Privacy Policy

Effective Date: June 03, 2026

This Privacy Policy ("Policy") explains how OpenCanvas Pte Ltd ("Company," "we," "us," or "our") collects, uses, stores, and discloses information in connection with your use of Eko ("Application," "App"), a macOS desktop application and companion web application (collectively, the "Platform"). The desktop application uses artificial intelligence (AI) vision and optical character recognition (OCR) technology to help users automate workflows on their computers. The web application (accessible at https://app.tryeko.io or such other URL as may be notified from time to time) allows users to register for an account, manage their subscription, process payments, and submit bug reports.

Please read this Policy carefully. By downloading, installing, or using the App, you confirm that you have read, understood, and agree to the practices described herein. If you do not agree, you must not install or use the Platform.

This Policy should be read together with our Terms of Service, which govern your use of the Platform.

1. Scope and Applicability

This Policy applies to all users of the Platform, whether accessing Eko through the Desktop App or the Web App. It covers all activities on the Platform, including account registration, account and subscription management, payment and credit processing, customer support, bug reporting, and AI-assisted automation.

This Policy applies regardless of the authentication method used to access the Platform. Supported authentication methods may vary over time depending on what Eko enables, and this Policy applies equally to all such methods.

This Policy does not apply to third-party websites, services, or applications that may be integrated with or linked from the Platform, including any third-party authentication or payment providers. Those services are governed by their own privacy policies.

2. Identity of the Data Controller

Company Name: OpenCanvas Pte Ltd

Contact Email: contact@tryeko.io

For any privacy-related inquiries, data access requests, or complaints, please contact us at the email address above.

3. Information We Collect

3.1 Account Registration Data

When you create an account, we collect:

Email address — used to identify your account, send transactional communications, and authenticate you into the App.

If you choose to register or sign in using Google Login (OAuth 2.0), we receive from Google only your name and email address associated with your Google account. We do not receive your Google password or access to other Google services.

3.2 Screen Capture and Visual Data

The core functionality of the App requires capturing screenshots of your screen to enable AI-assisted automation. Specifically:

The App takes periodic or event-triggered screenshots of your macOS display or selected application window.
These screenshots are transmitted to an AI model (via a secure API) for processing and interpretation.
The AI model uses computer vision and OCR to understand the on-screen context and execute automation actions on your behalf.
Screenshots may contain any information visible on your screen at the time of capture, including text, images, application data, and other personal or sensitive content.

Important: Screenshots captured by the Desktop App are stored exclusively on your local device and are not uploaded to or stored on our servers. However, in order to perform the automation features you request, content derived from your screen — which may include raw or minimally processed screenshots or other content necessary to complete your requested task — may be transmitted to our AI model infrastructure and third-party AI providers. The nature of what is transmitted depends on the specific feature being used and the content visible on your screen at the time.

3.3 Device and Technical Data

When you use the Platform, we may automatically collect technical and operational data to maintain, secure, and improve the Platform. This may include:

Device information such as macOS version and hardware architecture (e.g. Apple Silicon or Intel).
Application version number and build identifier.
Crash logs, error reports, and diagnostic information.
General usage analytics such as feature usage frequency and session duration, collected in aggregated or non-identifiable form where possible.
IP addresses, request identifiers, and security events processed by our infrastructure and operational systems.

This data is collected and retained for operational purposes, including maintaining Platform performance and availability, diagnosing technical issues, preventing fraud and abuse, and supporting security monitoring. Retention periods for this data vary depending on the purpose for which it is collected and the systems through which it is processed.

We do not use technical or operational data to build persistent profiles of individual users for advertising or marketing purposes.

3.4 Web Application Data

When you access the Eko web application at https://app.tryeko.io, we may collect the following additional data:

Browser type and version, operating system, and device type — collected automatically to ensure compatibility and optimise the web experience
IP address — collected transiently for security and fraud prevention purposes and not retained for tracking
Session data and authentication tokens — to maintain your logged-in session securely across the web application
Pages visited and navigation events within the web application — collected in anonymised, aggregated form to understand feature usage and improve the interface
Cookies and similar technologies — see Section 3.4(a) below for full details

3.4(a) Cookies and Similar Technologies

The Eko websites (tryeko.io and its subdomains) and web application (app.tryeko.io) use the following types of cookies. Your cookie consent choice is stored in a preference cookie shared across tryeko.io and its subdomains, so a decision made on one applies to all:

Strictly necessary cookies — essential for authentication, session management, and security. These cannot be disabled without impairing core functionality.
Functional cookies — used to remember your preferences (e.g., language, display settings) to personalise your experience.
Analytics cookies — used (with your consent) to collect anonymised data on how users navigate the web application, helping us improve the interface. With that same consent, we use Google Analytics and Microsoft Clarity as analytics providers; Microsoft Clarity additionally provides session-replay analytics (a reconstruction of page interactions such as clicks and scrolling, with typed input and designated sensitive on-screen content masked and not captured). You may opt out or withdraw consent at any time via our cookie preference centre (the "Cookie settings" control in the site footer) or your browser settings.

