Privacy Policy

Last updated: 10/08/2026

This policy describes how Ekklo SAS collects, uses, protects, and shares your personal data, including data obtained through Google APIs. We are committed to protecting the privacy of our users in accordance with the General Data Protection Regulation (GDPR).

1. Who are we?

‍Ekklo SAS — SIRET: 931 675 706 00010 — 229 rue Saint-Honoré, 75001 Paris, France. Contact: support@ekklo.com

2. Data collected

‍We collect in particular:

Coach data:First and last name, email address, payment information (via Stripe), subscription details (freemium/premium), professional liability insurance certificate or subscription, login history and platform activity, sports and nutrition programs created or shared, shared files (PDF, images, videos, etc.), calendar synchronization (via Google Calendar).

Coach clients' data:First and last name, email address, health-related data: weight, height, measurements, goals, photos, followed programs and progress, training statistics and data, files shared by their coach, access to a dedicated personal space.

Technical and analytical data:IP address, browser type, device used, browsing data and usage logs, measurement tools: Posthog, Crisp.

Note: Some collected data may be considered sensitive (health data). Such data is only processed with the explicit consent of the user concerned.

3. Use of Google user data

‍When you connect your Google account to Ekklo, we access the following data via Google APIs: your email address and name, your Google Calendar events (read/write).

This data is used solely to allow you to synchronize your Ekklo calendar with your Google Calendar and manage your appointments more efficiently. We never share this data with third parties. You can revoke access at any time via https://myaccount.google.com/permissions.

Important:

‍ We do not use data obtained through Google Workspace APIs to develop, improve, or train generalized artificial intelligence or machine learning models.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

4. Purposes of processing

‍Data is used to: provide platform services, manage user accounts, enable personalized coaching, process payments and subscriptions, offer file storage and sharing features, track sports and nutritional performance, provide user support via Crisp, and improve the user experience via Posthog.

Ekklo provides an AI-based assistant that allows coaches to automate certain tasks and access their clients' information conversationally. Use of this feature involves data processing by Ekklo and its specialized AI technology partners (see section 4bis). This feature is optional and subject to prior explicit consent.

4bis. Artificial Intelligence Assistant

‍How it works: The AI assistant analyzes the data required for each request (client information, tracking data, programs) to generate automated responses.

Technology partners:

Transfers outside the EU: Data processed by the AI assistant may be transferred to the United States. These transfers are governed by Standard Contractual Clauses approved by the European Commission and Data Protection Agreements (DPAs) signed with our partners.

Legal basis: Explicit consent (voluntary activation of the feature by the coach).

Data processed: Only the data strictly necessary for the request is transmitted. Data is not used to train our partners' AI models.

Deactivation: You may choose not to activate this feature or stop using it at any time.

5. Legal basis for processing

‍Processing is based on: your consent (Google connection, health data collection, use of the AI assistant), performance of the contract (Terms of Use), and legal obligations (billing, security, etc.).

6. Data storage and security

‍Data is stored on secure servers hosted by Dyjix SAS (France) and Scaleway (France), with encryption in transit and at rest. As part of the use of the AI assistant, certain data may be temporarily processed by our technology partners located outside the European Union, in accordance with the safeguards described in section 4bis.

7. Retention period

‍Your data is retained for as long as your account is active, and up to 30 days after account deletion (then permanently deleted).

7bis. Instagram direct messages

When you send a direct message to one of Ekklo’s Instagram accounts, the message is received in Ekklo’s internal support tool, through Instagram’s official API, so that our team can reply to you.

Data processed: the content of your messages and of your replies to our stories, the files you send us, your Instagram profile name, username and profile picture, and a technical identifier provided by Instagram. We have no access to your password or to your other conversations.

Purpose and legal basis: this data is used only to handle your request and reply to you (Ekklo’s legitimate interest in answering the people who contact it). It is not sold, and it is not used for advertising or profiling. Replies are written and sent by a member of the Ekklo team; no reply is sent to you automatically.

Writing assistance: at the request of a team member, the text of the conversation’s latest messages may be sent to OpenAI (United States), acting as a processor, to suggest a draft reply or a translation. Your name, username, picture and files are not sent. This data is not used to train OpenAI’s models, and the transfer is governed as described in section 4bis.

Retention period: a resolved conversation is deleted no later than 24 months after it was resolved. Technical data about the receipt of messages is deleted after 30 days.

Deleting your Instagram data

You may ask at any time for the deletion of the data from your Instagram exchanges with Ekklo, by writing to support@ekklo.com or by sending us a direct message on Instagram. Please give your Instagram username. We then delete the conversation, its messages, its files and your profile picture from our systems, within one (1) month at most, and we confirm it to you.

This deletion covers the data held by Ekklo. The messages remain visible in Instagram’s own inbox, where you can delete them directly; there they are governed by Instagram’s privacy policy.

8. Exercising your rights

‍In accordance with the GDPR, you have a right of access, rectification, erasure, portability and objection regarding your personal data, as well as a right to restriction of processing and to withdraw your consent at any time.

To exercise these rights, in particular to retrieve or export all of your data, contact us at support@ekklo.com.

Your request is processed within one (1) month of its receipt. However, given the large volume of data generated by use of the application, processing requests covering a large amount of information may require up to three (3) months. In that case, we inform you of this extension and its reasons within one month of your request.

Your data is provided to you in a structured, commonly used and machine-readable format.

You may also lodge a complaint with the CNIL, the French supervisory authority (www.cnil.fr), or with the supervisory authority of your country of residence, if you believe your rights are not being respected.

9. Cookies

‍We use cookies to measure audience (Posthog), provide user support (Crisp), and improve the user experience. By continuing to browse our site, you agree to the use of cookies.

10. Changes

‍We may update this policy at any time. In the event of a major change, you will be notified by email or via the application.

11. Contact

‍Data Processing Officer: Pomier Mathys — mathys.pomier@ekklo.com

If you have any questions or concerns about this privacy policy, please do not hesitate to contact us.

‍

Cookie preferences

By clicking « Accept all », you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts, as described in our Data processing policy.