Echo is a document intelligence platform operated by Edgertech, a UK-based business owned by Timothy Edgerton. In this policy, "we", "us" and "our" refers to Edgertech. You can reach us at privacy@edgertech.co.uk.
We are registered as a data controller with the UK Information Commissioner's Office (ICO), registration number C1989632. For your account data, we are the data controller. For documents you upload into Echo workspaces, you remain the data controller — we process that content only as necessary to provide the service to you.
We collect the following types of personal data:
Account information
Your email address and password, or Google account details if you sign in with Google.
Billing information
Payment card details, processed and stored securely by Stripe. We never see or store your full card number.
Usage data
The workspaces you create, documents you upload, and chat messages you send within Echo.
Document content
Text extracted from documents you upload. This is used solely to provide the AI chat functionality described in Section 5.
Technical data
Authentication tokens stored in your browser to keep you logged in. We use only essential cookies — no tracking or advertising cookies.
We use your personal data to:
We do not sell your personal data. We do not use it for advertising. We do not share it with third parties for their own marketing purposes.
Contract
Processing your account data and documents is necessary to provide the Echo service you have subscribed to.
Legitimate interests
We process limited technical data to maintain the security and reliability of Echo and to prevent fraudulent use of the service.
Legal obligation
We retain billing and transaction records as required by UK tax law (typically 7 years).
Please read this section carefully.
When you send a chat message in Echo, the text content of your uploaded documents is transmitted to OpenAI's API to generate a response. This means your document content leaves our servers and is processed by OpenAI, a US-based company.
What you should know about OpenAI's handling of your data:
Our recommendation: Do not upload documents containing highly sensitive personal data (such as medical records, financial data, or information about vulnerable individuals) without carefully considering that this content will be transmitted to OpenAI for processing.
We use the following trusted third party services to operate Echo:
OpenAI
AI processing of document content when you use the chat feature. US-based. Does not train on API data. Transfers covered by SCCs.
Supabase
Database storage for your account, documents, and chat history. EU-hosted infrastructure. UK GDPR compliant.
Stripe
Payment processing. PCI DSS compliant. We never see your full card number. Stripe stores billing data securely.
Vercel
Application hosting and serving. Processes request data to deliver the Echo application to your browser.
Resend
Sends account-related emails on our behalf, such as sign-up confirmation and password reset links, from our verified domain.
Google (optional)
If you choose to sign in with Google, we receive your email address and profile information from Google.
Echo uses only essential cookies required for authentication and to keep you logged in. We do not use tracking cookies, advertising cookies, or analytics cookies. If you decline cookies using our cookie banner, the core functionality of Echo will not be affected since we only rely on essential cookies.
We keep your data only for as long as necessary:
You have the following rights regarding your personal data. To exercise any of these rights, email us at privacy@edgertech.co.uk. We will respond within 30 days.
Right of access
Request a copy of the personal data we hold about you.
Right to rectification
Ask us to correct inaccurate or incomplete personal data.
Right to erasure
Request deletion of your personal data. You can also delete your account directly within Echo.
Right to restrict processing
Ask us to pause processing your data in certain circumstances.
Right to data portability
Request your data in a structured, machine-readable format.
Right to object
Object to processing based on legitimate interests.
Right to withdraw consent
Where we rely on consent, you can withdraw it at any time.
Right to lodge a complaint
You can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your data.
Some of your data is transferred to and processed in the United States, specifically by OpenAI and Vercel. These transfers are carried out under Standard Contractual Clauses (SCCs) approved by the UK ICO, which ensure your data is protected to UK GDPR standards regardless of where it is processed.
We take reasonable technical and organisational measures to protect your personal data, including encrypted connections (HTTPS), row-level security in our database, rate limiting to prevent abuse, and access controls on our systems. However, no online service is 100% secure. If you believe your account has been compromised, please contact us immediately.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a notice within Echo. The "last updated" date at the top of this page will always reflect when changes were last made. Continued use of Echo after changes take effect constitutes acceptance of the updated policy.
For any privacy-related questions, requests, or complaints, please contact us at privacy@edgertech.co.uk. If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk.