Draft — last updated 2026-10-03
Privacy notice
What Ekvi at ekvi.app stores, why, where, and for how long.
Who is responsible
For your account and this website, the controller is TRAININ SIA, Reg. No. 40203233934, Ventspils iela 27-5, Riga, LV-1002, Latvia. Contact: the contact form.
For the records you keep about a company (its shareholders, option holders, documents), the company is the controller and TRAININ SIA processes them on its behalf, only to provide the service. A data processing agreement is available on request through the contact form.
What we store
- Your account: name, email address, whether you confirmed it, a salted hash of your password (never the password), and, if you sign in with Google, Google's identifier for your account.
- Sign-ins: each sign-in attempt (address, method, success, time) to slow down password guessing, and your active sessions (start, last use, the browser's description) so you can see and end them on your profile page.
- Company records: what you and your colleagues record — holders' names, addresses and holdings, options, documents you upload — and who recorded what, when.
- Assistant questions: the questions asked of Ekvi AI and its answers, kept with the company they were asked about, and daily usage counts for the limits.
- Contact form: sent to us by email and not stored by the service. We keep the email in our mailbox as long as we need it to answer and follow up.
Why (legal basis)
Account and company data: to provide the service you signed up for (Art. 6(1)(b) GDPR) and, for company records, on the company's instructions as its processor. Sign-in records and security logs: our legitimate interest in keeping accounts and data safe (Art. 6(1)(f)). Contact messages: to answer you (Art. 6(1)(b) or (f)).
Who processes data for us
- Oracle Cloud Infrastructure hosts the service and its database in the EU (Madrid, Spain) and delivers our email (Oracle Email Delivery): confirmations, password resets, invitations and contact messages.
- Google, only if you choose to sign in with Google: Google confirms your identity and tells us your name and email address.
- Google (Gemini API), only when someone asks Ekvi AI a question: the question and the records the assistant reads to answer it are sent to the model to produce the answer.
Cookies
Three, all strictly necessary or set by your own choice: a session cookie that keeps you signed in (and briefly carries one-time notices), and two preference cookies, ekvi_theme and ekvi_lang, set only when you choose a colour theme or a language. No analytics, no advertising, no tracking; no external fonts, scripts or CDNs. That is why there is no cookie banner.
How long we keep it
- Company records are a permanent ledger by design: a recorded event is never changed or deleted, and a real company is archived, not deleted. A demo company is deleted when its owner deletes it.
- Your account is kept while you use it. Ask through the contact form to close it: we disable it and delete your sign-in data; entries you recorded in a company's ledger stay in that company's history.
- Server logs carry account and company identifiers, not passwords, tokens or message contents, and are kept for up to 30 days.
Your rights
You can ask to see, correct, export or delete your personal data, or object to its use, through the contact form. For data in a company's records, we pass your request to that company, which decides as controller. You can also complain to your national data protection authority; in Latvia that is the Data State Inspectorate (Datu valsts inspekcija).