Subprocessors
Echo uses the third parties below to deliver the platform. Each one is named, along with exactly what it receives and where that data is hosted. Last updated: 2026-10-06.
Where your data lives
Echo's database, authentication and file storage run on Supabase in AWS eu-west-1 (Ireland). The application itself runs on Vercel in Dublin, Ireland. Your account, client records, bookings, invoices and notes are stored in the European Union and are not replicated elsewhere.
Some vendors below operate outside the EEA. Echo relies on the European Commission's Standard Contractual Clauses for those transfers. Echo is operated by 3CHO AGENT INC LTD, a UK company, and some of our personnel work remotely from South Africa; that access is likewise covered by Standard Contractual Clauses annexed to our Data Processing Agreement.
Handling confidential client data
Providers bound by professional confidentiality — therapists, psychologists, medical practitioners — can switch on confidentiality mode in Settings. It stops Echo sending client information to AI providers, keeps client names and addresses out of WhatsApp, SMS and email subject lines, and excludes the account from analytics entirely. The one exception is the text of public reviews, which is checked for abusive content before it appears, with no names attached.
Infrastructure
Supabase
Supabase, Inc.
- Purpose
- Database, authentication and file storage
- Data processed
- All account, business, client, booking, invoice and note data; uploaded files
- Location
- AWS eu-west-1 (Ireland)
- Privacy
- https://supabase.com/privacy
Vercel
Vercel, Inc.
- Purpose
- Application hosting and serverless compute; cookieless page-view counting on public marketing pages
- Data processed
- Data in transit during request processing; request logs; anonymous page-view counts (no cookies, no cross-visit identifier, never on dashboards or booking pages)
- Location
- Dublin, Ireland (dub1)
- Privacy
- https://vercel.com/legal/privacy-policy
Google Ireland Limited
- Purpose
- Address autocomplete and travel distance; Google Calendar sync where the provider connects it
- Data processed
- Service addresses submitted for lookup; booking title, time and location when calendar sync is enabled
- Location
- European Union / United States
- Privacy
- https://policies.google.com/privacy
Microsoft
Microsoft Ireland Operations Limited
- Purpose
- Outlook Calendar sync where the provider connects it
- Data processed
- Booking title, time and location when calendar sync is enabled
- Location
- European Union / United States
- Privacy
- https://privacy.microsoft.com/privacystatement
Communications
Twilio
Twilio Inc.
- Purpose
- WhatsApp and SMS delivery, one-time passcodes
- Data processed
- Recipient phone number and message content (appointment reminders, confirmations, invoice links)
- Location
- United States
- Privacy
- https://www.twilio.com/legal/privacy
Meta (WhatsApp)
WhatsApp Ireland Limited
- Purpose
- Delivery of WhatsApp messages sent via Twilio
- Data processed
- Recipient phone number and message content, as passed through by Twilio
- Location
- Ireland / United States
- Privacy
- https://www.whatsapp.com/legal/privacy-policy
Twilio SendGrid
Twilio Inc.
- Purpose
- Transactional email delivery
- Data processed
- Recipient name and email address, email content, attached invoices
- Location
- United States
- Privacy
- https://www.twilio.com/legal/privacy
AI processing
OpenAI
OpenAI Ireland Limited (EEA data) / OpenAI OpCo, LLC
- Purpose
- Voice transcription, note structuring, quote generation, content moderation
- Data processed
- Audio recordings submitted for transcription and the resulting text; job and note descriptions; the text of reviews and replies for content moderation. In confidentiality mode, only the moderation of review text continues, with no names, business or booking details attached.
- Location
- United States
- Privacy
- https://openai.com/policies/privacy-policy
Payments
Stripe
Stripe, Inc. / Stripe Payments Europe, Ltd.
- Purpose
- Card payments, payouts and subscription billing
- Data processed
- Payer name, email, payment card details (collected directly by Stripe), transaction amounts
- Location
- United States / Ireland
- Privacy
- https://stripe.com/privacy
Paystack
Paystack South Africa (Pty) Limited (a Stripe company)
- Purpose
- Card payments and payouts in supported African markets
- Data processed
- Payer name, email, payment card details (collected directly by Paystack), transaction amounts
- Location
- South Africa / Nigeria
- Privacy
- https://paystack.com/privacy
Optional analytics
Google Analytics
Google Ireland Limited
- Purpose
- Aggregate usage analytics on Echo's public marketing pages
- Data processed
- IP address, page views, device and browser information. Never loaded on dashboards, customer portals or booking pages, and only after the visitor accepts analytics cookies.
- Location
- European Union / United States
- Privacy
- https://policies.google.com/privacy
Microsoft Clarity
Microsoft Ireland Operations Limited
- Purpose
- Aggregate usage analytics on Echo's public marketing pages
- Data processed
- IP address, page views, click and scroll interactions. Never loaded on dashboards, customer portals or booking pages, and only after the visitor accepts analytics cookies.
- Location
- European Union / United States
- Privacy
- https://privacy.microsoft.com/privacystatement
Not subprocessors
Echo uses ElevenLabs and Anthropic in its own outbound sales process, and Pexels for stock imagery. None of them receive any data belonging to a provider's clients.
Changes to this list
We notify providers before a new subprocessor begins processing personal data, so you have the opportunity to object. Questions: privacy@echo-agent.com.