the United States and our primary processing takes place there. If you are located in the EEA, the United Kingdom, or Switzerland, transferring your personal data to us is an international transfer.

We rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum and the Swiss addendum where applicable, as our transfer mechanism. Those clauses are incorporated into our Data Processing Addendum and are available on request.

We additionally intend to rely on the EU–US Data Privacy Framework and its UK extension and Swiss counterpart once our certification is finalised, and will update this Policy when it is. Until then, the Standard Contractual Clauses are the operative mechanism.

We carry out transfer impact assessments where required and apply supplementary technical measures, including encryption in transit and at rest and the access controls described in the Security Overview.

Storage and security

We apply administrative, technical, and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access control, least-privilege administrative access, audit logging, and monitored error reporting. Our measures are described in the Security Overview.

No system is perfectly secure. We do not guarantee absolute security, and we will notify affected customers and, where required, regulators of a personal data breach in accordance with applicable law and our Data Processing Addendum.

Retention

Account and configuration data: for the life of the account, then deleted within 30 days of closure unless a longer period is required by law
Conversation and agent execution data: per the retention window configured by the customer, defaulting to the term of the subscription
Billing and tax records: up to 7 years, as required by applicable accounting and tax law
Security and audit logs: up to 12 months
Backups: rolling backups are purged within 90 days

Your rights

Subject to applicable law, you may exercise the rights below by contacting [email protected]. We will respond within the period required by law — generally one month under the GDPR and forty-five days under United States state privacy laws — and will not discriminate against you for exercising them.

Access a copy of the personal data we hold about you
Rectify inaccurate or incomplete data
Erase data where there is no overriding basis to retain it
Restrict or object to processing, including profiling based on legitimate interests
Receive your data in a portable, machine-readable format
Withdraw consent at any time, without affecting prior lawful processing
Lodge a complaint with your supervisory authority or, in the UK, the Information Commissioner's Office

United States state privacy rights

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, or another state with comprehensive privacy legislation, you may have rights to know, access, correct, delete, and obtain a portable copy of your personal information, and to appeal a denial of a request.

We do not sell personal information and do not share it for cross-context behavioural advertising, so we do not offer a “Do Not Sell or Share” mechanism. We honour Global Privacy Control signals for non-essential cookies. You may use an authorised agent to submit a request, subject to verification.

Children

The Service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact [email protected] and we will delete it.

Cookies

We use strictly necessary cookies to operate the Service, and limited analytics only where permitted. Full detail, including categories and how to control them, is in the Cookie Policy.

Changes to this Policy

We may update this Policy to reflect changes in our practices or the law. We will revise the “last updated” date and, for material changes, provide notice by email or in-product notification before they take effect.

Contact

Eyeleven Inc. — Privacy. Write to [email protected] for any request under this Policy, or to [email protected] for other legal matters. Postal details are available on request.