Echo Privacy Policy

Who operates Echo

Echo is operated by AI Expert OÜ, registered in Estonia (registry code 17268273). For privacy questions, data subject requests, or deletion requests, use our contact form. AI Expert OÜ is the data controller for personal data processed by Echo.

Legal basis (GDPR Art. 6)

We process Meta account data and Page credentials under contract performance — you connect a Facebook Page so that Echo can publish posts on your behalf, and that processing is necessary to deliver the service you authorized. Operational logs are kept under legitimate interest in keeping Echo reliable and secure.

Data we collect

When you connect a Facebook Page through Meta, Echo may process:

• Meta account and Page identifiers needed to identify the Page you authorized.
• Page access tokens and related credentials needed to publish on your behalf.
• Display names and account metadata returned by Meta during connection setup.
• Posts, captions, publishing status, timestamps, and provider response metadata.
• Operational logs and metrics needed to diagnose failures and keep the service reliable.

How we use Meta data

Echo uses Meta data only to provide the publishing functionality you request: connecting a Facebook Page, validating that the connection works, publishing posts to that Page, and showing connection or publishing status inside Echo.

How we protect credentials

Echo stores platform credentials server-side and encrypts stored credentials at rest. Responses from Echo do not return raw access tokens or secrets. We do not intentionally log tokens, client secrets, or raw credential values.

Sharing and sale of data

We do not sell Meta data. We do not share Meta data with third parties for advertising or profiling. Data is processed by infrastructure providers only as needed to run, secure, back up, and monitor Echo.

Retention

Echo keeps connected account records, encrypted credentials, posts, status records, and operational metadata for as long as needed to provide the service, troubleshoot issues, comply with legal obligations, or protect the service. Credentials are removed when a connection is deleted.

Your choices

You can revoke Echo access from your Meta account settings, remove the Facebook Page connection in Echo, or contact us to request deletion of data associated with your connected account. See the Echo data deletion instructions for the current process. We respond to verified deletion requests within 30 days.

Your rights under GDPR

If you are in the EU/EEA you have the right to: access the personal data we hold about you; request rectification of inaccurate data; request erasure (right to be forgotten); request restriction of processing; data portability; and to object to processing based on legitimate interest. To exercise any of these rights, submit a request through our contact form and include the email address associated with your Meta account in the message so we can verify ownership.

If you believe we have processed your data unlawfully, you may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at aki.ee.

Changes

We may update this policy when Echo changes or when legal, operational, or platform requirements change. The latest version will be published at this URL with the “Last updated” date above. Material changes are announced via the Echo interface for connected accounts.