Privacy Policy
This Privacy Policy explains how Ekon Labs collects, uses, stores, and protects your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Spanish data protection law.
Last updated: 1 August 2026
1. Overview
Ekon Labs (“we”, “us”, or “our”) is a technology company registered in Spain, operating under the jurisdiction of the European Union. We develop AI-powered software solutions, SaaS platforms, CRM systems, automation tools, and custom software for businesses across multiple industries.
These Terms apply to all current and future products, platforms and services operated by Ekon Labs, including StorVault, RealtyOSai, Reels-Estate, EsCasa, The Real Spain Estate Company, and any future software, SaaS platforms, AI services, websites or technology solutions developed or operated by Ekon Labs.
As the data controller, we are responsible for the personal data you provide to us through our website (https://www.ekon-labs.com), our software products, and our business communications. We are committed to protecting your privacy and processing your data lawfully, fairly, and transparently.
Data Controller
Ekon Labs
Carrer Les Basses 7
03749 Jesús Pobre (Alicante)
Spain
NIE: X2373359-N
Email: service@ekon-labs.com
2. Data We Collect
We collect personal data in the following contexts:
2.1 Website Visitors
- IP address and approximate geolocation
- Browser type, version, and operating system
- Pages visited, time on site, referral source
- Cookie identifiers and session data
2.2 Contact & Lead Forms
- Full name, email address, phone number
- Company name and job title
- Message content and inquiry details
- Preferred contact method and business requirements
2.3 Software Accounts & Subscriptions
- Account registration data (name, email, password hash)
- Billing information (processed by Stripe — we do not store card numbers)
- Usage data, feature interactions, and activity logs
- Support tickets and communication history
2.4 Marketing & Newsletter
- Email address and name (with explicit consent)
- Email engagement data (opens, clicks)
- Marketing preferences and opt-out status
2.5 AI Services
- Prompts and inputs submitted to AI-powered features
- AI-generated outputs and interaction history
- Feedback and correction data provided by users
3. Legal Basis for Processing
Under GDPR Article 6, we process personal data on the following legal bases:
Contract Performance (Art. 6(1)(b))
Processing necessary to deliver our software services, manage subscriptions, process payments, and provide customer support.
Legitimate Interests (Art. 6(1)(f))
Analytics to improve our services, fraud prevention, security monitoring, and direct marketing to existing clients.
Consent (Art. 6(1)(a))
Newsletter subscriptions, marketing communications, non-essential cookies, and AI prompt processing where applicable.
Legal Obligation (Art. 6(1)(c))
Compliance with Spanish tax law, EU financial regulations, and other applicable legal requirements.
5. Third-Party Services & Data Processors
We engage trusted third-party processors to deliver our services. Each processor is bound by a Data Processing Agreement and is required to implement appropriate technical and organisational security measures.
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | European Union / United States |
| Netlify | Web hosting and deployment | United States |
| Cloudflare | CDN, DNS, DDoS protection | United States |
| OpenAI | AI language model services | United States |
| Anthropic (Claude) | AI language model services | United States |
| Google (Analytics, Workspace) | Analytics, email, productivity | United States / European Union |
| Microsoft (Azure, 365) | Cloud infrastructure, productivity | European Union / United States |
| CRM & Automation Platform | CRM systems, marketing automation and business software | United States |
| Stripe | Payment processing | United States / European Union |
6. International Data Transfers
Some of our third-party processors are located outside the European Economic Area (EEA), including in the United States. Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where applicable
- Binding Corporate Rules where relevant
- EU-US Data Privacy Framework participation where applicable
You may request a copy of the applicable transfer mechanisms by contacting us at service@ekon-labs.com.
7. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected:
8. Security Measures
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:
- TLS/SSL encryption for all data in transit
- AES-256 encryption for data at rest
- Role-based access controls and least-privilege principles
- Multi-factor authentication for internal systems
- Regular security assessments and penetration testing
- Incident response procedures with 72-hour breach notification to supervisory authorities
- Employee data protection training and confidentiality obligations
9. Your Rights Under GDPR
As a data subject under GDPR, you have the following rights:
Right of Access (Art. 15)
Request a copy of all personal data we hold about you.
Right to Rectification (Art. 16)
Request correction of inaccurate or incomplete data.
Right to Erasure (Art. 17)
Request deletion of your personal data ("right to be forgotten").
Right to Restriction (Art. 18)
Request that we limit how we process your data.
Right to Portability (Art. 20)
Receive your data in a structured, machine-readable format.
Right to Object (Art. 21)
Object to processing based on legitimate interests or for direct marketing.
Right to Withdraw Consent
Withdraw consent at any time without affecting prior processing.
Right to Lodge a Complaint
File a complaint with the AEPD or your local supervisory authority.
To exercise any of these rights, contact us at service@ekon-labs.com. We will respond within 30 days.
10. Children's Privacy
Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at service@ekon-labs.com and we will delete such data promptly.
11. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on our website with a revised “Last updated” date. For significant changes affecting your rights, we will provide additional notice via email where we hold your contact details.
12. Contact & Complaints
For any privacy-related questions, requests, or complaints:
Contact
Ekon Labs
Carrer Les Basses 7
03749 Jesús Pobre (Alicante)
Spain
Supervisory Authority
If you are not satisfied with our response, you have the right to lodge a complaint with the Spanish data protection authority:
Agencia Española de Protección de Datos (AEPD) →