Privacy Notice
Applies to: echo.agenticagency.dev, echo-beta.agenticagency.dev and the Echo service provided through them. Version: 1.2 · Effective: 23 September 2026
This notice explains what personal data we process when you use Echo, why, on what legal basis, who else sees it and what you can do about it. It is the privacy notice referred to in clause 13.3 of the Echo Beta Terms and Conditions.
1. The two roles — read this first
Echo processes personal data in two different capacities, and your rights run against a different organisation depending on which one applies.
1.1 We are the controller for personal data about the people who hold Echo accounts — account administration, security, support, billing and service communication. Sections 3 to 11 describe that processing. If you have an Echo account, this notice is addressed to you.
1.2 We are a processor for everything a customer puts into their projects: uploaded documents, mission definitions, contact lists, and the answers Participants give. The customer — the organisation whose account holds the project — is the controller of that data. They decide who is contacted, what is asked and why. We process it only on their instructions, under our Data Processing Agreement, referred to in clause 13.2 of the Terms.
1.3 If you answered an Echo interview link and want to know why you were contacted, what happens to your answer, or want it deleted — the organisation that sent you the link is the one who can tell you, and the one who must act on your request. Section 12 explains how to find them, and what we will do if you come to us instead.
2. Who we are
Agentic Agency ApS Gammel Kongevej 152 B, 3. 1850 Frederiksberg C Denmark CVR no. 46326458
Full company details, representation and supervisory information are in our Legal Notice / Impressum.
Privacy contact: privacy@agenticagency.dev
We have not appointed a Data Protection Officer. We are not required to under Article 37 GDPR: our core activities do not consist of large-scale regular and systematic monitoring of data subjects, nor of large-scale processing of special-category data.
3. What we process as controller, and why
3.1 Account data
| What | Examples | Why | Legal basis |
|---|---|---|---|
| Identity and credentials | Name, email address, password hash (bcrypt — we never hold the password itself) | Creating and running your account, signing you in | Art. 6(1)(b) — performance of the contract |
| Email verification and password reset | Single-use tokens, their expiry and whether they have been used | Proving you control the address; letting you recover access | Art. 6(1)(b) |
| Session state | A signed session cookie and a server-side session version that lets us revoke every session at once | Keeping you signed in; cutting off sessions after a password reset | Art. 6(1)(b) and Art. 6(1)(f) — security |
| Legal acceptance | Which version of the Terms and of this notice you accepted, and when | Proving the contract was accepted; meeting our accountability duty | Art. 6(1)(c) and Art. 6(1)(f) |
| Billing | Stripe customer and subscription id, subscription status, invoice history (held by Stripe, referenced by Echo). At checkout, we also disclose your name, email address, billing address and VAT ID to Stripe; card data is entered on Stripe's own pages and never seen by Echo. | Running your subscription, taking payment, issuing invoices | Art. 6(1)(b) and Art. 6(1)(c) — performance of the contract and our statutory invoicing obligations |
3.2 Usage and operational data
| What | Examples | Why | Legal basis |
|---|---|---|---|
| Service metering | Per-call token counts for the AI models, tied to a project and a session | Understanding cost, detecting misconfiguration and abuse, planning pricing | Art. 6(1)(f) — our legitimate interest in running a viable service |
| Server logs | Request paths, status codes, timestamps, error traces | Keeping the service up, diagnosing faults, security | Art. 6(1)(f) |
| Support correspondence | What you write to us and our reply | Answering you | Art. 6(1)(b) and Art. 6(1)(f) |
We do not use analytics or advertising trackers, and we do not profile you.
3.3 What we do not do
- We do not sell personal data, and we do not share it for anyone else's marketing.
- We do not use your content, your Participants' answers or your transcripts to train AI models, and our providers do not either: Anthropic is prohibited by its commercial terms from training on that content, and ElevenLabs' use of content to train or improve its models is disabled at account level for the account the Service uses (clause 12.3 of the Terms).
- We take no automated decision producing legal or similarly significant effects for you within the meaning of Article 22 GDPR.