We do not use advertising or tracking cookies. You can manage your cookie preferences through your browser settings at any time; however, disabling strictly necessary cookies may prevent you from using certain features of the web application.

3.4(b) Support and Bug Reports

When you submit a support request or bug report through the Platform, we collect your email address, the content of your submission, and any attachments such as screenshots or diagnostic logs you choose to include. Where available, we may also automatically append technical context such as app version, macOS version, and browser version to assist our team in diagnosing issues.

This data is accessible only to our support and engineering teams and is used solely to respond to your request and resolve technical issues. It is retained for a maximum of 24 months from submission, after which it is deleted or anonymised, unless a longer retention period is required for operational or legal reasons.

3.5 No Collection of Sensitive Categories

We do not intentionally collect special categories of personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, biometric data for identification purposes, or financial account details. You should take care not to expose such data via the screen capture functionality.

4. How We Use Your Information

We use the information collected for the following purposes:

Account creation and authentication — to create, maintain, and secure your account.
Service delivery — to process screen captures through the AI vision model and execute automation tasks as instructed by you (desktop application), and to provide account management, subscription management, and payment processing (web application).
Service communications — to send essential transactional emails such as account verification, password reset, and important policy updates.
Product improvement — to analyse anonymised usage patterns and crash data, and to investigate and resolve bug reports submitted through the web application, in order to improve Platform performance and reliability.
Legal compliance — to comply with applicable laws, regulations, and lawful requests from competent authorities.
Security — to detect, investigate, and prevent fraudulent, unauthorised, or illegal activity in connection with any part of the Platform.

We do not use your data for advertising, profiling for marketing purposes, or sale to third parties.

5. Legal Basis for Processing

Where applicable data protection law (such as the GDPR or equivalent legislation) requires us to identify a legal basis, we rely on the following:

Performance of a contract — processing your email address and screen data is necessary to provide the App services you have requested.
Legitimate interests — collecting anonymised crash and usage analytics to maintain and improve the App, where such interests are not overridden by your privacy rights.
Consent — where required by law (e.g., for optional analytics), we will obtain your prior consent and provide a mechanism to withdraw it.
Legal obligation — retaining records to the extent required by applicable law.

6. Screen Capture — Special Disclosure

Because the App's primary function involves capturing and transmitting screenshots to an external AI model, we provide the following enhanced disclosures:

You retain full control over when screen capture is active. You may pause or stop the App at any time.
Screenshots are transmitted over encrypted connections (TLS 1.2 or higher) to our AI processing infrastructure.
Screenshot files are saved and managed locally on your macOS device. You may locate, review, or delete these files at any time using your device's file system. When you request an automation task, raw screenshots or documents may be transmitted through our servers to our AI providers for processing. We do not store the content of these requests or responses; we retain only usage metrics for billing and operational purposes.
You acknowledge that you are responsible for any third-party data visible on your screen during capture, and you warrant that you have the right to share such content with the App.

7. Data Sharing and Disclosure

7.1 AI Model Provider

Screenshots and contextual data are transmitted to our third-party AI model provider(s) solely for the purpose of processing your automation requests. These providers act as our data processors and are contractually obligated to handle your data only in accordance with our instructions and applicable data protection laws.

7.2 Google OAuth

If you use Google Login, your authentication is handled directly between your device and Google. We receive only your name and email address as described in Section 3.1. Google's processing of your data is governed by Google's Privacy Policy.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of our assets, your data may be transferred to the successor entity, subject to equivalent privacy protections.

7.4 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we reasonably believe that disclosure is necessary to protect the rights, property, or safety of the Company, our users, or the public.

7.5 No Sale of Personal Data

We do not sell, rent, lease, or otherwise commercially exploit your personal data to third parties.

8. Payments and Billing Data

Eko offers paid subscription plans and an ad hoc credit top-up system. All payment processing is handled exclusively by Stripe, Inc. (“Stripe”), a third-party payment processor. We do not collect, process, or store your payment card details on our own servers at any time.

8.1 Payment Processing by Stripe

When you purchase a subscription or top up credits, your payment is handled through a Stripe-secured interface. Stripe collects and processes your payment card information directly. Stripe’s handling of your payment data is governed by Stripe’s Privacy Policy (https://stripe.com/privacy), which we encourage you to review.

