Ethos Privacy Policy

Effective date: 9 October 2026 · Version: 1.0

Controller: Ethos, operated by its founder, Natanel Fishman (the company that will operate Ethos is still in the making), of Or Akiva, Israel (write to support@ethosy.ai for a full postal address) ("Ethos", "we", "us", "our").

Privacy contact: privacy@ethosy.ai · Everything else: support@ethosy.ai

How to read this document. Each section opens with a short summary in plain words, marked In short. The summaries are written to be accurate, and we hold ourselves to them. If a summary and the full text of a section ever appear to differ, the full text governs, and we will fix the summary.

Read this Policy together with our Terms of Use and the Sub-processors and Data Location page, which names every company that receives any part of your data, what it receives, and where.

The ten things to know first

Ethos holds what you hand over about one person, usually a person who has died, and answers questions from it. To do that it stores the material, breaks it into passages, indexes them, and sends the relevant parts to a small number of named companies that read, transcribe, index and speak them.
It is not end-to-end encrypted, and cannot be while it does what it does. We hold the key. We could read your Archive. We do not, except in the narrow cases in section 9, and nothing leaves except to the companies named on the Sub-processors page, for the reasons named there.
Your data lives in the United States. Our servers, database and uploaded files are hosted in California. If you are in Israel, the European Economic Area or the United Kingdom, your data is transferred there. Section 7 explains how. The earlier web version of the Service, which is being retired, keeps its data in the European Union.
We never train models on your Archive, and we never sell it or share it for advertising.
Nothing arrives on its own. No notifications, reminders or messages, and never anything in the person's name.
A voice is built from recordings you add as the person's own, and a face from their photograph at the first meeting or when you start a video call, in each case only after a separate consent, and both are destroyed when you delete the Archive. Section 5 is our biometric notice.
Other people are in your material. The other side of a chat, the people mentioned, the faces in photographs. Section 4 says what we do and do not do with them, and how they can have their part removed without an account.
You can export everything, free, as often as you like, and you can delete one file, one Archive or your whole Account from inside the App, immediately. Deletion reaches our vendors. Backups are kept for no longer than 90 days.
There is no way to pass an Archive to anyone when you die. Export it while you can. A close relative or executor can ask us to delete it.
Ethos is for adults. You must be 18 years of age or older.

1. Who we are, and what this Policy covers

In short: Ethos is the controller of your personal data. This Policy covers the Ethos App and the ethosy.ai website. It does not cover other products.

1.1 Controller. Ethos is the controller of the personal data described in this Policy, and the owner of the databases in which it is held, for the purposes of the Israeli Protection of Privacy Law, 5741-1981 ("PPL"), the EU General Data Protection Regulation and the UK GDPR (together, "GDPR"), and the state privacy laws of the United States.

1.2 What this Policy covers. This Policy covers:

(a) the Ethos mobile application for iOS and Android (the "App");

(b) the website at ethosy.ai (the "Website"), including its public pages and sign-in; and

1.3 The earlier web version, and what this Policy does not cover. An earlier, web-based version of the Service can still be reached from the Website after sign-in. It is being retired. If you sign in on the Website, your email address and name are also recorded in that version's own database. Its Archives, invitations and emails are handled by the servers and Sub-processors listed under "Earlier web version" on the Sub-processors page: its servers and database are in the European Union, and its emails are sent by a provider in the United States. It differs from the App in that it can share an Archive with people you invite or whose accounts you add, and it fetches web addresses you paste from its own servers. Deleting your Account in the App does not reach it: write to privacy@ethosy.ai and we will delete what it holds about you. The commitments in this Policy apply to it. This Policy does not cover deadbook.ai or any other product.

1.4 Definitions. Capitalised words have the meanings given in the Terms of Use. In particular: an "Archive" is everything you provide about one person and everything derived from it; the "Subject" is the person an Archive is about; "Source Material" is what you provide; "Generated Content" is what the Service produces from it; a "Third-Party Participant" is any person other than the Subject who appears in Source Material; a "Voice Model" and a "Likeness Model" are the biometric models described in section 5; and a "Sub-processor" is a company that receives part of your data to perform part of the Service for us.

2. What we collect

In short: your email and sign-in identity; everything you hand over to build an Archive, including the other people in it; what the Service derives from it; the conversations you have with it; a voice and a face if you ask for them; the invitations you make or use; and a small amount of content-free usage and crash data. Some things stay only on your phone.

2.1 Account data

Your email address, and the identity we receive from a sign-in provider if you use one (Google, or Apple where offered): an identifier, your email address, and your name if the provider supplies it.
The record that you accepted the Terms of Use and this Policy, and when.
Session tokens and the technical data needed to keep you signed in.
If you sign in on the Website, the same email address and name, recorded also by the earlier web version (section 1.3).

