# Privacy Policy | Ekos Labs

> How Ekos Labs (Magic Labs, Ingolstadt, Germany) handles personal data on ekoslabs.com.

Updated 2026-10-24 · https://www.ekoslabs.com/privacy

## 1. Who we are

Ekos Labs is a trade name of Magic Labs, a sole proprietorship (Einzelunternehmen) operated by Eshaan Kansal, registered in Ingolstadt, Germany.
Postal address: Schönbergstr. 15, 85057 Ingolstadt, Germany.

Contact: [eshaan@ekoslabs.com](mailto:eshaan@ekoslabs.com)

## 2. What data we collect

When you first visit this site, no cookies are set and no analytics run. A consent banner asks whether you accept analytics cookies. Nothing is measured unless you choose “Accept”. If you choose “Decline”, or ignore the banner, analytics stay switched off and only your choice is stored locally in your browser.

If you contact us by email, we receive and process the information you voluntarily provide (your email address, name, and message content) solely to respond to your enquiry.

If you buy or use Ekos Skills, we process your purchase email, Stripe customer and transaction identifiers, plan status, library sign-in tokens, skill download activity, and any custom-skill or account deletion request you submit. We do not receive or store your complete card details.

## 3. Analytics (only after you accept)

If you accept, we use PostHog to understand how this site is used. PostHog then sets cookies and stores identifiers in your browser, and records:

- pages viewed, referrer, and time on page
- clicks and other interactions with page elements, including which calls to action are used
- approximate location (country and region), derived from your IP address
- device, browser, screen size, and page performance measurements
- a session recording of your interaction with the pages, used to see where visitors get stuck

Session recordings capture navigation, scrolling, and clicks. Text entered into form fields is masked before the recording leaves your browser, so we never receive it. Your IP address is anonymised by PostHog before storage and is not retained in full.

We use this to improve the site. We do not build advertising profiles, we do not sell or share this data, and we do not attempt to identify you personally.

Analytics data is processed by PostHog, Inc. (2261 Market Street #4008, San Francisco, CA 94114, USA) as our processor, on PostHog Cloud EU, which is hosted on servers in Frankfurt, Germany. Session recordings are deleted after 30 days. Other analytics events are kept for a maximum of 12 months. For details, see [PostHog's Privacy Policy](https://posthog.com/privacy).

You can withdraw your consent at any time by clearing this site's data in your browser settings, which removes your stored choice and brings the consent banner back. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

## 4. Booking a call

The “Talk to the founder” and “Get a free audit” buttons are ordinary links to an external booking page operated by Cal.com. Nothing from Cal.com is embedded in this site, and no data is sent to them while you are on this site. Once you follow the link, Cal.com acts as its own controller for anything you enter there, under [their privacy policy](https://cal.com/privacy). We receive the booking details you submit so that we can hold the call. Cal.com sends confirmed booking details to our server, and we forward the attendee name, email, meeting title, and start time to our private Slack workspace so we can respond promptly.

## 5. Legal basis for processing

Analytics, and the storing of and access to information on your device that it requires, happen solely on the basis of your consent (§ 25(1) TDDDG and Art. 6(1)(a) GDPR), given through the banner. There is no other legal basis for it, so declining costs you nothing.

When you contact us by email, we process your data on the basis of your consent (Art. 6(1)(a) GDPR) and our legitimate interest in responding to your enquiry (Art. 6(1)(f) GDPR).

A lead research request sent from /leads (your website, email and any targeting details you add) is stored on the basis of your consent (Art. 6(1)(a) GDPR), given by ticking the box on the form, so that we can review it and reply with a quote. Those form fields are excluded from analytics and session replay.

Purchase, library access, downloads, billing management, and support requests are processed to perform our contract with you (Art. 6(1)(b) GDPR). Payment and transaction records may also be retained to comply with legal obligations (Art. 6(1)(c) GDPR).

Server log data processed by our host is handled on the basis of our legitimate interest in operating and securing the site (Art. 6(1)(f) GDPR).

We also send a limited internal notification when a browser session opens /find or /leads. It contains only the page name and no IP address, referrer, cookie, or browser identifier. This is processed on the basis of our legitimate interest in monitoring whether these business tools are being used (Art. 6(1)(f) GDPR).

## 6. Data retention

Email correspondence is retained for as long as necessary to fulfil the purpose of the communication. If a business relationship results, correspondence is retained for the statutory retention period (6 years for commercial correspondence under German HGB § 257).

Skills account and download data is kept while your access is active and then only as long as needed for support, fraud prevention, and legal obligations. If you request account deletion, we remove account and activity data that is no longer required. Records that tax, commercial, or payment law requires us to keep remain restricted for the applicable retention period.

Lead research requests are kept while we review and quote them, and deleted on request unless they lead to an order whose records we are required to keep.

Stripe processes payments and subscription management. Supabase hosts the Skills access database, Resend delivers one-time sign-in emails, and Slack receives the limited internal notifications described above. These providers receive only the data needed for those tasks.

## 7. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and objection. To exercise any of these rights, contact us at [eshaan@ekoslabs.com](mailto:eshaan@ekoslabs.com).

You also have the right to lodge a complaint with a supervisory authority. The competent authority for Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

## 8. Hosting

This website is hosted on Vercel Inc., 440 N Baxter St, Coppell, TX 75019, USA. Vercel may process server log data (IP address, browser type, timestamps) on our behalf for security and operational purposes. For details, see [Vercel's Privacy Policy](https://vercel.com/legal/privacy-policy).

## 9. AI disclosure (EU AI Act, Art. 50)

Some services offered by Ekos Labs involve AI-powered systems (including outbound agents and content generation tools). In accordance with the EU AI Act, any AI system that interacts directly with individuals on behalf of Ekos Labs or its clients will disclose that the interaction is AI-driven at the point of first contact.

## 10. Changes to this policy

We may update this policy as our services or legal requirements evolve. The date at the top of this page reflects the latest revision.

## Links

- Human page: https://www.ekoslabs.com/privacy
- Site guide for agents: https://www.ekoslabs.com/llms.txt