Privacy Policy

Ekso.ai provides document-processing software for customs and logistics teams. In this policy, “Ekso,” “we,” and “us” refer to Ekso.ai, the company that operates the Ekso service at ekso.ai.

Questions, access requests, correction or deletion requests, withdrawals of consent, and privacy complaints may be sent to the Privacy Officer above. To arrange postal delivery of a privacy request, contact the Privacy Officer by email. Please do not send sensitive document contents in an unencrypted email.

Depending on how you use Ekso, we may collect:

• Account and workspace information: email address, name, job title, organization, membership role, profile image, preferences, and authentication records. Password authentication is handled by our authentication provider.
• Documents and extracted data: files you upload or forward by email, their filenames and metadata, extracted fields and rows, source references, corrections, review decisions, templates, allowed-value lists, and exports.
• Service and billing information: job status, processing mode, model and token usage, provider costs, wallet credits, reservations, and transaction history. Ekso does not currently collect payment-card details through the application.
• Communications: support messages, account invitations, inbound document emails, delivery information, and related message identifiers.
• Technical information: IP address, browser and device information, timestamps, security and audit events, diagnostic logs, cookies required for authentication, and—if you enable alerts—a browser push-notification subscription.

Documents may contain personal information about people other than the account holder. Organizations using Ekso are responsible for having authority to upload and process that information and for providing any notices required in their relationship with those people.

We collect information directly when users create or update an account, upload or email a document, configure a workspace, review extracted information, or contact us. We also collect technical and usage information automatically through the service, and may receive account or workspace information from an organization administrator who invites or manages a user.

We use information to:

• create and secure accounts and organization workspaces;
• receive documents, extract structured data, support human review, and create exports;
• send invitations, processing alerts, requested exports, and service communications;
• calculate usage, operate organization wallets, prevent duplicate charges, and maintain billing records;
• provide support, diagnose errors, recover interrupted jobs, and improve reliability;
• detect abuse, enforce access controls, investigate security incidents, and keep audit records; and
• meet legal, regulatory, accounting, and contractual obligations.

We collect, use, and disclose personal information with consent or as otherwise permitted or required by applicable law. We limit collection to information reasonably needed for the purposes described here.

Ekso uses artificial intelligence and specialized document-processing systems to classify documents, recognize text and layout, identify rows, extract requested fields, compare results, and flag values for human review. Ekso is designed to assist business users; it does not make employment, credit, health, immigration, or other decisions about individuals.

Depending on configuration and processing mode, document content and extraction instructions may be sent to providers such as OpenAI, Google Gemini, and Reducto. Not every provider is used for every job. Ekso records provider responses and usage information where needed to make processing durable, reviewable, and correctly billed.

AI output can be incomplete or incorrect. Ekso provides source evidence and review tools so authorized users can verify results before relying on or exporting them.

We disclose personal information to the following categories of service providers only as reasonably necessary to operate Ekso. Our current material providers include:

• Supabase for authentication, databases, private file storage, and realtime updates;
• Vercel for application hosting, server execution, and durable workflows;
• OpenAI, Google, and Reducto for configured AI and document-processing operations;
• AgentMail for configured inbound-document and transactional email workflows; and
• browser and push-delivery infrastructure when a user opts into notifications.

These providers may receive account information, technical records, communications, uploaded documents, extracted information, or usage information, depending on the service they provide. They may process that information only to supply services to us, subject to their contracts and applicable law. Not every provider receives every category of information or participates in every extraction.

We may also disclose information when required by law, to protect rights or security, in a business transaction, or when an organization or user directs or authorizes us to do so. We do not currently make personal information available to a parent, subsidiary, or other related organization. We do not sell personal information or use it for third-party behavioural advertising.

Ekso and its service providers may process information in Canada, the United States, and other countries where they operate. Information processed outside your province or country may be subject to the laws of that location and may be accessible to courts, law enforcement, or national-security authorities there. We remain responsible for personal information transferred to providers for processing and use contractual and technical measures intended to protect it.

Uploaded documents and extraction artifacts are stored in private storage. Ekso uses organization-based access controls, row-level database security, server-only administrative credentials, transport encryption, audit records, file-type and size restrictions, and signed or authenticated access paths. Profile and organization images may be stored as public assets and should not contain confidential information.

No system is completely secure. If we identify a breach involving personal information, we will investigate it and provide notice where required by applicable law.

We retain information only for as long as reasonably necessary to provide Ekso, maintain security and auditability, resolve disputes, and satisfy legal, accounting, or contractual requirements. Account and document records are generally retained while the relevant workspace remains active. Some provider, security, audit, backup, and billing records may remain for a limited period after operational data is deleted where necessary for those purposes.

Authorized platform administrators can delete user or organization records and associated document storage. To request deletion of an account, an uploaded document, or other personal information, contact us at markus@ekso.ai. We may need to verify your identity and your authority within the organization, and we may retain information that applicable law requires or permits us to keep.

Subject to applicable law, you may request access to personal information we hold about you, ask us to correct it, withdraw consent for optional processing, request deletion, or challenge our compliance. You can disable browser notifications through the Ekso app or your device settings. Essential authentication and security cookies cannot be disabled while remaining signed in.

We will respond within the period required by applicable law. Some requests may need to be handled through your organization because it controls the business documents and workspace in which the information is stored. You may also complain to the privacy regulator with jurisdiction over your concern.

Ekso is a business service and is not directed to children. We do not knowingly invite children to create accounts. Contact us if you believe a child has provided personal information through Ekso without proper authorization.

We may update this policy as Ekso, its providers, or legal requirements change. We will post the revised policy here and update the effective date. If a change materially affects how we handle personal information, we will provide additional notice where appropriate or required.