2.2 Source Material you provide

Everything you hand over to build an Archive:

Exported conversations, such as WhatsApp, Telegram and email exports, and exports from Google and Meta services. An exported conversation is stored whole, not only the Subject's side, because an Archive is a record of a conversation. Section 4 explains how the other side is treated.
Documents, letters and notes.
Photographs, including photographs of the Subject and, if you use the guided face capture, a set of photographs of a face taken from several angles.
Audio recordings, voice notes and video, including recordings you add as the Subject's own voice, which the Service treats as theirs on your word, and recordings you make in the App.
Links to Wikipedia articles you add, and the public pages the Service finds at your request as described in section 2.6.
Corrections you make to what the Archive says.

2.3 What the Service derives from it

Passages, which we sometimes call memories: short pieces of text extracted from Source Material, each carrying where it came from and, where known, when it was said.
A numeric index over those passages (embeddings), used to find the passages relevant to a question. The index is stored on the same row as the passage and is deleted with it.
A description of how the Subject speaks and what is known about them, compiled from the Archive, in which the Subject's recurring phrases are checked against Source Material attributed to them and any not found there is removed, and which is rebuilt, without it, when Source Material it was compiled from is removed.
Groupings of passages by area of life, used to organise the Archive.
A record of who is mentioned in your Archives and how they are related to the Subject, used so the Subject's words can be understood. It is kept with your Account, shared across the Archives on it, and deleted when you delete your Account.
A Voice Model and a Likeness Model, only if you ask for them (section 5).
Transcripts of recordings, made so that speech can be read and searched.

2.4 Your conversations with an Archive

The messages you send and the replies you receive, by text and in calls. Calls are transcribed as they happen; on our own call lane the audio is streamed for transcription and we do not keep the recording afterwards.
What the Archive learns about you from your conversations with it, such as your name, your relationship to the Subject and things you tell it about yourself, kept so that it can keep continuity from one conversation to the next. This is stored with your Account and deleted with it.
Reports you make about a reply, and letters you write to us about one.
When enabled, an internal record of which passages reached the model for a given reply, kept so that we can audit that replies were grounded in the Archive. It contains no more than the reply and the passages already stored.

2.5 Usage, diagnostics and device data

Product analytics. In the App and on our servers: which screens are used, how often, and which stage of a flow was reached, sent to PostHog's European cloud. The App and our servers are built to send only counts, screen names, stage labels and true-or-false values; message content, names, files and recordings are dropped before anything is sent. On the Website: page views, the addresses of the pages you visit and interactions such as clicks, sent to the same service; the Website does not use PostHog's session recording. The same content-free events, with your Account identifier, are recorded in our own operations system, hosted for us by Railway in the United States, so that we can understand how the Service is used and run controlled comparisons of features.
Crash reports. The App, our servers and the Website can send crash reports to Sentry. In the App, when enabled, they carry no personal identifiers and no content. On our servers and on the Website, when enabled, they also carry a short trail of what happened just before the error: on our servers, recent log lines, which can include names mentioned in an Archive; on the Website, recent clicks, page changes and requests. Crash reporting is inactive unless we configure it, and the Sub-processors page states whether it is active.
Server logs. Our hosting platform keeps request logs, which include your IP address, the time and the path requested, and our servers write application logs that can include names mentioned in an Archive and web addresses you approve, each for a limited period stated in section 8.
Device permissions. The App asks your phone for the microphone (to record a voice note or hold a call), the camera (to photograph the Subject or a print), your photo library (to choose a photograph), and vibration (for small physical feedback). On Android it also declares internet access and the technical permissions the call libraries need: reading the network state, adjusting audio settings, keeping the screen awake during a call, connecting a Bluetooth headset, and running a call in the foreground; and it explicitly removes the default permissions to read or write general storage and to draw over other apps. The App does not collect your location and does not access your contacts.
The video-call page. The page that shows a video call on a vendor's lane loads its code and fonts from two content-delivery networks named on the Sub-processors page, which see your IP address when the page loads.
Cookies on the Website. The Website uses cookies and similar storage for sign-in sessions (set by Clerk) and for analytics (set by PostHog, European cloud). It uses no advertising cookies and no cross-site tracking. Your browser lets you block or delete cookies; blocking session cookies prevents sign-in.

2.6 Public material the Service finds at your request

If you ask the Service to look for public material about the Subject by name, the name is sent to Wikipedia's search to find matching articles; if you give a web address, the Service classifies it. The Service then proposes matching public pages, such as a Wikipedia article or a public professional or social-media profile. No page is fetched until you approve one. Wikipedia pages are fetched directly; other public pages are fetched for us by Bright Data, a Sub-processor, so that our servers never open an address typed by a user. The text of an approved page is kept with the Archive for your review and, unless you decline the page, included in your export, and only the lines you confirm are added to the Archive as passages, as facts about the Subject and never as the Subject's own words or voice. Declining a page stops it being used and leaves it out of your export; its text is deleted when you delete the Archive.

2.7 Payments

Reading, adding to and exporting an Archive are free. The plan, a subscription that lifts the free monthly allowance of answers and calls, is bought through the Apple App Store or Google Play, which process payment. RevenueCat, a Sub-processor, receives your Account identifier and the purchase record the store reports, so that we know whether your Account holds the plan. Neither we nor RevenueCat receive your card number.

