Privacy Policy

1. Who controls your data

Bright Peak GmbH, Kürnbergstraße 32a, 81369 München, Germany (HRB 286591), is the data controller for the Service. Contact us at contact@echotxt.ai for any privacy request.

2. What we collect, and why

Account data. Your email address, used to sign you in and to identify your subscription. You can sign in either by email (a one-time code, no password) or via Google Sign-In. When you use Google Sign-In, we receive your name, email address, and Google account identifier from Google, and use them solely to create and identify your Echo account. Stored in our database (hosted on Supabase) for as long as your account exists.

Message content, when you use Echo. When you press a hotkey, Echo may capture a screenshot of the active application window (Modes A/B) or just the text you type (Mode C — templates). This is sent to our backend, which forwards it to Anthropic's Claude API to draft a reply, then returns the draft to you. We do not store the screenshot or the message content — it is processed to generate your draft and then discarded on our side. Anthropic processes this data as our sub-processor under its Data Processing Addendum (automatically incorporated into Anthropic's Commercial Terms of Service). Anthropic does not use commercial API inputs or outputs for model training, and deletes API inputs and outputs within 30 days by default. We are actively pursuing a Zero Data Retention (ZDR) arrangement with Anthropic — where message content would not be stored beyond safety screening at all — and will update this notice if that arrangement changes. See Anthropic's Privacy Center for current details.

Usage metadata. We log how many replies you draft each month, which mode and AI model were used, and token counts — needed to enforce plan limits and to understand our own AI costs. This does not include the message content itself, only counts.

Personal context you configure. Tone-of-voice profiles, templates, signatures, and personal/contact details you enter in Settings are stored on our servers (Supabase) so they follow your account across devices. They are only transmitted to Anthropic at the moment you draft a reply, as part of building that reply's prompt. You can delete them at any time by editing your settings or requesting account deletion (see Section 6).

Gmail data (optional, if you connect your Gmail account). You can optionally connect a Gmail account so Echo can read your Sent folder to generate a personalized writing-style description. When you use this feature:

• Echo fetches a sample of your recently sent emails (plain text only) from Google's Gmail API.
• That text is sent to Anthropic's Claude API to produce a short style description, which is then stored as your tone-of-voice profile in your Echo settings.
• We do not store the raw email content on our servers — it is read once, passed to Anthropic for analysis, and discarded immediately.
• Your Gmail OAuth tokens (the credentials that authorize read access) are stored locally on your device in an encrypted file, never on our servers.
• Echo's use of Gmail data is limited to this purpose only. We do not use Gmail data for advertising, do not allow humans to read your emails, and do not transfer it to any party other than Anthropic as described above.
• You can disconnect Gmail at any time under Settings → Account. Disconnecting immediately revokes Echo's access and deletes the locally stored tokens.

Echo's use of data obtained through Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Billing data. If you subscribe to a paid plan, Stripe (our payment processor) collects your payment details directly — we never see or store your full card number. We store your Stripe customer/subscription IDs and subscription status to know whether you have paid access.

2a. Legal basis for processing (EU/UK)

Under the GDPR (and UK GDPR), we process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR) — account data, message content processed to draft replies, billing data, and tone-of-voice profiles and other settings you configure. Processing this data is necessary to provide the Echo service you have subscribed to.
• Consent (Art. 6(1)(a) GDPR) — access to your Gmail Sent folder (the optional "Connect Gmail" feature). You give explicit consent at the time you connect Gmail; you can withdraw it at any time by disconnecting Gmail under Settings → Account.
• Legitimate interests (Art. 6(1)(f) GDPR) — aggregated usage metadata (token counts, AI model used, reply mode) used to monitor our infrastructure costs and detect abuse. Our interest in running a sustainable and secure service is balanced against the low intrusiveness of aggregated, content-free metadata.
• Legal obligation (Art. 6(1)(c) GDPR) — billing records retained for tax and commercial-law compliance (German HGB, UStG).

3. Who we share data with

• Anthropic (Claude API) — processes message content and, when you use the Gmail tone feature, sampled sent-email text, to generate drafts and writing-style descriptions. Data is processed under Anthropic's API terms as our sub-processor.
• Google — used for optional Google Sign-In authentication and, if you connect Gmail, to retrieve your sent emails via the Gmail API. Governed by Google's Privacy Policy.
• Supabase — hosts our database, authentication, and backend functions (sub-processor for account, usage, settings, and billing data).
• Stripe — processes payments and manages subscriptions.

We don't sell your data, and we don't share it with anyone else.

4. Where your data is processed

Several of our sub-processors are based in the United States. For each, we have verified that a lawful transfer mechanism under GDPR Chapter V is in place:

• Anthropic (US) — processes message content and, optionally, sampled sent-email text to generate drafts. Transfer basis: EU–US Data Privacy Framework (DPF) adequacy decision (Anthropic is a certified DPF participant), and in parallel, the 2021 EU Standard Contractual Clauses (Module 2, controller-to-processor) automatically incorporated via Anthropic's Data Processing Addendum (governed by Irish law). A UK International Data Transfer Addendum and Swiss addendum are also included.
• Google (US) — used for Google Sign-In and, if you connect Gmail, to retrieve your sent emails. Transfer basis: EU–US Data Privacy Framework (DPF) adequacy decision (Google LLC is a certified DPF participant, including the UK Extension and Swiss–US framework).
• Stripe (US) — processes payments. Transfer basis: Standard Contractual Clauses (2021 EU SCCs) via Stripe's Data Processing Agreement; Stripe also participates in the EU–US Data Privacy Framework — verify current certification at dataprivacyframework.gov.
• Supabase (US-incorporated) — hosts our database, authentication, and backend functions. Transfer basis: Standard Contractual Clauses (2021 EU SCCs) via Supabase's Data Processing Agreement, supplemented by a Transfer Impact Assessment. Note: Supabase is not currently listed as a DPF-certified organisation. We have selected EU (Frankfurt) data storage as a supplementary protective measure and are monitoring Supabase's DPF status.

You can obtain copies of the applicable Standard Contractual Clauses by contacting us at contact@echotxt.ai.

5. How long we keep data

Account and usage data: for as long as your account is active, plus a reasonable period afterward for billing and legal-compliance records. Message content and Gmail email text: not retained by us at all, as described above. Tone-of-voice profiles and other settings you save are kept until you change or delete them, or until you request account deletion. You can request deletion of your account at any time (see below).

6. Your rights

If you're in the EU/UK, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request deletion of your account and associated data;
• Request a copy of your data in a portable format;
• Object to or restrict certain processing;
• Lodge a complaint with your local data protection supervisory authority.

To exercise any of these, email contact@echotxt.ai.

7. Children

Echo is not directed at children, and we don't knowingly collect data from anyone under 16.

8. Changes to this policy

We'll update this page if how we handle data changes, and note the date at the top.