Privacy policy

Vega Ventures, LLC · Effective October 6, 2026 · Last updated October 6, 2026

Private beta. Echo opened as an invite-only private beta on October 6, 2026. Today it offers email sign-in, workspaces, team roles and invites, and adding sites. Sections about AI engine reads, credits and payments, the API, MCP server and CLI, reports, alerts, integrations, white label and analytics describe features that aren’t available yet; they apply once a feature launches, and we’ll update this page when it does. Nothing is charged during the beta.

The short version. We collect what we need to run your account and to read AI answers about the sites you track. We don't sell personal data, share it for advertising, or use it to train AI models. You can export or delete everything.

This policy covers echobrandtracker.com, the Echo app, API, MCP server and CLI. Vega Ventures, LLC (Orange Beach, Alabama, USA) is the controller of personal data about account holders and website visitors. When an agency or business uses Echo to handle its own users' or clients' data, it is the controller and we are its processor (see section 10 and the DPA).

1. What we collect

You give us: name, work email, company, role, workspace and billing details, support messages, and the sites, prompts, competitors, notes and logos you add. Agencies may add teammates' and clients' names and emails to invite them. The free checker collects the domain you enter and, if you give it, your email.

Collected automatically: sign-in events, IP address, device and browser type, pages and features used, and error logs. See the Cookie Policy.

From payment providers: Stripe, BTCPay Server and our x402 facilitator tell us whether a payment succeeded, the card brand, last four digits and expiry, billing country, and for crypto payments the transaction ID and paying wallet address. We never see or store full card numbers or wallet private keys.

From Google (optional): if you connect Search Console, we read query and impression data for the properties you pick, only to suggest prompts. Our use of data from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. You can disconnect at any time.

From AI engines: answers to the prompts you track and the sources they cite. These are about brands and websites, not about you. If an answer happens to mention a person, we store it only as part of that answer.

2. How we use it

To provide and secure the Service, bill you and calculate tax, send service emails (sign-in codes, receipts, alerts, reports you schedule), provide support, prevent fraud and abuse, comply with law, and improve Echo. We send marketing email only if you opt in or, where the law allows, about similar services you already use; every marketing email has an unsubscribe link.

We use AI models to grade the sentiment of answers toward brands. This is about brands, not people, and we make no decisions about individuals that have legal or similarly significant effects.

Legal bases (EEA/UK): performing our contract with you; our legitimate interests in running, securing and improving the Service and in B2B marketing; your consent (marketing where required, optional cookies); and legal obligations (tax, accounting).

We share personal data only with:

Subprocessors that help us run Echo (hosting, email, payments, AI and data providers). They're listed on our Subprocessors page and bound by data protection terms.
Your workspace. Owners and admins can see members' activity. Agencies see what their clients do in client workspaces.
Authorities, when the law requires, or to protect rights, safety and security.
A buyer or successor, if Echo is sold, merged or reorganized, under this same policy.

Prompts are sent to AI engines as plain queries. We don't include your name, email or account details in them.

4. Where data is stored

Where Echo runs. Echo’s application and primary database run on a server we rent from Hetzner in Ashburn, Virginia, USA. Sign-in and invite emails are sent through Resend in the US. Some subprocessors may process data in other countries; see the Subprocessors page.

Vega Ventures, LLC is in the US, and some subprocessors are in the US. For transfers out of the EEA, UK or Switzerland we rely on the EU Standard Contractual Clauses, the UK Addendum, or a recipient's certification under the EU-US Data Privacy Framework.

5. Retention

Account and workspace data, including stored answers: while your account is open.
After you close it: deleted within 14 days, and removed from backups within 30 more days.
Invoices, payment and tax records: as long as the law requires (usually 7 years).
Security and access logs: up to 12 months. Analytics events: up to 24 months.
Free checker results without an account: 30 days.

6. Your rights

Depending on where you live, you can access, correct, export, delete or restrict use of your personal data, object to processing (including direct marketing), and withdraw consent. Most of this is self-serve in Settings. Otherwise email paris@enokseo.com; we reply within 30 days (45 days for US state requests) and may need to verify your identity. You may use an authorized agent. We won't treat you differently for using your rights. If we deny a request, you can appeal by replying to our answer. You can also complain to your local data protection authority.

US state privacy notice (including California). In the last 12 months we collected: identifiers (name, email, IP address), commercial information (purchases, credits), internet activity (usage and device data), professional information (company, role), and inferences limited to product preferences. Sources and purposes are described above. We disclose these to service providers for business purposes only. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information beyond what's needed to provide the Service. We honor Global Privacy Control signals as an opt-out of optional analytics.

7. Security

Encryption in transit (TLS), least-privilege access, sign-in codes and links instead of reusable passwords, and workspaces kept separate, with membership checked on every request. We’ll list more measures here once they are in place and verified. No system is perfect; if a breach affects you, we'll notify you as the law requires. Report security issues to paris@enokseo.com.

8. Children

Echo is for businesses and isn't directed at anyone under 16. We don't knowingly collect children's data; if we learn we have, we delete it.

9. Links and third parties

Answers and reports link to third-party websites. Their privacy practices are their own.

10. White-label agencies

When an agency presents Echo under its brand, the agency controls its clients' data and Echo processes it on the agency's behalf. Clients should contact the agency first; we'll help the agency respond.

11. Changes

We'll post updates here with a new effective date and email you about material changes at least 30 days before they apply.

Contact

Vega Ventures, LLC · paris@enokseo.com