2.8 Correspondence

What you write to us at support@ethosy.ai or privacy@ethosy.ai, and our replies.

2.9 What stays only on your phone

The App keeps some things only on your device and never sends them to us:

a private note you type about the Subject, which is deliberately never uploaded, so that your own memory of a person is never spoken back to you in their voice;
an unfinished setup draft;
your reading and sound preferences;
which pronoun to use for each person; and
which person you last opened, and when you last opened the App.

These are not in your export and are not reached by a deletion on our side. Signing out clears the note, the draft and the pronouns; deleting your Account signs you out. Preferences and the last-opened records remain until you uninstall the App.

2.10 Invitations

If you invite someone to join you (Terms of Use section 4.5), or join someone through an invitation:

The invitation. We record a code, the Archive it is for, the Account that made it, and when. The code is part of the link. The App hands the link to your phone in a message that names the Subject as you have named them, or says that the Archive is your own. You choose who receives it and through which app, and we are not told who received it.
Opening the link. The link opens a page on the Website that names nobody and does not look the code up; it hands the code to the App. Opening it is recorded like a visit to any other page of the Website, including the page's address, which contains the code (section 2.5).
Joining. Only a person signed in to an Account of their own can join. When they choose to, we record which Account used the code and when, and keep their place beside you: the Archive, their Account, the first name on their Account if it has one, which the App sends as they join, and when they joined.
Who sees what. The person who joins is told the name the Archive is shown under, and nothing else about it. You see who joined through your invitations: the first name on the Account that used each one, if it had one, and when they joined. Joining gives no access to the Archive: the person who joined cannot ask it anything, read, hear or export anything in it, or learn how much it holds.
Weekly totals. We count, week by week, how many invitations were made and used, and how many of the people who joined sent at least one message in the App during their fourth week, to learn whether invitations help people keep using the Service. We look only at the totals, and the count reads no message content.

3. Why we use it, and on what legal basis

In short: we use your data to run the Service for you, to keep it secure, to answer you when you write to us, to understand which parts of the Service are used, and to comply with the law. We do not use it for advertising, and we do not train models on it.

3.1 Purposes and legal bases. The table below sets out each purpose, the data involved, and the legal basis we rely on under the GDPR. Under the PPL, we process personal data with your consent, given when you accept this Policy and, for a Voice Model or Likeness Model, given separately as described in section 5, and for the purposes stated here.

Purpose	Data	GDPR basis
Creating and securing your Account; signing you in	Account data	Performance of a contract (the Terms of Use)
Building an Archive: storing, transcribing, extracting, indexing and organising Source Material	Source Material; derived data	Performance of a contract; for special-category data present in Source Material, your explicit consent given when you provide it
Answering you: retrieving passages and generating replies, in text and in calls	Derived data; your conversations	Performance of a contract
Building and using a Voice Model or Likeness Model	Designated recordings and photographs; the models	Your explicit consent, given separately before either is built (section 5)
Keeping continuity across conversations	What the Archive learns about you	Performance of a contract
Making invitations, recording who joined, and showing each person what section 2.10 describes	Invitation records	Performance of a contract (the Terms of Use), with the person who makes an invitation and with the person who uses it
Counting, in weekly totals, how many invitations are made and used, and whether the people who joined keep using the Service	Invitation records; whether an Account that joined sent a message in its fourth week	Our legitimate interest in understanding whether invitations work, pursued with totals only and never with content
Finding public material about the Subject at your request	Your query; the pages you approve	Performance of a contract; for a living Subject, the Subject's consent that you have confirmed
Correcting replies and acting on reports	Reports, corrections, correspondence	Performance of a contract; our legitimate interest in the accuracy of the Service
Handling requests from Third-Party Participants and other people about their data	Correspondence; the relevant part of an Archive	Our legal obligations; our legitimate interest in respecting the rights of people who are not our users
Understanding how the Service is used; testing changes	Content-free analytics events	Our legitimate interest in improving the Service, pursued in a way that never involves content
Detecting and fixing faults	Crash reports; server logs	Our legitimate interest in a Service that works and is secure
Preventing abuse and keeping the Service secure; enforcing the Terms	Account data; logs; the minimum of content needed to investigate a report or an incident	Our legitimate interest in a secure Service; our legal obligations
Telling you about changes to the Service, these documents or your Account	Account data	Performance of a contract; our legal obligations
Billing for the plan	Purchase records	Performance of a contract; our legal obligations
Complying with the law and responding to lawful requests	Whatever the law requires	Our legal obligations

3.2 Processing of other people's data. Section 4 sets out the basis on which we process data about the Subject and about Third-Party Participants.

3.3 No automated decisions with legal effect. The Service makes no decision about you that has legal or similarly significant effects. Generated Content is produced automatically, but it is a reply to a question you asked, not a decision about you.

3.4 No advertising, no sale, no training. We do not use personal data for advertising, we do not sell it, we do not share it for cross-context behavioural advertising, and we do not use Source Material, Archives or Generated Content to train, fine-tune or improve any machine-learning model.

