Loading
Loading
AI Investment & Control Review
How personal data is handled for AI Value Ledger, and the limits of responsibility that apply to the website, the Pulse and a review.
This page has two parts. Part A is the privacy notice. Part B limits responsibility and liability. Read both before you rely on this website.
AI Value Ledger, at app.aivalueledger.com, is operated by EkaC Global Consulting LLC, a US limited liability company. Where the EU General Data Protection Regulation or the UK GDPR applies, EkaC Global Consulting LLC is the controller of the personal data described in this notice. In other places, the same company decides the purposes of that processing.
For a privacy request, write to trust@aivalueledger.com. The firm’s website is ekac.pro.
This notice is written so that it can be read with the EU GDPR, the UK GDPR, US federal and state privacy laws in general, Singapore’s Personal Data Protection Act, the personal-data law of the United Arab Emirates, and the Personal Data Protection Law of Saudi Arabia. It is not a certificate of compliance with any of those laws. It does not mean that every provision of each of them applies to every reader.
What we collect depends on how you deal with us.
The Pulse. If you complete the AI Pulse, we collect your email address, your company name, your answers, the indicative result, a record that you gave consent, the time of the submission, and a one-way hash of the connection address. The hash is kept so that repeated submissions can be limited. We do not keep the connection address itself.
Account users. If you have an account, we collect the data needed to sign you in and to record access, including the email address on the account.
Client engagements. Under a contract we collect the information, documents and evidence the client provides or uploads, and the correspondence about that engagement.
The Pulse does not ask for special-category data. A client should not upload evidence that the engagement does not need. If a document contains personal data, we use it for the engagement.
Where the EU GDPR or the UK GDPR applies, we use the following bases.
Consent. We use the Pulse email address, company name, answers and result to respond to the inquiry and to prepare any follow-up that is asked for, including contact about a Snapshot, on the consent given with the Pulse. You may withdraw that consent at any time by writing to trust@aivalueledger.com. Withdrawal does not affect processing that was lawful before it.
Contract. We use account data to provide the signed-in service. We use engagement data to perform the written engagement.
Legitimate interests. We use the connection-address hash and the time of a submission to limit abuse and to keep the service reliable, and we keep ordinary security records for the same reason. That interest is the security and proper running of the service. It is not used in a way that overrides the person’s rights.
Where another law applies, we use the data for the same purposes on the basis that law provides. That basis may be consent, a contract, or a permitted business purpose.
Service providers process personal data on our instructions, and only so far as the service requires. In general terms they are these.
We do not sell personal data. We do not use client data, or Pulse answers, to train AI models. We do not authorize a provider to use that data for its own marketing.
The database and stored files are held in an EU region. Hosting and AI analysis may involve processing in other countries, including the United States, because those providers operate internationally.
Where personal data is transferred from the European Economic Area or the United Kingdom to a country that has not been found to provide an adequate level of protection, we use a lawful safeguard where that safeguard applies. The safeguard includes the Standard Contractual Clauses, with any further measure the transfer requires. Singapore, the United Arab Emirates and Saudi Arabia set their own conditions for a transfer. We apply the condition that the relevant law places on the transfer we make.
We keep personal data only for as long as the purpose, the contract, or the law requires.
We use technical and organizational measures suited to the data. Access is limited to people who need it for an engagement or to operate the service. Hosting, storage and transmission use the controls the providers apply. No method of transmission or storage is free from interference. We do not promise that unauthorized access cannot occur.
Where the EU GDPR or the UK GDPR applies, you may ask for access, correction, erasure, restriction, or a portable copy, and you may object to processing that rests on legitimate interests. You may withdraw consent as clause 3 describes.
Where a US state privacy law applies to you, you may have a right to access, correct and delete personal data, and to opt out of a sale. We do not sell personal data.
Under Singapore’s Personal Data Protection Act, you may ask for access to, and correction of, personal data in our possession or under our control, subject to the exceptions in that Act.
