Privacy Policy

The controller of personal data for the Echo Forge marketing site and customer accounts is Echo Prime Tech LLC("Echo," "we," "us"). Site: https://echosforge.com. Privacy contact: [email protected].

When we process personal data on behalf of a business customer under a written agreement, that customer is typically the controller and Echo is the processor under the Data Processing Addendum.

We may collect:

• Account data — name, email, authentication identifiers, organization/workspace membership, role.
• Billing data — plan, promo codes, limited payment metadata from processors (we do not store full card numbers on our servers when a PCI-compliant processor is used).
• Customer Content — prompts, specifications, source files, designs, logs, and artifacts you submit to the forges.
• Usage and device data — IP address, user agent, approximate location derived from IP, pages viewed, feature usage, error diagnostics.
• Communications — support tickets, email correspondence, onboarding forms.

We do not intentionally collect special-category data (e.g., health, biometric templates for identification) unless you deliberately submit it in Customer Content; please do not submit such data unless required by a written enterprise engagement.

Data comes from you (or your organization), from your use of the Services, from authentication providers you choose (e.g., Google OAuth), from payment processors, and from security/monitoring tooling. See AI Providers & Subprocessors.

We use personal data to:

• Provide, secure, and improve the Services;
• Authenticate users and prevent abuse;
• Process subscriptions, promos, and invoices;
• Generate forge outputs you request;
• Provide support and operational notices;
• Comply with law and enforce our Terms;
• Produce aggregate, de-identified analytics that do not identify you or your confidential Customer Content.

Training shared models: Customer Content is not used to train shared foundation models available to other customers, except where you opt in under a separate written program. Details: IP Ownership.

Where GDPR/UK GDPR applies: contract performance (providing the Services), legitimate interests (security, product improvement without overriding your rights), consent (where required, e.g., certain cookies or marketing), and legal obligation.

We share personal data with:

• Subprocessors that host infrastructure, auth, email, payments, and AI inference — listed at /subprocessors;
• Professional advisors under confidentiality;
• Authorities when required by law or to protect rights and safety;
• Successors in a merger, acquisition, or asset sale (with notice where required).

We do not sell personal information as "sale" is commonly defined under U.S. state privacy laws, and we do not share it for cross-context behavioral advertising.

Data may be processed in the United States and other countries where Echo or its subprocessors operate. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) for transfers from the EEA/UK.

Retention periods, deletion workflows, and post-cancellation handling are described in Data Retention & Deletion.

We implement administrative, technical, and physical safeguards appropriate to the risk, including access control, encryption in transit, least-privilege operations, and monitoring. No method of transmission or storage is 100% secure; report suspected incidents to [email protected] or [email protected].

Depending on your location, you may have rights to access, correct, delete, port, restrict, or object to certain processing, and to withdraw consent. Submit requests to [email protected]. We may need to verify your identity. You may lodge a complaint with a supervisory authority where applicable.

California residents: we do not sell or share personal information for cross-context behavioral advertising. You may request know/delete rights as above. We will not discriminate for exercising privacy rights.

We use essential cookies and local storage for authentication, security, and session continuity. Analytics cookies, if introduced, will be disclosed and, where required, consented. You can control cookies via browser settings; disabling essential cookies may break sign-in.

The Services are not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child provided data, contact us for deletion.

We may update this Privacy Policy by posting a new effective date on this page. Material changes may also be communicated by email or in-product notice.

Privacy: [email protected]. Operator: Echo Prime Tech LLC.