3.5 You are not obliged to provide anything. Providing personal data to Ethos is voluntary. Without an email address we cannot create an Account, and without Source Material there is nothing to build an Archive from, but you decide what to provide and you can remove it at any time.

4. People other than you

In short: an Archive is about someone, and that someone is usually not the Account Holder. The other people in your material never asked to be there. We treat both with care: the Subject's words are the only words the Archive speaks, the other people's words are context and nothing more, and anyone in your material can have their part removed without an account.

4.1 The Subject

(a) A Subject who has died. Most Archives are about a person who has died and cannot consent. The Account Holder is responsible for holding the authority the Terms of Use describe, and we act on objections from people with standing as the Terms set out. Data about a person who has died is not personal data under the GDPR, but it may be protected by the laws of the country concerned, including Israeli law on the privacy and likeness of the deceased, and we treat it with the same care as personal data.

(b) A living Subject who is not the Account Holder. An Archive about a living person may be built only with that person's explicit consent, which the Account Holder must hold. A living Subject who learns that an Archive about them exists may contact us at privacy@ethosy.ai; after reasonable verification of identity we will tell them whether an Archive about them exists, and on their request delete it, or the parts of it that concern them, and any Voice Model or Likeness Model of them. We will tell the Account Holder that this has happened.

(c) You, as your own Subject. If you build an Archive about yourself, you are both Account Holder and Subject, and every right in this Policy is yours.

4.2 Third-Party Participants

(a) What is held. The other side of every imported conversation, the people mentioned in it, and the people in photographs are stored as part of the Archive. Their lines are read by the model that extracts passages, so that the Subject's words can be understood in context, and the Service may record that they are mentioned and how they are related to the Subject.

(b) What is not done. In an imported conversation, the Service splits the export by sender and treats as the Subject's only the lines of the sender whose name matches the Subject or whom you confirm; the other participants' lines are never attributed to the Subject, never spoken in the Subject's voice, and never used to shape how the Archive speaks, and where a line cannot be confidently attributed to the Subject it is treated as not the Subject's. A recording or photograph you add on its own is treated as the Subject's, and for a document the Service judges from the text who wrote it; the Terms of Use make you responsible for adding as the Subject's only what is theirs. No Voice Model or Likeness Model is built from anything you have not added as the Subject's. The Service records who is mentioned and how they are related to the Subject, kept with your Account and shared across your Archives; no other profile of a Third-Party Participant is built, and nothing about them is used for any purpose beyond understanding your Archives.

(c) Legal basis. We process Third-Party Participants' data on the basis of our legitimate interest in providing an accurate Archive of the Subject to the Account Holder, with the safeguards in paragraph (b) and the removal right in paragraph (d). Where Source Material contains special-category data about a Third-Party Participant, such as a health disclosure, we do not seek it out, we use it for nothing beyond the Archive, and we remove it on request.

(d) Removal without an account. A Third-Party Participant may ask us at privacy@ethosy.ai to remove their material from an Archive. After reasonable verification of their identity and of their appearance in the material, we will remove or pseudonymise the lines, images and details attributed to them and the passages derived from those lines, across the Archive, normally within 30 days. We will tell the Account Holder that a removal was made and what it concerned, but not who asked unless the requester agrees. Because the Account Holder's own copy of the Source Material is theirs, removal applies to what Ethos holds.

(e) Export. An export contains Source Material as it was provided, including Third-Party Participants. The Account Holder's responsibilities under the Terms of Use apply to what they do with it.

4.3 People in public material

Material the Service finds at your request under section 2.6 is public material about the Subject. A page is fetched only after you approve it, its text is kept with the Archive, and only the lines you confirm become passages. The feature is provided for material about the Subject, and the Terms of Use require you to use it only for the Subject.

5. Biometric data: voices and faces

In short: a voiceprint and a face model are biometric data. A voice is built from recordings you add as the Subject's own, and a face from their photographs, in each case only after a separate written consent, and only to speak and animate the Archive they belong to. They are destroyed when the Archive or the Account is deleted, at the vendor as well as here, and they are never sold, leased, traded or used to identify anyone.

This section is our notice for biometric data, and it applies wherever you are.

5.1 What we build.

(a) A Voice Model. When you add a recording to the Archive as the Subject's own voice, it is sent to our speech Sub-processor, ElevenLabs, which derives a model of how that person sounded. That model is what speaks Generated Content aloud. The recordings themselves stay in the Archive.

(b) A Likeness Model. For our own video lane, a model of the face is built on our servers from a guided set of photographs you take for the purpose. For the first meeting with the Subject after an Archive is made, and for video calls on its lane, the photograph you chose is sent to LemonSlice, which draws and animates a face from it for that session. For a video call on the Anam lane, the most recent photograph of the Subject in the Archive is sent once to Anam, which builds a face it keeps until you delete the Archive and animates during each call; the Subject's name is sent with each call.

5.2 Consent before capture. No Voice Model or Likeness Model is built without your separate, explicit consent, given in the App before capture or upload, which names the model to be built, its purpose, the retention period in section 5.4 and the destruction described there. The version of the words you agreed to and the time you agreed are recorded with the Archive. A general acceptance of the Terms of Use or this Policy is not that consent.

