Privacy Policy

Effective Date: July 16, 2026 Version: 1.0

This Privacy Policy explains how VeyonLab ("Ekai," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the Ekai business management platform (the "Service"). This Policy applies to the business entities that register for the Service ("Business," "you") and to individuals whose personal data we process in connection with a Business's use of the Service, including that Business's staff and its own customers.

By creating an account, checking the acceptance box presented at signup, or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Introduction & Scope

1.1. Ekai is a business management platform, not a consumer product. The Business that registers for the Service is our direct customer. In the course of providing the Service, we also process personal data about:

(a) the Business itself (registration and tax details);

(b) individuals the Business authorizes to use the Service on its behalf (staff/owner accounts); and

(c) the Business's own customers, where the Business chooses to record their information using the Service's customer relationship management, billing, or loyalty features.

1.2. For the data described in 1.1(c) — information about the Business's own customers — the Business is the data controller and Ekai acts as a data processor, processing that data only as instructed by and on behalf of the Business to operate the Service. Ekai is not responsible for the Business's decisions about what customer data to collect or how the Business uses it outside the Service, and questions from a Business's customers about their own data should be directed to that Business in the first instance, in accordance with Section 5.2 of our Terms & Conditions.

1.3. This Policy does not apply to any third-party website, application, or service that may be linked from the Service, or to information a Business collects about its customers outside of the Service.

2. Information We Collect

2.1. Business & Account Data

When you register, we collect your business name, business address, business contact number, and Nepali tax registration details (PAN number and, where applicable, VAT registration number), which we record and display as part of your business profile and the invoices you generate through the Service. Tax registration numbers are stored using encryption at rest.

2.2. Staff/User Data

For each individual who is given access to your account (owners and staff), we collect their name, email address, phone number, date of birth, and address (where provided), and their assigned role within your account. Login credentials are stored as irreversible cryptographic hashes — we do not store your staff's actual passwords.

2.3. Your Customer Data

Where you use the Service's customer relationship management, billing, or loyalty features, you may record personal data about your own customers, including their name, phone number, email address, date of birth, purchase history, and loyalty program activity. Sensitive fields in this category (name, phone, email, and related identifiers) are stored using encryption at rest. This data is collected, stored, and processed strictly on your instructions as described in Section 1.2 above.

2.4. Transaction & Billing Data

We collect and store records of orders, invoices, payment amounts, and the payment method selected at checkout (e.g., cash, card, or a named digital wallet). We do not collect or store payment card numbers or other card credentials — the Service does not integrate with a card-processing gateway, and payment method fields are recorded as a label of how payment was collected, not processed as a transaction by us.

2.5. Usage Data

We automatically collect standard technical information when you access the Service, including IP address, browser type, device information, and access timestamps, for security, troubleshooting, and service-operation purposes.

3. How We Use Information

3.1. We use the information described in Section 2 to:

(a) create and administer your account and provide the Service's features to you;

(b) generate AI-assisted business analytics and marketing content on your behalf, as described in Section 4;

(c) send you service-related communications, including account confirmations and, if requested, marketing content prepared for your business;

(d) provide customer support and respond to your inquiries;

(e) maintain the security, integrity, and proper functioning of the Service; and

(f) comply with applicable law.

3.2. We may derive aggregated or de-identified data from information collected across the Service — that is, data processed so that it does not identify your Business, your staff, or your customers. Because this data no longer identifies you or them, we may use it for any purpose connected with operating and growing our business, including improving and developing the Service, building new features, training or evaluating AI/ML models used in the Service, and producing internal or published analytics (for example, benchmarking typical transaction volumes across a business vertical). We will not attempt to re-identify this data.

3.3. Separately, and independent of Section 3.1, we may use identifiable data — including your Business's, your staff's, or your customers' personal data — across the Service (i.e., not limited to your own account) where reasonably necessary to detect, investigate, and prevent fraud, abuse, security incidents, or violations of these Terms, and to protect the safety of Ekai, our users, and the public. This is the only circumstance in which we use identifiable data for a purpose beyond directly operating your account.

We do not sell your data or your customers' data to third parties, and we do not share your identifiable business data with other businesses using the Service.

4. AI Processing Disclosure

4.1. The Service uses a third-party AI service provider (currently Groq) to generate marketing ad copy, video ad scripts, business analytics summaries, and draft replies to customer conversations.

