Privacy Policy

We collect the information you give us directly.

• Account information, which is the email address, name, organization, and authentication credentials you provide when you create an account.
• Research data, which is the files, datasets, and metadata you upload to the platform.
• Usage data, which describes how you interact with the services, including API calls, storage usage, and the features you use.
• Technical data, which is IP addresses, browser type, device information, and access logs kept for security and performance.

Storage is content addressed on IPFS. Your data is identified by its cryptographic hash rather than by its location, which protects both its security and its integrity.

We use your information for the following purposes.

• To provide the services, which means storing, retrieving, and managing your research data on decentralized infrastructure.
• To maintain security, protecting against unauthorized access, fraud, and abuse through UCAN authorization.
• To improve the platform by analyzing usage patterns, improving performance, and developing new features.
• To communicate with you, sending service updates and security alerts and responding to your inquiries.
• To comply with the law, meeting legal obligations and responding to lawful requests from authorities.

We never sell your personal information, and we never use your research data for any purpose other than providing the services.

The platform follows the GDPR principles.

• Data minimization. We collect only the data needed to provide the services.
• Purpose limitation. Your data is used only for the purposes stated in this policy.
• Storage limitation. Data is kept only as long as the stated purposes require.
• Integrity and confidentiality. Encryption and access controls protect the data we hold.
• Accountability. We keep records of processing activities and conduct regular audits.

You keep control over your data at all times through UCAN capability authorization.

Under GDPR and applicable privacy laws you have the following rights.

• Access. You can request a copy of the personal data we hold about you.
• Rectification. You can correct inaccurate or incomplete personal data.
• Erasure. You can request deletion of your personal data.
• Restriction. You can limit how we process your personal data.
• Portability. You can receive your data in a structured, machine-readable format.
• Objection. You can object to processing based on legitimate interests.
• Withdrawal of consent. Where processing is based on consent, you can withdraw it at any time.

To exercise these rights, contact us at privacy@ekayana.io. We respond to every request within 30 days.

Because the infrastructure is decentralized, your data may be processed in more than one location.

• Content is pinned on the IPFS cluster and replicated across its peers for redundancy and availability.
• API requests are processed in data centers with appropriate security certifications.

Transfers outside the EEA rely on one of the following safeguards.

• Standard Contractual Clauses approved by the European Commission.
• Adequacy decisions where they apply.
• Your explicit consent for a specific transfer.

Every transfer keeps the level of protection GDPR requires.

The following measures protect your data.

• All data is encrypted in transit with TLS 1.3 and at rest with AES-256.
• IPFS content identifiers make storage tamper evident, since anyone can verify a file against its hash.
• UCAN capability authorization gives fine grained permissions.
• Every API request is logged under a request id for security monitoring.
• ML-DSA-87 signatures under FIPS 204 authenticate identity and authorization, and ML-KEM-1024 under FIPS 203 protects stored content against attackers who record ciphertext now to decrypt it later.
• No component has yet received an external security audit or penetration test. We will commission independent assessments before general availability and publish their status in the documentation.

If a data breach occurs, we notify affected users and the relevant authorities within 72 hours, as GDPR requires.