5.3 Purpose, and the purposes we exclude. A Voice Model and a Likeness Model are used solely to speak and animate Generated Content in the Archive they belong to. They are never used to identify any person, never compared against any other voice or face, never disclosed to anyone other than the Sub-processor that hosts them, never sold, leased, traded or otherwise profited from, and never used outside your Archive.

5.4 Retention and destruction schedule. A Voice Model and a Likeness Model are kept no longer than the Archive they belong to exists. They are destroyed:

(a) when you delete the Archive or your Account, immediately on our systems and by an immediate instruction to the Sub-processor that hosts them;

(b) for a Voice Model, in the same way, when you delete the recording or the imported conversation it was built from. Where we hold no record of which recording a Voice Model was built from, as is the case for Voice Models built before we began keeping that record, it is destroyed when you delete the last recording in the Archive that could have been its source, and until then the App tells you, each time you delete one of those recordings, that the voice remains; if no such recording remains, it is destroyed at the latest under (a), or earlier under (d);

(d) when you ask us to destroy them on their own, at privacy@ethosy.ai.

If a destruction instruction to a Sub-processor fails, the App tells you that a step could not be completed, and we complete it by hand and confirm. Our Sub-processors' own retention of what we send them is described on the Sub-processors page; where a Sub-processor's published terms retain voice data for a period after our instruction, we say so there.

5.5 Disclosure of synthetic output. Generated Content spoken by a Voice Model or animated by a Likeness Model is marked in the App as generated and not the real person, and any reply you share out of the App carries that statement.

5.6 The person whose voice it is. Because the Subject is usually a person who has died, the consent in section 5.2 is given by the Account Holder, who must hold the authority the Terms of Use describe. A living Subject's own consent is required before their Voice Model or Likeness Model is built, and the Terms set out who may consent for a Subject who has died and how objections are handled.

6. Who receives your data

In short: an Archive cannot be built, searched, spoken or answered without leaving Ethos. Each company below receives one part, for one reason, at the moment something is being done with it, and none of them is given the Archive to browse. The full list, with locations and each company's published terms on training and retention, is on the Sub-processors page.

6.1 Sub-processors. We use the following categories of Sub-processor, each named on the Sub-processors and Data Location page with what it receives, why, where it is, and the safeguards that apply:

Authentication (Clerk): your email address and sign-in identity.
Hosting (Railway): our servers, database and uploaded files, in the United States, and one supporting service in the Netherlands.
Language models (OpenAI): the text of Source Material, including the other side of imported conversations, documents and approved pages, when passages are extracted from it and the description of the Subject is compiled; your message and the passages that answer it, to write a reply; the text of passages, to build the index; and recordings, to transcribe them. Other providers are wired into the Service but not used unless we switch to them, and the Sub-processors page names which provider is in use.
Speech (ElevenLabs): the recordings you add as the Subject's own voice, and the Subject's name as the name of the voice, to build a Voice Model; the text of a reply, to speak it. On a call lane that uses ElevenLabs' conversational agent: your speech during the call, and, depending on how the agent is built, either only the sentences our own server decides to speak, or the compiled description of the Subject and the facts in the Archive as the agent's knowledge base, with replies written by a model that ElevenLabs hosts. The Sub-processors page states which applies.
Animation (LemonSlice, for the first meeting and video calls on its lane): the photograph you chose, at each meeting or call, and each reply as spoken audio. (Anam, for video calls on its lane): the most recent photograph of the Subject, once; and with each call, the Subject's name and each reply as spoken audio.
Call transport (LiveKit, for meetings and calls on the LemonSlice lane): the sound and picture of the call while it runs.
Public-page fetching (Bright Data): a public web address you approved, other than Wikipedia, as described in section 2.6.
Wikipedia (Wikimedia Foundation): a name you search for, and the title or address of an article you add or approve.
Analytics (PostHog, European cloud): content-free usage events from the App and our servers; page views and interactions on the Website.
Crash reporting (Sentry): crash reports from the App and our servers, as section 2.5 describes.
Subscriptions (RevenueCat): your Account identifier and the purchase records the store reports, as section 2.7 describes.
Website hosting (Vercel): the Website and its logs.
Content delivery for the video-call page (esm.sh, Google Fonts): the page's code and fonts; they see your IP address when the page loads.
Sign-in providers (Google, Apple): the identity they give us when you sign in with them.
App stores (Apple, Google): distribution of the App and payment for the plan.
The earlier web version (Railway in the Netherlands, Supabase in Germany, Postmark for its emails): the account data, Archives and invitations of that version, as section 1.3 describes.

Several other call and video vendors are integrated in our code but receive nothing until we enable them; the Sub-processors page lists them as inactive and will be updated before any of them receives data.

