Privacy Policy

1. What We Collect

1.1 Account Information

When you sign up, we collect:

• Email address — used for authentication, password resets, and essential service notifications
• Name — displayed in your profile and shared workspace for team collaboration
• Password — stored as a salted bcrypt hash; we never store or see your plaintext password

1.2 Content You Upload

When you use Eternity, you may upload:

• Files (CSV, XLSX, PDF, DOCX, PPTX, TXT, JSON) — processed and indexed in your organisation's isolated storage
• Queries — the questions you ask in chat. Stored in your organisation's chat history so you can revisit past conversations
• Business context — answers you provide during guided ingestion (e.g. "CTC means annual salary"). Stored in your knowledge space to improve query accuracy

1.3 Automatically Collected Data

• Authentication tokens — JWT tokens stored in your browser's localStorage for session management
• Server logs — IP address, browser type, and timestamps for security monitoring and debugging. Retained for 30 days, then deleted

1.4 Analytics (only with your consent)

If you accept cookies via our consent banner, we load Microsoft Clarity for session replay and heatmaps. This helps us understand how people navigate the product so we can improve it. Clarity collects:

• Page views and click patterns
• Scroll depth and session duration
• Device type, screen size, and browser
• Anonymised session recordings of your UI interactions

Clarity does NOT have access to:

• Your uploaded files or their contents
• Your query text or chat messages
• Your data tables or analytics results
• Any information inside your knowledge spaces

If you decline cookies, Clarity is never loaded. No tracking scripts run. Your choice is stored in localStorage and respected permanently.

2. What We Do NOT Collect or Do

This is equally important. We want to be explicit about what we will never do:

3. How Your Data Is Processed

3.1 Structured Data (CSV, XLSX)

When you upload a spreadsheet, the rows are ingested into a DuckDB database running on our servers. Queries against your spreadsheet data are executed as real SQL — the AI translates your question into SQL, and the database computes the result from your actual rows. The AI never "guesses" numbers.

3.2 Unstructured Data (PDF, DOCX, TXT)

Documents are chunked and embedded using the all-MiniLM-L6-v2 model (runs locally on our servers, not sent to any third party). Embeddings are stored in Qdrant (vector database) with organisation-level isolation via payload filtering.

3.3 AI Processing

When the AI needs to understand your question or generate a narrative response, we send context to Anthropic's Claude API. Here's exactly what is sent:

• Your question text
• Relevant schema information (column names, sample values, business context)
• For document queries: retrieved text chunks from your uploaded files
• Recent chat history (for follow-up question context)

Anthropic's commitments:

• Prompts and outputs are NOT used for training (contractually guaranteed under their commercial API terms)
• Data may be retained for up to 30 days for trust & safety review, then deleted
• Enterprise customers can negotiate zero-retention agreements

4. Where Your Data Lives

5. Cookies & Local Storage

Eternity uses minimal browser storage. Here's the complete list:

We do not use cookies for authentication. We do not set any third-party cookies unless you explicitly accept analytics via our cookie consent banner.

6. Data Retention & Deletion

• Your uploaded files: Retained as long as your account is active. You can delete individual files or entire knowledge spaces at any time from the dashboard.
• Chat history: Retained as long as your account is active. Text-only (no dataframes or computed results stored).
• Account data: If you delete your account, all associated data (files, chat history, spaces, business context) is permanently deleted within 30 days.
• Server logs: Automatically deleted after 30 days.
• Anthropic processing: Anthropic may retain query data for up to 30 days for trust & safety, then deletes it. Enterprise zero-retention available on request.
• Pinned insights: Persist until you unpin them. Shared insight links remain accessible until the pin is deleted.

7. Shared Insights & Public Links

When you share a pinned insight via email, a unique link is generated (e.g. eternity.help/shared/abc123). Anyone with this link can view that specific insight — the query, answer, chart, and data table. No other data from your organisation is accessible through shared links.

Shared insight pages are marked with robots: noindex — search engines will not index them. You can revoke access by deleting the pin.

8. Third-Party Services

We use the following third-party services. Each has been chosen for a specific purpose and receives only the minimum data necessary:

9. Your Rights

9.1 For All Users

• Access: You can view all your data in the dashboard at any time
• Export: Your original uploaded files are always downloadable
• Delete: Delete individual files, spaces, or your entire account
• Consent: Decline analytics tracking at any time via the cookie banner

9.2 GDPR (European Union)

If you are in the EU, you have additional rights under GDPR:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to restrict processing
• Right to object to processing

To exercise any of these rights, email privacy@eternity.help. We will respond within 30 days.

9.3 CCPA (California)

If you are a California resident: we do NOT sell your personal information. You have the right to know what data we collect, request deletion, and opt out of any sale (though there is nothing to opt out of — we don't sell data).

9.4 India (DPDP Act)

If you are in India: we process your data based on your consent (provided at signup) and for the legitimate purpose of delivering the service. You can withdraw consent and request deletion at any time.

10. Security Measures

• Encryption in transit: All data is transmitted over HTTPS (TLS 1.2+)
• Encryption at rest: Database storage is encrypted at rest via provider-level encryption
• Password hashing: bcrypt with per-user salt
• JWT authentication: Short-lived tokens with secure signing
• Organisation isolation: All queries are scoped to your organisation via database-level filtering
• Role-based access control: Owner, admin, and member roles with different permission levels
• Security headers: CSP, HSTS, X-Frame-Options, and other standard security headers on all responses

11. Children's Privacy

Eternity is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has provided us data, contact us and we will delete it promptly.

For educational use cases involving minors (ages 13+), the institution is responsible for obtaining appropriate parental or guardian consent as required by local law.

12. Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will notify you via email or a prominent notice on the Service. The "Last Updated" date at the top reflects the most recent revision.

13. Contact

• Privacy questions: privacy@eternity.help
• General support: support@eternity.help
• Data deletion requests: privacy@eternity.help