4.2. Depending on which AI-assisted feature you use, the following may be sent to our AI processing provider for the purpose of generating a response:

• aggregated business figures such as revenue totals, order counts, and top-selling item names, used to generate analytics summaries and ad copy;
• your business name and business type (vertical);
• conversation text and any accompanying notes you provide when requesting a drafted message reply; and
• images you submit for menu or product catalog extraction.

4.3. Our AI processing provider processes this information solely to generate the requested output and does not use it to train models on our behalf beyond what is necessary to provide that output. We do not control, and are not responsible for, our AI provider's own data handling practices beyond the terms of our agreement with them; we encourage you not to include information in AI-drafted requests that you do not wish to be processed by a third-party AI service.

4.4. AI-generated output is not reviewed or verified by us before it is returned to you. See Section 6 of our Terms & Conditions for your responsibilities when using AI-generated content.

5. Third-Party Service Providers

We use the following categories of third-party service providers to operate the Service. Each is used solely for the stated purpose, and none receives more data than is necessary for that purpose:

• AI processing — to generate analytics summaries, marketing content, and message drafts, as described in Section 4.
• Cloud storage — to store AI-generated marketing assets, such as generated video ads and reference images you upload for marketing content requests.
• Email delivery — to send account-related transactional emails, such as welcome messages and staff invitations.

We do not use advertising networks, data brokers, or analytics providers that track you across other websites or apps.

We may also disclose information as required to comply with a valid legal process, court order, or other lawful government request, or where necessary to protect the rights, property, or safety of Ekai, our users, or the public.

6. Data Security

6.1. We apply industry-standard security measures to protect the information you provide, including encryption of sensitive personal data at rest, irreversible hashing of account passwords, and role-based access controls that limit which staff within your account can view or modify particular data.

6.2. No method of electronic storage or transmission is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security, and you acknowledge this in using the Service.

6.3. You are responsible for maintaining the confidentiality of your account credentials and for promptly notifying us of any suspected unauthorized access.

7. Data Retention

7.1. We retain your account data for as long as your account remains active, and for a reasonable period after account closure to allow for account recovery, dispute resolution, and to satisfy our own legal and accounting obligations.

7.2. We do not currently offer a fully automated, self-service tool to permanently delete your account or export your data. If you wish to close your account or request deletion or a copy of your data, please contact us using the details in Section 13, and we will process your request manually, subject to the retention period described above and any legal obligation that may require us to retain certain records for longer.

8. Your Rights

Consistent with Nepal's data protection framework, you may:

(a) request access to the personal data we hold about your Business or its staff accounts;

(b) request correction of inaccurate data;

(c) request deletion of your data, subject to the retention considerations described in Section 7; and

(d) withdraw consent for optional communications at any time.

To exercise any of these rights, contact us using the details in Section 13. We will respond within a reasonable time. Where a request concerns a Business's own customer data, and you are that customer, please direct your request to the Business directly, as described in Section 1.2; where the Business itself is unreachable or has ceased operating, contact us and we will assist to the extent we are able as a data processor.

9. Children's Privacy

The Service is intended for use by businesses and their authorized adult representatives. It is not directed at, and we do not knowingly collect personal data directly from, individuals under the age of 18 in their personal capacity. If you believe a minor has provided us with personal data outside the context of a Business's own customer records (which remain the Business's responsibility under Section 1.2), please contact us.

10. International Data Transfers

Some of the third-party service providers described in Section 5 may process data on servers located outside Nepal. Where this occurs, we take reasonable steps to ensure such providers maintain an appropriate standard of data protection consistent with the purpose for which the data was shared.

11. Cookies & Local Storage

The Service uses browser local storage to keep you signed in between visits, by storing session authentication tokens on your device. We do not currently use tracking cookies for advertising or cross-site analytics purposes.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. The "Effective Date" and "Version" at the top of this document will be updated accordingly. Material changes will be handled in the same manner as material changes to our Terms & Conditions, described in Section 14 of that document.

13. Contact / Grievance Officer

For questions, requests, or concerns regarding this Privacy Policy or our handling of your data, contact:

Veyon Lab (operating Ekai) Email: contact@veyonlab.com Website: veyonlab.com Address: Mahalaxmi-04, Lalitpur, Nepal