6.2 How Sub-processors are bound. Each Sub-processor that processes personal data on our behalf is bound to us by a data-processing agreement or terms that restrict it to processing what we send for the purpose of providing its service to us. Sign-in providers, the app stores and Wikipedia are independent services acting under their own terms, and receive only what section 6.1 describes. What each company's published terms say about training, retention and location is stated on the Sub-processors page, so that you can see our claims and theirs side by side. We do not assert terms we cannot show.

6.3 Adding a Sub-processor. We will update the Sub-processors page before a new company receives any personal data, and we will notify you in the App of any change that affects an Archive you have already built.

6.4 Other disclosures. Beyond Sub-processors, we disclose personal data only:

(a) to comply with the law: in response to a valid legal process from a court or authority with jurisdiction. We will require the request to be lawful, limit what we disclose to what it requires, and, unless prohibited by law or unless doing so would endanger a person, tell you before we comply;

(b) to protect people: where we reasonably believe disclosure is necessary to prevent imminent harm to a person;

(d) in a change of control: if Ethos or the Service is acquired by or merged with another organisation, your data will pass to that organisation only under this Policy and the Terms of Use, or terms at least as protective, and you will be told in advance and be able to export and delete before the transfer takes effect.

We never disclose an Archive to another user or to a member of the Subject's family, and we never disclose the contents of an Archive to a Third-Party Participant beyond confirming and removing their own material. A person who joins through an invitation is told only the name the Archive is shown under (section 2.10).

7. Where your data is, and international transfers

In short: our servers are in the United States. If you are in Israel, the EEA or the UK, that is a transfer abroad, made under the safeguards described here.

7.1 Location. Our production servers, database and uploaded files are hosted by Railway in the United States (California), as is our own operations system.

The earlier web version runs on Railway in the Netherlands with its database at Supabase in Germany. The Website is served by Vercel from locations near the visitor. Our Sub-processors are located as stated on the Sub-processors page; several operate in the United States, so material is transferred there when a reply is written, speech is transcribed, an index is built, a voice is built or a face is animated.

7.2 Transfers from Israel. We transfer personal data from Israel to the United States and to other countries under the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, relying on your consent to this Policy and on the contractual undertakings each Sub-processor gives us to protect the data to the standard those Regulations require.

7.3 Transfers from the EEA and the UK. Israel benefits from a European Commission adequacy decision, renewed in January 2024, and from UK adequacy regulations. Transfers from Ethos to Sub-processors in the United States are made under the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and, where the Sub-processor is certified under the EU-US Data Privacy Framework, under that Framework. The Sub-processors page states which mechanism applies to each.

7.4 Representative in the EU and the UK. We are in the process of appointing a representative in the European Union and in the United Kingdom under Article 27 of the GDPR and the UK GDPR. Their details will be published here when appointed. Until then, contact us directly at privacy@ethosy.ai.

8. How long we keep it

In short: until you delete it. Backups for no longer than 90 days. Logs for no longer than 30 days. Nothing is kept "in case you change your mind".

8.1 Retention schedule.

Data	Kept until
Account data	You delete your Account. Your sign-in identity at Clerk, and the record that you accepted the Terms and this Policy, are deleted by our instruction at the same time.
Source Material, passages, index, description, groupings	You delete the source, the Archive or your Account. Deleting an Archive or your Account destroys them immediately on our production systems. Deleting a single source destroys the file, the text extracted from it, its passages and its index entries immediately. A short record that the source existed and was removed is kept, never used to answer anyone, until you delete the Archive or your Account: its name (for a web page, its title) and where the file was stored, its type and size, the period it covered and how many items it held, when it was added and removed, cryptographic fingerprints of its contents from which the contents cannot be reconstructed, for a recording, whether it was marked as the Subject's voice, and, for a guided set of photographs, the record of the consent under which they were taken and by whom.
Relationship record (who is mentioned, and how they are related)	You delete your Account. It is kept with the Account and shared across its Archives.
Voice Model, Likeness Model	You delete the Archive or your Account, or ask for the model to be destroyed; a Voice Model also when you delete the recording it was built from (section 5.4).
Conversations, corrections, what the Archive learns about you	You delete the Archive or your Account.
Invitations, and the place of each person who joined	An invitation stops opening once it is used, or 30 days after it was made. Its record is kept, so that a link opened after it has closed can be answered as closed, and for the weekly totals in section 2.10, until the Archive is deleted or the Account that made or used it is deleted. The place of a person who joined, with the first name recorded for them, is kept until the Archive is deleted or their Account is deleted.
Reports about a reply	Until the report has been handled, and no longer than 12 months.
Public material found at your request	The text of an approved page, and the lines held from it, are kept with the Archive until you delete it; confirmed lines are passages and are kept with the Archive.
Analytics events and usage counters keyed to your Account identifier	Content-free. No longer than 12 months after your Account is deleted, after which they are deleted or reduced to counts that identify no one.
Crash reports and server logs	No longer than 90 days.
Backups of our database and files	Backups are taken on a fixed schedule and each is kept for a fixed period: a daily backup for 6 days, a weekly backup for 27 days and a monthly backup for 89 days, depending on which schedules are enabled. A deleted Archive therefore leaves every backup within 90 days. Backups are never read to answer anyone, and a restore does not bring a deleted Archive back into the Service.
Correspondence with you	3 years after the last message, or longer if needed for a legal claim.
Purchase records	7 years, as Israeli tax and bookkeeping law requires.

8.2 What deletion does not reach, and what we are still fixing. When you delete an Archive or your Account, we instruct ElevenLabs to delete the Voice Model and the conversational agent, Anam to delete the face, and Clerk to delete your sign-in identity; the other Sub-processors hold nothing keyed to you beyond what section 8.1 and the Sub-processors page describe, and keep it on the schedules stated there. Things kept only on your phone (section 2.9) are cleared as that section describes. A few technical artefacts can currently survive the deletion of an Archive, and of your Account: cached audio and cached mouth-movement files for a voice that was later replaced, and the working logs and verdicts of a face build. None is used for anything, we are removing them, and you can ask us to destroy them now at privacy@ethosy.ai.

8.3 What remains after your Account is deleted. Backups for the period above; server logs for up to 30 days; usage counters and analytics or operations events keyed to your former Account identifier, which carry no content and are kept no longer than 12 months; the artefacts named in section 8.2 until we have removed them; the earlier web version's own copy of your account data, if you signed in on the Website (section 1.3); and any correspondence in which you asked us to delete the Account. Nothing else.

8.4 What an export contains. An export is a folder of plain files: every passage, in a readable list that leaves out the passages you corrected as wrong and in a data file that keeps them, marked as retired; the description of the Subject; what the Archive learned about you; the conversations; the corrections; the original files you provided and their transcripts; and the text of public pages you approved and did not decline. It leaves out the numeric index; the Voice Model and any Likeness Model, which are models rather than files (the recordings, and the photograph a video-call face was built from, are included); the photographs taken in a guided face capture; other Archives on your Account; operational records; and media above a size cap, which the folder names.

9. How we protect it, and who at Ethos can see it

In short: encrypted in transit, protected by sign-in and by server-side ownership checks on every request. Not end-to-end encrypted: we hold the key. Nobody at Ethos reads an Archive except for the three reasons listed. If something goes wrong that affects you, we will tell you.

9.1 Measures in place. Data travels over encrypted connections (TLS) between the App, the Website, our servers and every Sub-processor, and calls use encrypted real-time transport. Every request to our API must carry a verified sign-in token, and every query is scoped on the server to the Account that owns the data, never trusting the App to say who is asking. Access to voice and face assets requires a signed link. Requests are rate-limited and oversized requests are refused before they are read. Secrets are held outside the code and rotated. Our servers refuse to start in a public configuration without identity verification enabled.

9.2 What is not in place. We do not apply our own encryption to data at rest, and there is no arrangement in which we hold only ciphertext. The Service needs the words in readable form to build an index, to search it and to write a reply, and we hold the key that lets you back into your Account. We say this plainly because it is the fact most likely to be assumed the other way.

9.3 Who at Ethos can see an Archive. Nobody at Ethos reads an Archive in the ordinary course of running the Service. A member of our team may access the minimum content necessary only: (a) to investigate a report you made about a reply, or a request from a person under section 4; (b) to investigate and fix a security incident or a fault that affects you; or (c) to comply with a legal obligation. We do not use human review to improve the Service.

9.4 Security incidents. If a security incident affects your personal data, we will tell you without undue delay, and we will notify the Israeli Privacy Protection Authority and any other supervisory authority as the law requires.

9.5 Your part. Keep your credentials confidential and tell us at once if you believe your Account has been accessed without your permission.

10. Your rights

In short: wherever you live, you can see what is held, correct it, take it out, take it elsewhere, object, and complain. Most of it you can do from inside the App without asking us. Everything is free.

10.1 Rights you can exercise from inside the App

See what is held. Export any Archive as a folder of plain files, as often as you like (section 8.4 says what it contains).
Correct it. Correct any reply, and remove any source.
Delete it. One source, one Archive, or your whole Account, immediately.
Withdraw consent to a voice or a face. Delete the Archive, or ask us to destroy the model on its own.

10.2 Rights you can exercise by writing to us

Write to privacy@ethosy.ai. We may ask you to confirm that you control the email address on the Account, and, for a request from a person who is not an Account Holder, for enough information to verify who you are and where you appear in an Archive. We never ask for more than we need to verify a request. We respond within one month, extended by up to two further months for a complex request, and we will tell you if we need the extra time. All of this is free.

Access. A copy of the personal data we hold about you, and the information in this Policy about how it is processed.
Rectification. Correction of inaccurate personal data.
Erasure. Deletion of personal data, including where you are a Third-Party Participant or a living Subject who is not an Account Holder.
Restriction. Restriction of processing while a dispute about accuracy or lawfulness is resolved.
Portability. Your data in a structured, commonly used, machine-readable format. An export from the App is that.
Objection. Objection to processing based on our legitimate interests. We will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms.
Withdrawal of consent. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

10.3 Israel

If you are in Israel, you have the rights of access and correction under sections 13 and 14 of the Protection of Privacy Law, and the right to ask that data about you be deleted where the law provides. You may complain to the Privacy Protection Authority (הרשות להגנת הפרטיות). This Policy also serves as the notice required by section 11 of that Law: providing data to us is voluntary, the purposes are stated in section 3, and the recipients are stated in section 6 and on the Sub-processors page.

