Privacy Policy

Echo IO, Inc., a Delaware corporation ("Echo", "we", "us"), operates echoio.ai and the Echo platform — an agentic AI service that helps business customers run creator-led growth marketing. For data you and your team submit while using the platform, we generally act as a processor/service provider on behalf of your organization; for our websites, account administration, billing, security, and product analytics, we act as the data controller. For the public information we process about people who do not use the Service (see "Public & Licensed Data" below), we act as an independent controller.

This policy covers visitors to our websites, users of the Echo platform, and — in summary form — individuals whose information we process from third-party platforms and public sources. If you are a creator, brand representative, or other individual who does not use Echo but whose public information may appear in our systems, please also read our Public Data Notice at echoio.ai/public-data-notice, which is the dedicated notice for you. Contact for all privacy matters: legal@echoio.ai.

Information you provide: account registration data (name, email, password stored as a salted hash), organisation and brand profile information, content you submit such as prompts, campaign briefs, and uploaded documents, conversations with Echo's agents (and the working memory those agents maintain across sessions), payment and billing information processed via our payment providers, and communications you send us.

Information collected automatically: usage data (pages visited, features used, operator runs triggered), device and browser information, IP address and session security data, log data and crash reports, and cookies and similar technologies (see "Cookies & Tracking Technologies").

Information from third parties: data from accounts you connect (see the next section), limited billing metadata from our payment processor (we never receive full card numbers), and publicly available or licensed data about creators, brands, and competitors (see "Public & Licensed Data About Creators & Brands").

When connecting advertising or social platforms to Echo — including Meta (Facebook and Instagram), Google (including Google Ads and Gmail), TikTok, LinkedIn, X, YouTube, and Slack — you authorize Echo through official OAuth flows to access the data needed to operate on your behalf. This may include ad-account and business details, campaigns, ad sets, ads, creatives, performance metrics, page and profile content, and mailbox data for outreach conversations you run through the Service. We store the OAuth tokens and identifiers needed to operate each integration.

We apply the following rules to all platform data:

• We use platform data solely to provide and support the Service for the customer who connected the account — never to serve advertising, retarget individuals, build profiles for other purposes, or sell it. Each customer's platform data is segregated; one customer's data never serves another.
• We retain platform data only as long as needed to provide the Service, and we honor each platform's retention and deletion requirements where they are stricter.
• When you disconnect an account, revoke access on the platform side, or close your Echo account, we delete the associated tokens, stop collection, and delete stored platform data in line with our Data Deletion page.
• When a platform notifies us of a user's deletion request (for example, Meta's data-deletion callback), we honor it and confirm completion.

YouTube — Echo uses YouTube API Services. By using features that rely on YouTube data, you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). Google's handling of data is described in the Google Privacy Policy (https://www.google.com/policies/privacy). You can revoke Echo's access to your Google data at any time via Google security settings (https://security.google.com/settings/security/permissions). We access, store, and use YouTube API data (such as channel and video statistics and metadata) to provide creator and competitor analytics, refresh or delete stored YouTube API data in accordance with Google's policies, and honor deletion and revocation requests within the timeframes those policies require.

Google user data — Echo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Ads data is used to operate, optimize, and report on advertising campaigns in your connected Google Ads account only; Gmail data is accessed only to draft, send, and track the outreach conversations you run through the Service. We do not sell this data, do not transfer it except as necessary for user-facing features (or for security, legal compliance, or a merger with notice), and do not use it to serve advertising. Human access is limited to support, security, or with consent.

Echo is an independent product and is not endorsed by, affiliated with, or sponsored by Meta, TikTok, LinkedIn, X, Google, YouTube, Slack, or any other platform.

To provide market, creator, and competitor intelligence, we collect and analyze publicly available information about creators, brands, and their content — such as public profiles and handles, follower and engagement statistics, public posts and ads, and publicly evident business relationships — from public platform surfaces and from licensed data providers. Where available, this may include business contact information used by customers for legitimate partnership outreach.

When people opt out, we suppress their information from further processing and stop contacting them. Full details — including the sources, purposes, legal basis, retention, and how to object or request deletion — are in our Public Data Notice at echoio.ai/public-data-notice.

• Provide and operate the Service — accounts, integrations, agents, campaigns, reports, and support. Legal basis: performance of a contract.
• Run AI-assisted analysis and generation (see the next section). Legal basis: performance of a contract; our and our customers' legitimate interests in efficient marketing analysis.
• Secure the Service — authentication, fraud and abuse prevention, logging, and diagnostics. Legal basis: legitimate interests in securing our systems; legal obligation where applicable.
• Billing and administration — subscriptions, invoicing, taxes, and records. Legal basis: contract; legal obligation.
• Product analytics and improvement — understanding feature usage and fixing errors, and improving Echo's orchestration and operator playbooks using aggregated, de-identified data. Legal basis: legitimate interests; consent where required for analytics cookies.
• Communications — service notices, security alerts, operator run results, and (with opt-out) product updates. Legal basis: contract; legitimate interests; consent where required.
• Legal compliance and protection — responding to lawful requests and enforcing our terms. Legal basis: legal obligation; legitimate interests.

Where we rely on legitimate interests, we balance them against your rights and interests; you may object as described under "Your Rights & Choices".

Echo processes prompts, context, and relevant platform or public data through large language models hosted by AI infrastructure partners — routed through a gateway to model providers such as Anthropic, OpenAI, Google, and Z.ai (see echoio.ai/sub-processors) — solely to provide the Service. Interactions are logged for performance monitoring, debugging, and safety evaluation.

We do not use your content to train our own general-purpose or foundation AI models, and we configure our AI providers to process your content only to generate outputs for you; we do not authorize them to use it to train their models. Aggregated, de-identified usage patterns may be used to improve Echo's orchestration layers and operator playbooks.

Echo is a decision-support tool: its outputs are recommendations for human review, and account-level actions are governed by the autonomy settings and approvals our customers configure. We do not use automated processing to make decisions that produce legal or similarly significant effects about individuals without human involvement. Scores and forecasts about creators and brands are statistical estimates for marketing analysis, not evaluations of private individuals' personal lives.

The platform maintains conversation memory and agent context to improve operator continuity, stored securely and scoped to your organization.

Echo does not sell personal information. We share personal data only:

• With service providers (sub-processors) that host and support the Service under contracts limiting their use of the data — the current list is at echoio.ai/sub-processors.
• With third-party platforms at your direction — when the Service posts content, sends outreach, or manages campaigns through accounts you connected, the relevant data necessarily flows to that platform or recipient.
• Within your organization — workspace members and admins can see the content and activity of their organization's workspace.
• For legal reasons — to comply with law, enforce our agreements, or protect rights, safety, and security.
• In a business transfer — merger, acquisition, or asset sale, with notification before different privacy practices apply.

Echo uses cookies and similar technologies to operate and improve its websites and platform. Essential cookies are required for authentication, session management, consent storage, and core functionality and cannot be disabled. Analytics cookies help us understand usage and are set only after you accept them via the cookie banner; we honor a Global Privacy Control (GPC) signal by treating it as a decline of all non-essential cookies.

To understand which channels bring people to Echo, this site stores a first-party attribution cookie that records how you arrived — such as the referral source and campaign parameters (UTMs) in the link you followed. It is set only if you accept measurement cookies, is kept for up to 90 days, is never shared with third parties, and is used only to attribute pilot requests to their source. We do not use advertising or cross-site tracking cookies.

The full list of cookies, their purposes, and durations — and how to change your choice at any time — is in our Cookie Policy at echoio.ai/cookie-policy.

Personal information is retained for as long as accounts remain active or as needed to provide services. Account data is retained during subscriptions and up to 90 days after deletion. Agent run logs and operator outputs are retained up to 24 months. Billing records are retained 7 years as required by regulations. Analytics and usage data may be retained in aggregated, de-identified form indefinitely for product improvement.

Connected-account tokens are kept until disconnection, revocation, or account closure; platform data is kept per the shorter of our operational need or the platform's mandated retention window. Public creator/brand intelligence is retained per the criteria in the Public Data Notice.

Echo uses reasonable technical and organisational safeguards appropriate to the risk, including encryption in transit (TLS 1.2+) and at rest at the infrastructure layer, and role-based access controls with organisation-scoped data isolation.

No security system is impenetrable; we cannot guarantee absolute security, and you are responsible for safeguarding your credentials. If we learn of a breach affecting your personal data, we will notify you and regulators as required by law.

Echo operates globally. Information may be transferred to and processed in countries other than your own, including the United States, where our primary infrastructure is hosted, and in the regions where our service providers operate.

Where we transfer personal data from the EEA, UK, or Switzerland, we put in place appropriate safeguards where required, such as the European Commission's Standard Contractual Clauses (and the UK Addendum/IDTA), or rely on another lawful transfer mechanism.

Depending on where you live, you may have rights to: access a copy of your personal data, correct inaccuracies, delete your data, receive it in a portable format, object to or restrict certain processing (including processing based on legitimate interests), and withdraw consent at any time without affecting prior processing.

If you've connected Meta, Facebook, Instagram, or other external platforms to Echo, you can request deletion of the obtained data at any time. Removing the app in your Meta settings triggers automatic deletion, or use the self-serve page at echoio.ai/data-deletion to request and track deletion.

To exercise any right, contact legal@echoio.ai. We will verify your request (and any authorized agent's authority), respond within 30 days, and will not discriminate against you for exercising your rights. If we deny a request, you may appeal by replying to our decision. EEA and UK users may also lodge complaints with their local supervisory authority.

For residents of California and other U.S. states with comprehensive privacy laws: in the last 12 months we have collected the categories of personal information described in "Information We Collect" — identifiers (name, email, IP), commercial information (subscription records), internet/electronic activity (usage data), professional information (organisation and role), and inferences used only for the marketing-analysis purposes described above.

• We do not sell personal information, and we do not knowingly process personal information of minors.
• "Sharing" for cross-context behavioral advertising: we do not use third-party advertising cookies. If our analytics configuration were ever deemed "sharing", you can opt out at any time via the cookie banner, by declining analytics, or through a Global Privacy Control signal, which we honor.
• We do not collect sensitive personal information as defined by the CPRA except credentials used for authentication, which we use only to provide the Service.
• You may exercise your rights (know, access, correct, delete, opt out, limit, non-discrimination) via legal@echoio.ai.

Echo is designed for professional brand marketing teams and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal data, contact legal@echoio.ai and we will delete it promptly.

Echo may update this Privacy Policy periodically. Material changes update the effective date at the top of this page and may trigger in-app notifications or emails. Continued use after changes take effect constitutes acceptance of the updated policy.

For questions or requests regarding this Privacy Policy, contact legal@echoio.ai. If you are in the EEA or UK and believe we have not resolved your concern, you may lodge a complaint with your local supervisory authority.