Privacy Policy

DRAFT — pending counsel review. This document is a working draft prepared from public templates and carrier guidance for SMS programs. It has not been reviewed by counsel. It will be replaced or ratified by counsel before any paid-business sending begins.

Effective date: May 1, 2026

Who we are

Eko is a hyperlocal community SMS service operated by LAB90 LLC, a Georgia limited liability company ("we," "us," "our"). When this policy refers to "Eko" or "the Service," it means the Eko service operated by LAB90 LLC at https://eko.day and any related landing pages on the eko.day domain.

Contact:

• Email: privacy@eko.day
• Mail: LAB90 LLC, Newnan, GA

What this policy covers

This policy explains what information Eko collects, how we use it, when (if ever) we share it, how we protect it, and what choices you have. It applies to anyone who visits eko.day, signs up to receive Eko SMS messages, or interacts with Eko in any other way.

Information we collect

We collect only what we need to operate the Service.

You give us directly when you sign up:

• Your mobile phone number
• The local area(s) you select (up to two — for example, Newnan and Peachtree City)
• Optional inputs you provide later, such as feedback or support messages

Automatically when you visit eko.day or tap a link in an Eko message:

• IP address and approximate location derived from it
• Browser type, operating system, and device type
• Pages you visit on eko.day, the link you tapped to get there, and the time of the visit
• Cookie identifiers used to remember your session and measure aggregate engagement

From our SMS provider (Twilio) when you receive a message:

• Whether the message was delivered, failed, or opted out
• Whether you replied with STOP, HELP, or another keyword
• Your carrier (used to diagnose deliverability issues)

We do not collect government identifiers, payment card data, precise geolocation, contacts, or any health or financial information.

How we use your information

We use the information above only for these purposes:

1. To send you the Service you signed up for — one curated SMS per day for the local areas you selected.
2. To verify it's really you during signup, by sending a one-time code to the number you provided.
3. To honor STOP, HELP, and other consent signals from you or your carrier.
4. To measure how the Service is performing — for example, how many people tapped a link, how many opted out, how engagement varies by location. This is reported to us in aggregate and is used to improve the editorial mix.
5. To prevent abuse — for example, blocking signup attempts that look automated.
6. To meet legal obligations — including responding to lawful requests from carriers, regulators, or law enforcement.

We do not use your information for any other purpose without telling you first and giving you a meaningful chance to opt out.

How we share your information — and what we never do with it

We do not sell your personal information. We do not share it with third parties for their own marketing.

Mobile information (including your phone number, opt-in status, and consent) is never shared with third parties or affiliates for marketing or promotional purposes. This restriction is required by mobile carriers and we honor it without exception.

We share information only in these limited cases:

• Service providers we use to operate Eko, under written contracts that limit them to working on our behalf:
  • Twilio Inc. — our SMS delivery and phone-number verification provider
  • Supabase — our database and authentication provider
  • Vercel — our website and application hosting provider
  • Cloudflare — our content delivery and security provider
  • Analytics providers used for aggregate, non-marketing measurement
• As required by law — for example, in response to a subpoena, court order, or other lawful government request.
• To protect rights and safety — when we have a good-faith belief that disclosure is necessary to prevent fraud, abuse, or harm.
• In a business transfer — if LAB90 LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you and honor any prior consent choices.

If we ever introduce paid placements from local businesses (Phase 2 of Eko), each such message will be clearly identified as such, and businesses will not receive your phone number, your name, or any other personal identifier — only aggregate counts of how many subscribers their message reached.

How long we keep your information

• Phone number, opt-in record, and consent timestamp: retained for as long as you are subscribed, plus a minimum of four (4) years after opt-out, to comply with TCPA recordkeeping obligations.
• Engagement and click data tied to your phone number: retained for up to 18 months, then anonymized.
• Aggregate, non-identifying analytics: retained indefinitely.
• Support correspondence: retained for up to three (3) years.

You may request earlier deletion as described below; we will honor it except where law requires us to retain a record.

Your choices and rights

• Stop receiving messages at any time by replying STOP to any Eko SMS. You will receive one final confirmation message and no further messages from that campaign. Standard message and data rates may apply to the STOP message itself.
• Get help by replying HELP to any Eko SMS, or by emailing support@eko.day.
• Access, correct, or delete your information by emailing privacy@eko.day from the email or mobile number associated with your account. We will respond within 30 days.
• Withdraw consent for analytics cookies through the cookie banner on eko.day or by using your browser's standard tracking-prevention controls.

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or another state with comprehensive privacy legislation, you may have additional rights under that state's law (including the right to opt out of "sales" or "sharing," to limit the use of sensitive data, or to appeal a denied request). Eko does not sell or share personal information for cross-context behavioral advertising. To exercise any state-law right, email privacy@eko.day.

Children

Eko is not directed to children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us their information, email privacy@eko.day and we will delete it promptly.

Security

We protect your information using industry-standard administrative, technical, and physical safeguards, including encryption in transit (TLS) and at rest, access controls scoped to operators with a legitimate need, and regular security reviews of our service providers. No method of transmission or storage is perfectly secure; if we ever experience a breach affecting your information, we will notify you as required by applicable law.

International users

Eko is operated from the United States and serves users located in the United States. If you access Eko from outside the U.S., your information will be transferred to and processed in the U.S. We do not currently offer the Service outside the U.S.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top and, for material changes, notify subscribers by SMS or by posting a banner on eko.day for at least 14 days before the change takes effect. Continued use of the Service after that period constitutes acceptance of the updated policy.

Contact

For privacy questions or requests:

• Email: privacy@eko.day
• Mail: LAB90 LLC, Attn: Privacy, Newnan, GA

For SMS support: reply HELP to any Eko message, or email support@eko.day.

This policy is a working draft. The version posted at https://eko.day/privacy is the controlling version once published.