1. Who we are

Optivio Software Ltd, trading as Echo ("we", "us", "our"), provides an AI-powered recording and transcription service. This Privacy Policy explains what personal data we collect, why we collect it, and how we handle it. We act as a data controller for account data and as a data processor for the content you upload or record.

2. Data we collect

Account data: name, email, password hash, billing details.
Content: audio recordings, uploaded files, transcripts, summaries, and notes you create.
Usage data: log files, device type, browser, IP, pages visited, feature usage.
Payment data: handled by our payment processor (Stripe). We do not store full card numbers.

3. How we use your data

To provide transcription, summarisation, and analysis features.
To operate, secure, and improve the service.
To process payments and manage subscriptions.
To send essential service emails (security alerts, billing).
To comply with legal obligations.

4. AI processing

Audio you upload or record is sent to third-party AI providers (such as OpenAI) for transcription and summarisation. These providers are contractually prohibited from using your content to train their models. Transcripts and audio are stored in your account until you delete them.

5. Recording consent

You are solely responsible for obtaining consent from all parties to a conversation before recording. Recording laws vary by jurisdiction (one-party vs. all-party consent). By using Echo you confirm you have the legal right to record and process every conversation you upload.

6. Sharing

We share data only with:

Infrastructure providers (hosting, database, storage).
AI processors for transcription and summarisation.
Payment processors for billing.
Authorities when required by law.

We never sell your personal data.

7. Data retention

Recordings and transcripts are retained until you delete them or close your account. Account data is kept for the lifetime of your account plus up to 12 months for legal and accounting purposes.

8. Your rights (GDPR / CCPA)

You may request access, correction, deletion, portability, or restriction of your data, and you may object to processing. Email us at the address below; we respond within 30 days.

9. International transfers

Data may be processed in the United States and other countries. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

10. Security

We use encryption in transit (TLS) and at rest, role-based access controls, and regular backups. No system is 100% secure; we encourage strong passwords and two-factor authentication where available.

11. Children

Echo is not directed to children under 16. We do not knowingly collect their data.

12. Changes

We will post any updates here and, for material changes, notify you by email.

13. Contact

privacy@echo.app