10.4 European Economic Area and United Kingdom

If you are in the EEA or the UK, the rights in section 10.2 are your rights under the GDPR. You may also lodge a complaint with the supervisory authority of your country of residence or place of work, or of the place of an alleged infringement. In the UK, that is the Information Commissioner's Office.

10.5 United States

If you are a resident of California or of another state with a comprehensive privacy law, you have the rights described in section 10.2, and the additional information in section 12 applies. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not discriminate against you for exercising a right.

10.6 Authorised agents and representatives

You may make a request through someone acting for you, such as an executor, a guardian or an authorised agent. We will ask for evidence of their authority and no more than we need.

11. Children

In short: Ethos is for people aged 18 and over.

The Service is not directed at children, and you must be 18 years of age or older to use it. We do not knowingly collect personal data from a person under 18. If we learn that an Account belongs to a person under 18, we will close it and delete its data. If you believe a person under 18 has provided data to us, write to privacy@ethosy.ai. Source Material about a Subject may of course include material from the Subject's own childhood; that is part of the Archive and is treated as such.

12. Additional information for United States residents

In short: the categories of information we collect, where they come from, and what we do with them, in the form the California Consumer Privacy Act asks for.

12.1 Categories collected in the last 12 months, sources and purposes.

Category (Cal. Civ. Code §1798.140)	Examples	Source	Purpose
Identifiers	Email address, sign-in identity, Account identifier, IP address, invitation codes	You; your sign-in provider; your device	Providing and securing the Service
Personal information under Cal. Civ. Code §1798.80(e)	Name, and any such information in Source Material	You	Providing the Service
Audio, electronic, visual or similar information	Recordings, photographs, video, transcripts	You	Providing the Service
Biometric information	Voice Model, Likeness Model	Derived from recordings and photographs you designate, with your consent	Speaking and animating the Archive
Internet or other electronic network activity	Screen and stage events, crash reports, logs; whether an invitation was used, and whether the person who used it kept using the Service	Your device; our servers	Improving and securing the Service
Inferences	Passages, the description of how the Subject speaks, what the Archive learns about you	Derived from Source Material and your conversations	Providing the Service
Sensitive personal information	Contents of messages you provide; biometric information; any health or other sensitive information present in Source Material	You	Providing the Service, and no other purpose
Commercial information	Purchase records	You; the Stores; RevenueCat	Billing

We do not collect geolocation, professional or employment information, education information, or protected classifications, except where such information happens to be present in Source Material you provide.

12.2 Disclosure. We disclose the categories above to the Sub-processors named on the Sub-processors page, each of which is a service provider or contractor under the CCPA, for the business purposes stated in section 3. We have not sold or shared personal information in the preceding 12 months and we do not sell or share it. We do not knowingly sell or share the personal information of anyone under 16.

12.3 Sensitive personal information. We use sensitive personal information only to provide the Service you have asked for, to secure it, and as otherwise permitted by Cal. Civ. Code §1798.121 and its regulations, and we do not use it to infer characteristics about you. Because of this, the right to limit its use does not apply, but you may delete it at any time.

12.4 Your rights. You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to receive it in a portable form; to opt out of sale or sharing, which we do not do; and not to be discriminated against for exercising a right. Exercise them as section 10 describes. We honour Global Privacy Control signals from your browser as an opt-out of sale or sharing, which changes nothing because we do not sell or share.

12.5 Retention. Section 8 states how long each category is kept.

12.6 Shine the Light. We do not disclose personal information to third parties for their direct-marketing purposes.

12.7 Other states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have substantially similar rights, which section 10 describes, and may appeal a decision on a request by writing to privacy@ethosy.ai with "appeal" in the subject line; we will respond within the period the applicable law allows.

13. Changes to this Policy

In short: the date and version at the top tell you which Policy is in force. If a change affects material you have already provided, we tell you in the App and by email before it takes effect, and you can export and delete before then.

We may change this Policy. For a change that affects what happens to personal data you have already provided, or that materially reduces your rights, we will give you at least 30 days' notice in the App and by email before it takes effect, unless the change is required sooner by law. Other changes take effect when published. Previous versions are available on request.

14. Contact and complaints

Privacy requests, objections, removal and deletion: privacy@ethosy.ai Everything else: support@ethosy.ai Post: Or Akiva, Israel (write to support@ethosy.ai for a full postal address)

If we handle a request badly, you may complain to the Privacy Protection Authority in Israel, to your data-protection supervisory authority in the EEA, to the Information Commissioner's Office in the UK, or to your state attorney general in the United States. We would rather hear from you first, and we will answer.

Every factual statement in this Policy about what the Service does is paired to the code that makes it true in a claim map we keep with the Policy's source. A statement that stops being true is changed in the same release as the behaviour, or removed.