OpenCanvas Pte Ltd receives from Stripe only the following non-sensitive billing data necessary to manage your account:

A tokenised payment method identifier (Stripe token) — cannot be used to charge your card outside of your authorised transactions
Last four digits and brand of your card (e.g., Visa, Mastercard) — for display purposes only
Billing country and postal code
Transaction status, amount, currency, and timestamp
Stripe Customer ID, used to associate your account with your payment history

8.2 Monthly Subscription Plans

Eko offers recurring monthly subscription plans. By subscribing, you authorise OpenCanvas Pte Ltd (via Stripe) to charge your nominated payment method automatically at the start of each billing cycle. We retain a record of your subscription status, plan tier, billing cycle dates, and payment history for account management, invoicing, and dispute resolution purposes.

8.3 Ad Hoc Credit Top-Ups

In addition to subscription plans, users may purchase additional usage credits on a one-time, as-needed basis. Each top-up is a discrete transaction processed by Stripe. We retain a record of the credit amount purchased, transaction amount, date, and associated Stripe transaction ID for accounting and credit balance management purposes.

8.4 Billing Records and Retention

We retain billing and transaction records for a minimum of seven (7) years from the date of each transaction, in compliance with applicable financial record-keeping and tax obligations under Singapore law (including the Income Tax Act 1947 and the Goods and Services Tax Act 1993, as applicable). This retention obligation applies even after account deletion.

8.5 Refunds and Billing Disputes

Refund and cancellation terms are set out in our Terms of Service. For billing enquiries, payment disputes, or to request a copy of a transaction record, please contact us at contact@tryeko.io. We will work with Stripe as necessary to resolve any billing issues promptly.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy:

Account data (email address): Retained for the duration of your account and for a reasonable period thereafter to comply with legal obligations or resolve disputes.
Local files: Images, screenshots, and documents processed by the Desktop App are stored solely on your local macOS device and are never retained on our servers. You are responsible for managing and deleting these local files at your discretion.
Anonymised analytics data: May be retained indefinitely in aggregated, non-identifiable form.
Bug report data: Retained for up to 24 months from the date of submission, after which it is permanently deleted or anonymised. Billing transaction records associated with your account remain subject to the 7-year retention period under Section 8.4 regardless of bug report deletion.
Web application session and cookies data: Session cookies are deleted when you close your browser. Persistent functional cookies expire within 12 months of being set.
Legal hold: If required by law or legal proceedings, we may retain specific data for longer periods.

Upon account deletion, we will delete or anonymise your personal data within 60 days, except where retention is required by law.

10. Data Security

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

Encryption of data in transit using TLS 1.2+
Encrypted storage for account credentials
Access controls and authentication requirements for our internal systems
Regular security reviews and vulnerability assessments

However, no method of electronic transmission or storage is 100% secure. You acknowledge that you provide data at your own risk and that we cannot guarantee absolute security.

11. Your Rights and Choices

Depending on your jurisdiction, you may have some or all of the following rights with respect to your personal data:

Right of access — to request a copy of the personal data we hold about you.
Right to rectification — to request correction of inaccurate or incomplete data.
Right to erasure — to request deletion of your personal data in certain circumstances.
Right to restriction — to request that we limit the processing of your data.
Right to data portability — to receive your data in a structured, commonly used format.
Right to object — to object to processing based on legitimate interests.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at contact@tryeko.io. We will respond within the timeframe required by applicable law (typically 30 days). We may need to verify your identity before processing your request.

12. U.S. State Privacy Rights

If you are a resident of California or another U.S. state with applicable privacy laws (including but not limited to the California Consumer Privacy Act as amended by the California Privacy Rights Act, "CCPA/CPRA"), you may have additional rights, including the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell or share your personal information as defined under applicable U.S. state law.

To submit a privacy request, email us at contact@tryeko.io with the subject line "U.S. State Privacy Request."

13. Children's Privacy

The App is not intended for use by individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data without appropriate consent, please contact us and we will promptly delete such data.

14. International Data Transfers

Our servers and those of our third-party service providers may be located in jurisdictions outside your country of residence. These providers include, but are not limited to, AI model providers, authentication services, payment processors, storage providers, and content delivery services. Where your personal data is transferred to and processed in another country, we take reasonable steps to ensure appropriate safeguards are in place in accordance with applicable data protection laws.

15. Third-Party Services

The App may integrate with or link to third-party services (e.g., Google OAuth). We are not responsible for the privacy practices of such third parties. We encourage you to review the privacy policies of any third-party services you use in connection with the App.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will notify you by:

Sending an email to the address associated with your account, and/or
Displaying a prominent notice within the App upon your next login.

The updated Policy will take effect on the date indicated at the top of the document. Your continued use of the App following notification constitutes your acceptance of the revised Policy.

17. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us at:

Email: contact@tryeko.io

Company: OpenCanvas Pte Ltd

We take privacy inquiries seriously and will respond promptly and in accordance with our legal obligations.