Privacy Policy

Last Updated: January 29, 2026

1. Introduction

1.1 Overview. Eru Technologies, Inc. ("Eru," "Company," "we," "us," or "our") is committed to protecting and respecting your privacy. This Privacy Policy describes how we collect, use, disclose, retain, and safeguard personal information when you access or use our data integration and intelligence platform (the "Platform"), visit our website at www.joineru.com (the "Website"), or otherwise interact with us.

1.2 Scope. This Privacy Policy applies to: (a) visitors to our Website; (b) business customers who access the Platform ("Customers"); (c) individuals whose personal information may be contained within data that Customers process through the Platform ("End Users"); and (d) individuals who communicate with us through any channel.

1.3 Data Controller. For purposes of the EU General Data Protection Regulation ("GDPR") and UK Data Protection Act 2018, Eru Technologies, Inc. is the data controller with respect to personal information we collect directly from you. When we process Customer Data on behalf of our Customers, we act as a data processor, and the Customer is the data controller.

1.4 Acceptance. By accessing or using the Platform or Website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our services.

2. Information We Collect

2.1 Information You Provide Directly

We collect information that you voluntarily provide to us, including:

Account Information: Name, email address, job title, company name, phone number, and password when you create an account or request a demo.
Billing Information: Payment card details, billing address, and tax identification numbers processed through our secure payment processors.
Communications: Information contained in emails, contact forms, support requests, and other correspondence with us.
Integration Credentials: API keys, OAuth tokens, and authentication credentials necessary to connect your third-party systems to the Platform.

2.2 Customer Data

When Customers connect third-party systems to the Platform, we access and process data from those systems ("Customer Data"), which may include:

Financial Data: Transaction records, subscription information, revenue metrics, and billing data from systems such as Stripe, Chargebee, or similar payment processors.
CRM Data: Customer records, contact information, account details, opportunity data, and interaction history from systems such as Salesforce, HubSpot, or similar CRM platforms.
Product Usage Data: User activity, feature adoption, session data, and behavioral analytics from your product databases or analytics systems.
Support Data: Support tickets, customer communications, and satisfaction scores from systems such as Intercom, Zendesk, or similar platforms.

Important: Eru accesses Customer Data on a read-only basis. We do not modify, delete, or write data to your connected systems.

2.3 Information Collected Automatically

When you access the Platform or Website, we automatically collect certain technical information:

Device Information: Browser type and version, operating system, device type, screen resolution, and unique device identifiers.
Log Data: IP address, access times, pages viewed, referring URL, and actions taken on the Platform.
Usage Analytics: Feature usage patterns, click paths, session duration, and interaction data.
Cookies and Similar Technologies: Information collected through cookies, pixels, and local storage as described in Section 8.

2.4 Information from Third Parties

We may receive information about you from third parties, including:

Identity Verification Services: For fraud prevention and compliance purposes.
Marketing Partners: Lead information from business partners and event sponsors.
Publicly Available Sources: Business contact information from professional networking sites and public directories.

3. How We Use Information

3.1 Primary Purposes

We use the information we collect for the following purposes:

Purpose	Legal Basis (GDPR)
Providing and operating the Platform	Performance of contract
Processing Customer Data to generate insights and analytics	Performance of contract
Account management and customer support	Performance of contract
Processing payments and billing	Performance of contract
Sending transactional communications	Performance of contract
Improving and developing the Platform	Legitimate interests
Security, fraud prevention, and abuse detection	Legitimate interests / Legal obligation
Marketing communications (with consent)	Consent
Compliance with legal obligations	Legal obligation

3.2 Artificial Intelligence Processing

The Platform utilizes artificial intelligence and machine learning technologies to analyze Customer Data and generate insights. We want to be explicit about our AI practices:

No Model Training on Customer Data: We do not use Customer Data to train, improve, or develop our machine learning models or any third-party models.
Isolated Processing: Customer Data is processed in isolation and is not commingled with data from other customers for AI training purposes.
Third-Party AI Services: We may use third-party AI services (such as large language models) to power certain features. When we do, Customer Data is processed subject to strict data processing agreements that prohibit the use of such data for model training.

3.3 Aggregated and De-identified Data

We may create aggregated, anonymized, or de-identified data from information we collect. Such data is not considered personal information and may be used for any lawful business purpose, including industry benchmarking, product development, and research.

4. How We Share Information

4.1 Categories of Recipients

We may share personal information with the following categories of recipients:

Service Providers: Third-party vendors who perform services on our behalf, including cloud hosting providers (e.g., AWS, Google Cloud), payment processors, email delivery services, customer support tools, and analytics providers. All service providers are bound by contractual obligations to protect personal information.
Professional Advisors: Attorneys, accountants, auditors, and insurers who provide professional services to us.
Business Transfers: In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, personal information may be transferred to a successor entity.
Legal and Regulatory: Government authorities, law enforcement, courts, or other third parties when required by applicable law, legal process, or to protect our rights, privacy, safety, or property.
With Consent: Any other third parties with your prior consent or at your direction.