Under the personal-data laws of the United Arab Emirates and of Saudi Arabia, you may have a right of access and of correction, and a right to ask for erasure, subject to the conditions and exceptions in the local law.
To use a right, write to trust@aivalueledger.com. We may ask for what we need to confirm that the request is from the person concerned, or from someone with authority to act for them. We will answer within the time the applicable law requires. If we decline a request, we will give the reason where the law requires one, and we will say how to complain.
You may complain to a supervisory authority. If the EU GDPR applies, you may complain to the authority of your place of residence, your place of work, or the place of the alleged infringement. If the UK GDPR applies, you may complain to the Information Commissioner’s Office. You may also write to us first, at trust@aivalueledger.com.
This website, the Pulse and the signed-in service are not directed at anyone under 18. We do not knowingly collect personal data from a child. If you believe we have, write to trust@aivalueledger.com and we will delete it.
We may amend this page. When we do, we change the date below and post the amended page here. Where a client has a written engagement, that engagement prevails if this page conflicts with it.
Last updated: October 18, 2026.
Read this part before you rely on the website, the Pulse, or a review. It states who carries the responsibility, and the limit of any liability.
Each organization remains solely and exclusively responsible for its own AI governance, its own risk management, and its own regulatory compliance. That includes its compliance under the EU AI Act, the law of the United Kingdom, US federal and state law, the law of Singapore, and the laws of the Middle East jurisdictions in which it operates. The responsibility covers the organization’s AI systems, the decisions the organization takes, and the outcomes of those decisions.
EkaC Global Consulting LLC does not assume, and shall not be deemed to have assumed, any such responsibility. It does not assume a compliance obligation of the organization. It shall not be deemed the provider, the deployer, the operator, or the controller of the organization’s AI systems under the EU AI Act or any comparable law.
The material on this website, the AI Pulse, and any review, score, investment call or authority level are information. Where a written engagement exists, the work under it is advice on the conduct of the review. None of it is legal advice. Reading this website, sending an inquiry, or receiving a review does not create an attorney-client relationship with EkaC Global Consulting LLC.
The work is not a certification, a conformity assessment, an audit opinion, or any other assurance. It does not guarantee compliance, a regulatory outcome, an investment return, or the quality of a decision. An investment call and an authority level are recommendations. The client decides whether to adopt them.
A review, a score, an investment call and an authority level depend on the information, documents and access the client provides. EkaC Global Consulting LLC does not independently verify every fact the client asserts, unless the written engagement says so. Pulse answers are self-reported. A Pulse result is indicative only.
To the maximum extent permitted by law, EkaC Global Consulting LLC and its members and personnel shall not be liable for indirect, consequential, special or punitive damages, for lost profits, for regulatory fines and penalties, or for third-party claims, arising out of this website, the Pulse, a review, or reliance on any of them. The exclusion applies in contract, in tort and otherwise, whether or not the possibility was known.
Where the law does not permit the liability to be excluded, the aggregate liability of EkaC Global Consulting LLC for a claim shall not exceed the fees the client paid to EkaC Global Consulting LLC for the specific engagement giving rise to the claim, in the twelve months before the claim. For a person who uses only this website or the free Pulse, and who has paid no engagement fee, that cap is USD 100.
If the written terms of an engagement conflict with this page, the written terms prevail.
This page gives no right to any person other than the organization that uses the website or that is a party to an engagement. A mandatory right that the law gives, and that cannot be excluded, is not affected.
To the extent permitted by law, the client shall indemnify EkaC Global Consulting LLC against claims, losses, liabilities and reasonable costs arising from the client’s AI systems, the client’s decisions, or the client’s failures of compliance.
If a provision of this page is held unenforceable, the rest of the page continues in effect. That provision shall be modified to the minimum extent required to make it enforceable, where the court or tribunal has power to modify it.
Nothing on this page excludes or limits a liability, or a right, that the applicable law does not allow to be excluded or limited. That includes a mandatory right of a consumer, and a right to a remedy for a breach of data-protection law where that right cannot be given up. Part B does not reduce the rights in Part A except so far as the applicable law allows.