Privacy Policy

Jan 1, 2026

Who we are
Echotrace AI (“Echotrace,” “we,” “us,” or “our”) is an AI and marketing agency. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our websites, use our online services, attend our events, or otherwise interact with us (collectively, the “Services”). This Policy does not cover data we process on behalf of our business clients as their processor/service provider; that processing is governed by our agreements with those clients.
Scope

Applies to: our public websites, landing pages, newsletters, webinars, demos, AI chat or support tools, and other online touchpoints where this Policy is posted.
Does not apply to: third-party websites or services that we do not control, or to client-provided data processed under a separate contract.

Information we collect
a) Information you provide

Contact and identifiers: name, email address, phone number, mailing address, company, job title.
Account and preferences: username/password (if applicable), communication and marketing preferences.
Business information: your role, team size, industry, project details, budget, RFPs.
Content you submit: inquiries, chatbot prompts, form inputs, survey responses, testimonials, uploads.
Payment and transaction details: if you purchase from us (processed by third-party payment processors).
Recruitment data: resumes/CVs, LinkedIn profile, work history (if you apply for a job).

b) Information collected automatically

Device and usage data: IP address, device IDs, browser type, operating system, language, pages visited, links clicked, timestamps, referring/exit pages.
Cookies and similar technologies: cookies, pixels, tags, SDKs, session replay, and analytics tools to measure engagement and improve our Services.
Approximate location: derived from your IP address.

c) Information from third parties

Business partners, resellers, and referral sources.
Analytics, advertising, and social media platforms.
Publicly available sources and professional networks.
Lead-generation providers and data enrichment services.

Note on sensitive information: We do not intentionally collect sensitive personal information (e.g., health, financial account numbers, precise geolocation, government IDs) via our website. Please do not submit sensitive information in forms or chat prompts.

How we use your information

Provide and operate the Services, including AI-enabled features (e.g., chatbots, content suggestions).
Respond to inquiries, provide demos, proposals, and customer support.
Send administrative messages, updates, and marketing communications (you can opt out at any time).
Personalize content and measure campaign performance.
Conduct analytics, research, troubleshooting, and product/service improvement.
Detect, prevent, and respond to fraud, security incidents, and misuse.
Comply with legal obligations and enforce our terms.
Recruitment and HR purposes (if you apply for a role).

AI features and model improvement

We may use de-identified or aggregated data to improve our Services, including AI features.
We do not use your personal information to train publicly available AI models without your explicit consent.
If we use third-party AI providers to process your inputs (e.g., to power a chatbot), we contractually require them to protect your data; do not share sensitive information in chat.

Legal bases for EEA/UK/Swiss users

Contract: to provide the Services you request.
Legitimate interests: to operate and improve our Services, market to business contacts, secure our systems (balanced against your rights).
Consent: for certain cookies/analytics/marketing where required.
Legal obligations: to comply with applicable laws.

How we share information
We may share personal information with:

Service providers and processors: hosting, cloud, analytics, email, CRM/marketing tools, customer support, payment processing, security, and IT services.
Advertising and analytics partners: to measure performance and (where permitted) deliver or measure targeted ads.
Professional advisors: lawyers, auditors, insurers.
Corporate transactions: in connection with a merger, acquisition, financing, or sale of assets.
Legal and safety: to comply with law, respond to lawful requests, or protect rights, property, and safety.
With your direction or consent.

We do not sell personal information for money. We may “share” personal information with advertising partners for cross-context behavioral advertising as defined by some US state laws. See “Your privacy rights and choices” to opt out.

Cookies and tracking technologies

Types: strictly necessary, functional, performance/analytics, and advertising cookies/pixels.
Choices: manage preferences via our cookie banner or your browser settings. Some features may not function without certain cookies.
Do Not Track/GPC: we honor Global Privacy Control (GPC) signals for applicable opt-outs where required by law.

Data retention
We retain personal information for as long as necessary to fulfill the purposes described in this Policy, including to comply with legal, accounting, or reporting obligations; resolve disputes; and enforce agreements. Retention periods vary by data type and context.
Data security
We use administrative, technical, and physical safeguards designed to protect personal information. No method of transmission or storage is completely secure; we cannot guarantee absolute security.
International data transfers
If you access the Services from outside the country where our servers are located, your information may be transferred across borders. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) to protect personal information transferred internationally.
Children’s privacy
Our Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided personal information, contact us and we will delete it as appropriate.
Your privacy rights and choices
a) General choices

Marketing: unsubscribe via email footer or contact us.
Cookies/ads: use our cookie banner, browser settings, or industry opt-out tools (e.g., NAI/DAA). We also honor GPC where applicable.
AI/chat: avoid sharing sensitive information in free-text fields.

b) EEA/UK/Swiss residents (GDPR/UK GDPR)
You may have the right to: access, correct, delete, restrict, or object to processing; data portability; and withdraw consent. You also have the right to lodge a complaint with your local supervisory authority. We will respond to requests in accordance with applicable law.

c) US state privacy laws (e.g., CA, CO, CT, UT, VA)
Depending on your state, you may have the right to:

Know/access and obtain a copy of personal information.
Delete personal information.
Correct inaccuracies.
Opt out of: (i) sale of personal information, (ii) sharing for cross-context behavioral advertising, and/or (iii) targeted advertising and certain profiling.
Limit the use/disclosure of sensitive personal information (CA).
Non-discrimination for exercising your rights.

How to exercise

Submit a request at: [web form URL] or email: privacy@echotrace.ai
Verification: we may require information to verify your identity.
Authorized agents (CA): you may designate an agent; we may require proof of authorization and verification of your identity.
Appeals (where required): if we deny your request, you may appeal by contacting privacy@echotrace.ai with “Appeal” in the subject. If unresolved, you may contact your state attorney general.

Notice at collection for California residents

Categories collected: identifiers; customer records; commercial information; internet/electronic activity; geolocation (approximate); professional/employment information; inferences. We do not intentionally collect sensitive personal information via the website.
Purposes: as described in “How we use your information.”
Retention: as described in “Data retention.”
Selling/sharing: we do not sell for money; we may “share” for cross-context behavioral advertising. Opt out via our “Do Not Sell or Share My Personal Information” link: [link].

Links to third-party sites and services
Our Services may link to third-party websites, apps, or services. We are not responsible for their privacy practices. Review their policies before providing personal information.
Processor/Service provider role for clients
For client projects, we often act as a processor/service provider and process personal information under the client’s instructions and contract terms. Clients are responsible for providing appropriate privacy notices to their end users.
Changes to this Policy
We may update this Policy from time to time. The “Effective date” indicates when it was last revised. Material changes will be posted on this page and, where required, we will notify you.
Contact us

Email: privacy@echotrace.ai