1. Information We Collect
1.1 Information You Provide Directly
- Account information: First name, last name, email address, and password (stored as a one-way Argon2id hash — we never store your plaintext password)
- Profile information: Profile photo, timezone, and any other information you choose to add to your profile
- Workspace information: Workspace name and the email addresses of members you invite
- Messages: Content of messages sent within the EkamSphere internal messaging system
- Communications: When you contact us for support, we retain those communications to resolve your issue
1.2 Information Collected Automatically
- Log data: IP address, browser type, browser version, pages visited, time and date of visit, and time spent on pages
- Request IDs: Unique identifiers attached to each API request for debugging and audit purposes
- Usage data: Features used, frequency, and interaction patterns to improve the Service
1.3 Information from Third-Party Providers (via OAuth)
When you connect a third-party provider, we receive and store:
- Google: OAuth tokens (access + refresh), Google account email/name for identification, calendar events (title, time, location, attendees, conference links), and meeting metadata
- Zoom: OAuth tokens, Zoom user profile (name, email), meeting details (topic, start time, join URL, participants), and — if Team Chat integration is enabled — channel names and message content
- Microsoft Teams / Outlook: OAuth tokens, Microsoft account details, calendar events, and meeting details
- Cisco Webex: OAuth tokens, Webex account details, meeting metadata, and — if messaging integration is enabled — Space names and message content
- Zoho Meeting / Calendar: OAuth tokens, Zoho account details, meeting details, and calendar events
We do not access, collect, or store audio recordings, video recordings, screen-share content, transcripts, or chat content from within live meetings.
2. How We Use Your Information
We use the information we collect to:
- Provide the Service: Display your unified calendar, meeting list, and provider inbox; schedule and manage meetings on your behalf via provider APIs; deliver real-time notifications
- Authenticate you: Verify your identity on login; maintain session security via JWT access tokens and refresh token rotation
- Sync your data: Periodically pull new calendar events and messages from connected providers to keep your dashboard current
- Send notifications: Email verification on registration; password reset emails; meeting reminders (if enabled)
- Improve the Service: Analyze aggregated usage patterns to identify bugs, improve performance, and prioritize features — always in anonymized or aggregated form
- Comply with legal obligations: Retain audit logs and respond to lawful requests from authorities where required by law
- Protect against abuse: Detect and prevent fraud, unauthorized access, and other harmful activity
We do not sell your personal information to third parties. We do not use your meeting content or messages for advertising purposes.
3. OAuth & Third-Party Provider Data
3.1 Scope of Access
EkamSphere uses OAuth 2.0 to access third-party services on your behalf. We request only the minimum scopes necessary for each feature. You are shown exactly which permissions are being requested before you authorize each connection.
| Provider | Scopes / Permissions Requested | Purpose |
|---|---|---|
| openid, email, profile, calendar.events, calendar.readonly | Calendar sync, meeting creation via Google Calendar | |
| Zoom | meeting:read, meeting:write, user:read, chat_channel:read, chat_message:read/write | Meeting CRUD, user profile, Team Chat (if enabled) |
| Microsoft | offline_access, User.Read, Calendars.ReadWrite, OnlineMeetings.ReadWrite | Calendar sync, Teams meeting creation |
| Cisco Webex | meeting:schedules_read/write, spark:rooms_read, spark:messages_read/write | Meeting CRUD, Webex Spaces messaging (if enabled) |
| Zoho | ZohoMeeting.meeting.READ/CREATE/UPDATE/DELETE, ZohoCalendar.event.READ | Meeting CRUD, calendar sync |
3.2 Token Security
All OAuth access tokens and refresh tokens are encrypted at rest using AES-256-GCMwith a randomly generated initialization vector per record. Encryption keys are stored separately from the database. Tokens are never logged, never exposed in API responses to the browser, and never stored in plaintext.
3.3 Token Revocation
You may disconnect any provider at any time from the Integrations page. Upon disconnection, we immediately revoke the tokens via the provider's revocation endpoint and delete the encrypted token record from our database. You may also revoke access directly through the provider's own account/app settings (Google Account permissions, Zoom Marketplace, Microsoft App permissions, etc.) — EkamSphere will detect the revocation on the next sync attempt and mark the connection as inactive.
3.4 Google API Scopes — Additional Disclosures
EkamSphere's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We only use Google user data to provide and improve EkamSphere's meeting and calendar features
- We do not use Google user data for serving advertisements
- We do not allow humans to read your Google data unless you explicitly grant us support access or it is required for security purposes
- We do not transfer Google user data to third parties except as necessary to deliver the EkamSphere service (e.g., your infrastructure providers under confidentiality agreements)
4. Data Sharing & Disclosure
We do not sell, rent, or trade your personal information. We may share your information in the following limited circumstances:
- Service providers: We use trusted infrastructure providers to operate the Service, including Railway (cloud hosting), PostgreSQL database provider, and Redis cache provider. These providers process data on our behalf under data processing agreements and may not use your data for their own purposes.
- Third-party platforms: When you explicitly initiate an action (e.g., create a meeting, send a message), the necessary data is transmitted to the selected provider (Zoom, Google, etc.) on your behalf.
- Legal requirements: We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or comply with a legal obligation.
- Business transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your information becomes subject to a different privacy policy.
- With your consent: We may share information with third parties when you explicitly consent to such sharing.
5. Data Security
We implement industry-standard security measures to protect your information:
- Encryption in transit: All data transmitted between your browser and our servers uses TLS 1.2 or higher (HTTPS)
- Encryption at rest: OAuth tokens encrypted with AES-256-GCM; database stored on encrypted volumes
- Password hashing: Passwords are hashed using Argon2id — a memory-hard, side-channel-resistant algorithm
- JWT security: Short-lived access tokens (15 minutes); refresh token rotation with reuse detection; tokens stored in Redis with ability to revoke entire sessions
- Access controls: Role-based access control (OWNER / ADMIN / MEMBER / VIEWER) enforced on all API endpoints; workspace membership verification on every request
- Audit logging: Security-relevant actions are logged with actor, action, resource, and timestamp
- Non-root containers: Production services run as non-root users in Docker containers
While we implement these safeguards, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, and we encourage you to use a strong, unique password and enable any additional security features available.
In the event of a data breach that affects your rights and freedoms, we will notify affected users as required by applicable law.
6. Data Retention
We retain your information for as long as your account is active or as needed to provide the Service:
- Account data: Retained until you delete your account or request deletion
- OAuth tokens: Deleted immediately upon provider disconnection or account deletion
- Calendar events and meetings: Retained while your account is active; deleted within 30 days of account deletion
- Provider messages: Retained while the connected integration is active; deleted upon integration disconnection or account deletion
- Audit logs: Retained for up to 12 months for security and compliance purposes
- Server logs: Retained for up to 90 days for operational and security purposes
You may request deletion of your personal data at any time by contacting us at privacy@ekamsphere.com. We will process your request within 30 days.
8. Your Rights & Choices
You have the following rights regarding your personal information:
- Access: You may request a copy of the personal data we hold about you
- Correction: You may update your profile information at any time from the Settings page
- Deletion: You may request deletion of your account and personal data
- Portability: You may request your data in a machine-readable format
- Objection: You may object to certain processing of your data
- Restrict processing: You may request we restrict processing of your data in certain circumstances
- Withdraw consent: Where processing is based on consent, you may withdraw that consent at any time
To exercise any of these rights, contact us at privacy@ekamsphere.com. We will respond within 30 days. We may need to verify your identity before fulfilling your request.
8.1 Provider Data Rights
For data held by third-party providers (Google, Zoom, Microsoft, Webex, Zoho), you must exercise your rights directly with those providers. Disconnecting a provider in EkamSphere removes our copy of the synced data but does not affect data held by the provider itself.
9. Children's Privacy
EkamSphere is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child under 16 has provided us with personal information, please contact us at privacy@ekamsphere.com. If we discover we have collected information from a child under 16, we will delete it promptly.
10. International Data Transfers
EkamSphere is operated from India. Your information is processed and stored on servers provided by Railway (which may operate in the United States or other jurisdictions). By using the Service, you consent to the transfer of your information to these locations.
When we transfer personal data internationally, we ensure appropriate safeguards are in place, including data processing agreements with our infrastructure providers that include standard contractual clauses where applicable.
11. Third-Party Links
The Service may contain links to third-party websites or services (including provider documentation, API consoles, and status pages). These sites have their own privacy policies, and we have no responsibility for their content or practices. We encourage you to review the privacy policies of any third-party services you visit.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address on your account) and/or by posting a notice on the Service at least 14 days before changes take effect. The "Last updated" date at the top of this page reflects when the policy was most recently revised.
Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes. If you do not agree to the revised policy, you should discontinue use of the Service and may request account deletion.
13. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy team:
For legal inquiries related to our Terms of Service, see our Terms of Service or contact legal@ekamsphere.com.