4.2 We Do Not Sell Personal Information

We do not sell, rent, or lease personal information to third parties. We do not share personal information with third parties for their direct marketing purposes without your explicit consent.

5. Data Retention

5.1 Retention Periods. We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Specific retention periods depend on the nature of the information and the purposes for which it is processed:

Account Information: Retained for the duration of the customer relationship plus seven (7) years thereafter for legal and compliance purposes.
Customer Data: Retained for the duration of the customer relationship. Upon termination, Customer Data is deleted within ninety (90) days, unless a longer retention period is required by law or requested by the Customer.
Log and Analytics Data: Retained for up to twenty-four (24) months.
Marketing Data: Retained until you withdraw consent or opt out.

5.2 Deletion. Upon expiration of the applicable retention period, personal information is securely deleted or anonymized in accordance with our data deletion procedures.

6. Data Security

6.1 Security Measures. We implement and maintain comprehensive technical, administrative, and organizational security measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
Multi-factor authentication for all user accounts
Role-based access controls and principle of least privilege
Regular security assessments and penetration testing
Continuous monitoring and logging of system access
Incident response procedures and breach notification protocols
Employee security training and background checks
SOC 2 Type II compliance (or in progress)

6.2 No Guarantee. While we strive to protect personal information, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security.

7. International Data Transfers

7.1 Transfer Mechanisms. Eru is headquartered in the United States with operations in the United Kingdom. Personal information may be transferred to, stored, and processed in the United States or other countries where we or our service providers operate. When we transfer personal information outside the European Economic Area ("EEA"), United Kingdom, or Switzerland, we rely on appropriate transfer mechanisms, including:

Standard Contractual Clauses approved by the European Commission
UK International Data Transfer Agreement / Addendum
Adequacy decisions where applicable
Your explicit consent where no other mechanism applies

7.2 Data Processing Agreement. Enterprise customers may request execution of a Data Processing Agreement ("DPA") that includes Standard Contractual Clauses and additional data protection commitments.

8. Cookies and Tracking Technologies

8.1 Types of Cookies. We use cookies and similar technologies on our Website and Platform:

Category	Purpose	Duration
Strictly Necessary	Essential for Website/Platform functionality, authentication, and security	Session / up to 1 year
Functional	Remember preferences and settings	Up to 1 year
Analytics	Understand usage patterns and improve services (e.g., Microsoft Clarity)	Up to 2 years
Marketing	Measure advertising effectiveness and deliver relevant content	Up to 2 years

8.2 Your Choices. You can manage cookie preferences through your browser settings or through our cookie consent banner (where applicable). Disabling certain cookies may affect the functionality of the Website or Platform.

8.3 Do Not Track. Our systems do not currently respond to "Do Not Track" browser signals.

9. Your Rights and Choices

9.1 Rights Under GDPR (EEA/UK Residents)

If you are located in the European Economic Area or United Kingdom, you have the following rights under applicable data protection law:

Right of Access: Request confirmation of whether we process your personal data and obtain a copy of such data.
Right to Rectification: Request correction of inaccurate or incomplete personal data.
Right to Erasure: Request deletion of your personal data in certain circumstances.
Right to Restriction: Request restriction of processing in certain circumstances.
Right to Data Portability: Receive your personal data in a structured, machine-readable format.
Right to Object: Object to processing based on legitimate interests or for direct marketing.
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
Right to Lodge a Complaint: Lodge a complaint with a supervisory authority (e.g., the UK Information Commissioner's Office).

9.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
Right to Delete: Request deletion of personal information we have collected from you.
Right to Correct: Request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising.
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

California residents may also designate an authorized agent to make requests on their behalf.

9.3 Exercising Your Rights

To exercise any of the above rights, please contact us at privacy@joineru.com. We will respond to your request within the timeframe required by applicable law (generally 30 days for GDPR, 45 days for CCPA). We may request additional information to verify your identity before processing your request.

9.4 Marketing Communications

You may opt out of receiving marketing communications at any time by: (a) clicking the "unsubscribe" link in any marketing email; (b) contacting us at privacy@joineru.com; or (c) adjusting your communication preferences in your account settings.

10. Children's Privacy

The Platform and Website are not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us at privacy@joineru.com, and we will take steps to delete such information.

11. Third-Party Links and Services

The Website and Platform may contain links to third-party websites, services, or applications. This Privacy Policy does not apply to such third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you access.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will: (a) update the "Last Updated" date at the top of this page; (b) provide notice through the Platform or by email for significant changes; and (c) where required by law, obtain your consent. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Eru Technologies, Inc.
Attn: Privacy Team
67 Rope Street
London, United Kingdom
Email: privacy@joineru.com

For EU/UK residents, you may also contact our Data Protection Officer at dpo@joineru.com.

BY USING THE PLATFORM OR WEBSITE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY.