Privacy Policy

3CHO AGENT INC LTD, a company registered in England and Wales (company number 16599467), trading as Echo (“Echo”, “we”, “us”, or “our”), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

1. Information We Collect

1.1 Information you provide

Account information: Name, email address, phone number, business name, business address, and password when you create a service provider account.
Business profile: Services offered, pricing rules (hourly rates, call-out fees), working hours, business category, and booking page slug.
Customer information: When customers use your booking page, we collect their name, phone number, email address, and (if applicable) service address.
Voice recordings: When you or your customers use the voice input feature, audio is temporarily processed for transcription. We do not store raw audio after transcription is complete.
Job and invoice data: Booking details, job descriptions, line items, time tracking entries, invoice amounts, and payment status.
Project data: Project descriptions, scope items, uploaded documents (PDFs, images), progress claims, and stakeholder approval records.
Payment information: Payment card details are collected and processed directly by our PCI-compliant payment processor. We do not store full card numbers on our servers.
Team member information: Names, email addresses, and roles of team members you invite.
Communications: Messages you send through our contact form or support channels.

1.2 Information collected automatically

Device and browser information: IP address, browser type, operating system, and device identifiers.
Usage data: Pages visited, features used, actions taken, and timestamps.
Location data: Approximate location derived from IP address. Precise location (latitude/longitude) from your business address for travel distance calculations.
Timezone: Detected from your browser to display bookings in the correct local time.
Cookies: Session cookies for authentication and preferences, plus optional analytics cookies (Google Analytics and Microsoft Clarity) that you can accept or decline via our cookie banner. We do not use third-party advertising cookies.

2. How We Use Your Information

We use the information we collect to:

Provide our services: Process bookings, generate AI-powered quotes, create invoices, manage jobs, and facilitate payments.
AI features: Your job descriptions and pricing rules are sent to OpenAI to generate itemized quotes, and voice recordings are sent to OpenAI for transcription. Data submitted through OpenAI's API is not used to train their models. Providers who handle confidential client information can switch off AI and voice processing entirely — see section 4.
Notifications: Send booking confirmations, reminders, invoice delivery, and other transactional messages via WhatsApp and email. Customers can switch appointment reminders off in the customer portal. Booking confirmations and changes, invoices and payment messages can't be switched off, because customers need them to attend and to pay their provider.
Calendar integration: If you connect Google Calendar or Outlook Calendar, we sync bookings to your calendar and use connected-calendar busy events to block unavailable booking slots.
Payments: Process subscription payments and facilitate customer payments through our payment processor.
Referral programme: Track referral attributions and calculate referral rewards.
Improve our platform: Analyse usage patterns to improve features, fix bugs, and develop new capabilities.
Support: Respond to your enquiries and provide customer support.
Compliance: Meet legal obligations, enforce our terms, and protect against fraud.

3. How We Share Your Information

We share your information only in these circumstances:

With your customers: Your business name, services, availability, and booking page are publicly visible. Customer-facing invoices include your business details and bank information (if you provide it).
Sub-processors: Every third party that processes personal data on our behalf is named individually — together with what it receives and where that data is hosted — on our Subprocessors page. We notify providers under our Data Processing Agreement before a new sub-processor begins processing personal data.
Project stakeholders: When you send quotes or claims for approval, the recipient receives a token-authenticated link to view relevant project details.
Legal requirements: When required by law, court order, or government request.
Business transfers: In connection with a merger, acquisition, or sale of assets.

We do not sell your personal information to third parties.

4. Voice Data and AI Processing

Echo uses voice input features throughout the platform. When you record audio:

Audio is transmitted to OpenAI for transcription using their Whisper model.
The transcribed text may be further processed by OpenAI to generate structured outputs (e.g., quote line items or note sections).
We do not retain raw audio recordings after transcription is complete.
Data submitted through OpenAI's API is not used to train their models, and we do not use your data to train any model of our own.

Echo Social uses AI to plan and write social posts from your profile, brand story and any document you upload.

If you turn on comment and message answering, OpenAI reads new comments on your posts and messages sent to your connected social accounts to sort and answer them, including in confidentiality mode. It is off until you turn it on, and you can turn it off at any time. The names and text of those comments and messages are deleted 90 days after they are handled.

4.1 Confidentiality mode

Providers bound by professional confidentiality — psychologists, therapists, medical practitioners and similar — can enable confidentiality mode in Settings. With it on, Echo:

sends no client information to any AI provider (other than the text of public reviews, checked for abusive content with no names attached, and, if comment and message answering is on, the comments and messages sent to its connected social accounts);
sends messages to the provider's clients by email where the client has given an email address, and otherwise by WhatsApp with no client name, practice name or address — only the time and a link;
sends appointment reminders only if the client has explicitly agreed to them for that practice. Echo records the consent, and the client can withdraw it at any time in the customer portal;
loads no third-party maps or other third-party content on the practice's booking page;
does not list the practice in Echo's public marketplace or search, and asks search engines not to index its booking page; and
excludes the account from analytics entirely.

Echo staff and subprocessors who may see client information of these providers are bound in writing to professional secrecy, as set out in our Data Processing Agreement.

If you upload a CV, LinkedIn profile PDF, brand guide or pitch deck, we store the file privately and extract its text. OpenAI reads the text once to suggest your profile fields. The extracted text (not the file) is given to Echo Social's AI writer (run on xAI's Grok through Cursor), which uses it to plan and write your posts. You can delete the document at any time from the Social page; that deletes the file and the text. If a business account upgrades to a full Echo account, the document is deleted. We keep it until you delete it or your account is closed.

6. Data Retention

Active accounts: We retain your data for as long as your account is active.
Deleted accounts: When you delete your account, we delete or anonymise your personal data within 30 days, except where retention is required by law (e.g., financial records for tax purposes).
Customer data: Customers can delete their own profile in the customer portal. On deletion, personal details are anonymised while preserving aggregate booking/invoice records for the provider's accounting.
Voice recordings: Raw audio is not stored beyond the transcription session.
Notification logs: Delivery logs are retained for 90 days for troubleshooting purposes.

7. Data Security

We implement appropriate technical and organisational measures to protect your data:

All data is encrypted in transit (TLS 1.2+) and at rest.
Database access is restricted through row-level security policies ensuring data isolation between accounts.
Authentication uses industry-standard protocols (bcrypt password hashing, secure session tokens, OTP verification).
Payment data is handled by PCI DSS Level 1 certified payment processors and never touches our servers.
Admin access requires separate authentication with role-based permissions.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Delete your personal data (subject to legal retention requirements).
Export your data in a portable format.
Object to certain processing of your data.
Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at privacy@echo-agent.com.

9. International Data Transfers

Client data is stored on EU servers in Ireland. Echo's database, authentication and file storage run on Supabase in AWS eu-west-1 (Ireland), and the application runs on Vercel in Dublin, Ireland. Your account, client records, bookings, invoices and notes are stored in the European Union.

Some of the sub-processors listed on our Subprocessors page operate outside the European Economic Area — several, including our hosting providers, are US companies or part of US groups — and some Echo personnel work remotely from South Africa. Echo itself is a UK company, and the UK is recognised by the European Commission as providing adequate protection. For providers based in the United States, transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. All other transfers to countries without that recognition, including access by our personnel in South Africa, are made under the Standard Contractual Clauses, which are annexed to our Data Processing Agreement. The Subprocessors page states which safeguard applies to each provider. These safeguards do not stop a US company being subject to US laws on government access to data.

10. Children's Privacy

Echo is not directed at children under 16. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

11. Cookies

We use the following types of cookies:

Essential cookies: Required for authentication and core functionality. Cannot be disabled.
Preference cookies: Store your timezone, language, and display preferences.
Analytics cookies (optional): We use Google Analytics and Microsoft Clarity to understand how Echo is used so we can improve it. These tools collect aggregated usage data and may record session interactions (clicks, scrolls, page views). They are off by default and load only after you actively accept analytics in our cookie banner. They are never loaded on provider dashboards, customer portals, booking pages or any other signed-in surface, whatever your cookie choice — so they never see client information.
Cookieless visit counting: On our public marketing pages we also use Vercel Web Analytics to count page views. It sets no cookies, stores nothing on your device, and does not identify or track you across visits or sites, so it runs whether or not you accept analytics cookies. Like the other tools, it never runs on dashboards, customer portals or booking pages.

We do not use advertising cookies, and we do not share cookie data with third parties for marketing purposes. You can accept or decline analytics at any time via the "Manage cookies" link in our cookie banner. To re-open the banner, clear the echo-consent cookie in your browser.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on our platform or sending you an email. Your continued use of Echo after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Email: privacy@echo-agent.com
Post: 3CHO AGENT INC LTD, 4th Floor Office, 205 Regent Street, London, W1B 4HB, United Kingdom