Updated as of August 12, 2026
This Privacy Policy explains how echowin, Inc. ("echowin," "we," "us") collects, uses, shares, and protects personal information. It covers our marketing website, our dashboard and customer portal, and the echowin Service.
Read this first: which part of this policy applies to you depends on how you reached us.
When we act for ourselves (controller). For visitors to echo.win, for people who sign up for an account, and for our own business contacts, echowin decides how and why personal information is used. The rest of this policy describes that.
When we act for a business customer (processor). Our customers build AI agents that talk to their own callers and visitors. When you call, text, or chat with an agent built by one of our customers, that business, not echowin, decides what happens to your information. We process it on their behalf and on their instructions, under our Data Processing Addendum. If you want your information corrected or deleted, contact the business you were dealing with; see Section 11 below.
Information you give us when you use echowin as a customer:
Information processed through your agents. Calls, messages, and chats handled by an agent, including audio recordings, transcripts, caller and recipient phone numbers, call metadata such as time and duration, contact records, and AI-generated summaries and analysis of those interactions. Where this relates to your callers and contacts, we handle it as a processor on your behalf (Section 1).
Information we collect automatically. IP address, device and browser information, pages viewed and actions taken in our website and portal, referral source, and approximate country derived from IP address. Cookies and similar technologies are described in Section 6 below.
Information from third parties. Our payment processor tells us the status of a transaction. Where you connect a third-party service to your agent, that service returns data to us at your direction.
We do not make decisions producing legal or similarly significant effects about individuals through solely automated means.
The echowin Service uses artificial intelligence, including models operated by third-party providers, to transcribe speech, generate an agent's responses, synthesize speech, and analyze and summarize interactions. Those providers are listed on our subprocessors page.
We do not use identifiable Customer Personal Data to train artificial intelligence models, and we do not permit our AI providers to train their models on it, except (a) as necessary to provide the Service to the customer whose data it is — such as tailoring an agent to that customer's own configuration — or (b) with that customer's prior written consent. This commitment is set out in Section 3.4 of our Data Processing Addendum.
We may use de-identified or aggregated data — data that cannot reasonably be linked back to you, your business, or any caller — to operate, secure, analyze, and improve the Service. We do not attempt to re-identify such data, and we require anyone who receives it from us to do the same.
AI output is probabilistic and can be wrong. Customers are responsible for reviewing and overseeing what their agents do.
Subprocessors. We use third-party vendors to host, transmit, transcribe, synthesize, analyze, and deliver communications. Each one is bound by written terms no less protective than our DPA, and each is named on our subprocessors page, with its location and what it does. You can subscribe there to be notified before we add a new one.
Services you connect. When you connect a third-party service to your agent — a calendar, CRM, scheduling or commerce platform, messaging platform, or your own webhook endpoint — we transmit data to it at your direction. Those services are your vendors, not ours, and their handling of your data is governed by your agreement with them. See Terms of Service §2.7.
Vendors we use to run our own business. Separately from the subprocessors above, we use vendors that support echowin's own operations rather than the delivery of your agents: Stripe for payment processing and subscription billing, Brevo and Mautic for our own marketing contacts and newsletter, Backblaze B2 and Fonticons (Font Awesome) for static brand and icon assets, fal.ai for imagery on our marketing pages, and FreeScout for our support helpdesk. These do not process the call, message, or contact data your agents handle. The analytics and abuse-prevention vendors we use on our website and portal are described in Section 6.
Legal and safety. We may disclose information where required by law, subpoena, or other legal process, or where we believe disclosure is necessary to protect rights, safety, or property, or to investigate fraud or abuse. Where the request concerns a customer's data and the law permits, we notify the customer first and direct the requesting authority to them.
Business transfers. If echowin is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.
We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act. We have not done so in the preceding twelve months.
We use cookies and similar technologies to keep you signed in, remember preferences, secure the service, and understand how our website and portal are used.
Most browsers let you block or delete cookies. Some parts of the Service will not work correctly without them. Where required by law, we ask for consent before setting non-essential cookies, and we honor Global Privacy Control signals where applicable law requires it.
We keep account and billing records for as long as your account is active and afterward as needed for legal, tax, accounting, and dispute-resolution purposes. Call recordings, transcripts, and related records are retained for as long as the customer's account is active or until the customer deletes them, and are then deleted or de-identified in accordance with the DPA and our data deletion policy. Backups are deleted or overwritten on our normal rotation schedule. De-identified and aggregated data may be retained indefinitely.
We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access control with multi-factor authentication for production access, logging and monitoring, and a documented incident response process. These measures are described in Annex 2 of our Data Processing Addendum. No system is perfectly secure. You are responsible for safeguarding your credentials and for the settings and integrations you choose.
echowin is based in the United States, and our subprocessors process information in the United States and in the other locations named on our subprocessors page. Where we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland, we rely on the Standard Contractual Clauses and, where applicable, the UK Addendum, as set out in Section 10 of our DPA.
Depending on where you live, you may have the right to:
To exercise a right, email privacy@echo.win from the address associated with your account, or write to us using the details in Section 12. We will verify your identity before acting, and we will respond within the time the law allows. An authorized agent may act for you with proof of authority. We will not discriminate against you for exercising a privacy right.
If you spoke with, texted, or chatted with an AI agent, that agent belongs to one of our customers, a business that chose to use echowin. That business decides what information is collected, how long it is kept, and what it is used for. It is responsible for telling you that the interaction is recorded and transcribed and for obtaining any consent the law requires.
Direct your request to that business. If you send it to us instead, we will forward it to them and let you know, but we cannot access, correct, or delete their records on our own initiative. If you do not know which business it was, email us at privacy@echo.win with the phone number you called and the approximate date and time, and we will try to help you identify it.
The echowin Service is for business use and requires users to be at least 18 years old. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact privacy@echo.win and we will delete it.
We may update this policy. When we make material changes, we will update the date at the top and notify account holders by email or through the customer portal. Your continued use of the Service after the effective date means you accept the updated policy.
Questions, requests, or complaints about privacy: privacy@echo.win.
General support: help@echo.win.
Postal address: 110 Sugar Beet Circle, Longmont, CO 80501