4. What we process as processor, on our customers' instructions
For completeness, because it is the bulk of what the system holds:
- Project files — documents customers upload or Echo writes, stored as files on block-storage volumes in our cluster.
- Contacts — name, email address, and optionally organisation and a free-text note, entered by the customer about the people they want an Agent to contact.
- Interview links — the mission goal, the expected result, an expiry, and a hash of the link token. The token itself is never stored.
- Conversations — the full transcript of every chat and every voice interview, typed and spoken, kept as part of the customer's project.
The customer is the controller of all of it. We access it only to run the service, to fix a fault, or where the customer asks us to. Our staff do not read project content as a matter of routine.
5. AI models and voice
5.1 Echo works by sending text to a large language model. When you or a Participant writes a message, the message, the relevant project context and the conversation so far are sent to Anthropic PBC (Claude models) to produce the reply. Anthropic acts as our processor and is prohibited by its commercial terms from training models on the content.
5.2 Where a conversation happens by voice, the browser connects to ElevenLabs, Inc., which performs speech recognition and speech synthesis in real time. Audio therefore leaves your device and is processed by ElevenLabs as our processor. ElevenLabs' use of content to train or improve its models is disabled at account level for the account the Service uses, and ElevenLabs deletes the audio and its copy of the transcript 7 days after the call. The resulting transcript is written back into the customer's project in the same way a typed conversation is, and is kept there under section 8.
5.3 Participants are told they are talking to an AI system before the conversation starts. This is required by Article 50(1) of Regulation (EU) 2024/1689 (the AI Act), which has applied since 2 August 2026, and is promised in clause 8.3 of the Terms. Echo never presents itself as a named human being.
5.4 AI output can be wrong. Nothing Echo produces should be relied on as fact, advice or a decision without a human checking it.
6. Who else sees the data
We use the following processors. Each processes personal data only on our instructions and under a written data processing agreement.
| Processor | Role | Where it processes |
|---|---|---|
| OVH SAS ("OVHcloud") | Managed Kubernetes and block storage — the servers Echo runs on and the volumes it stores data on | Germany (region de1), EU |
| Anthropic PBC | Large language model inference — chat, interviews, summaries, extraction | United States |
| ElevenLabs, Inc. | Real-time speech recognition and synthesis for voice conversations | United States |
| Mailjet SAS | Transactional email — verification, password reset, interview invitations, reminders, result notifications | France, EU |
| Stripe Payments Europe, Limited | Payment processing, subscription management, invoicing, tax calculation | Ireland, EU |
For fraud prevention and its own regulatory compliance, Stripe also acts as an independent controller of the data it holds (clause 12.1 of the Terms) — unlike the other processors above, which act only on our instructions.
We will also disclose personal data where the law requires it, and to our professional advisers under a duty of confidence. We do not otherwise pass it to anyone.
Transfers outside the EU/EEA. Anthropic and ElevenLabs process data in the United States. Those transfers are made under Article 46 GDPR safeguards — Standard Contractual Clauses, or the EU–US Data Privacy Framework where the provider is certified — together with the supplementary measures set out in our Data Processing Agreement. A copy of the relevant mechanism is available on request from privacy@agenticagency.dev.
7. Cookies
Echo sets one cookie: a signed session cookie that keeps you logged in. It is strictly necessary for a service you asked for, so no consent banner is required under section 9 of the Danish Cookie Order (cookiebekendtgørelsen) or Article 5(3) of Directive 2002/58/EC.
We set no analytics, advertising or third-party tracking cookies. The public interview links set no cookie at all — a Participant needs no account and gets none.
8. How long we keep things
Echo is in beta and has no automated deletion. We state this plainly rather than quote periods we do not yet enforce:
- Account data is kept while the account exists.
- Project content, contacts, interview links and conversation transcripts are kept until the customer deletes them or asks us to. There is no automatic expiry. An expired or closed interview link stops working, but its record and its transcript remain in the customer's project.
- Service metering and server logs are kept for operational and security purposes.
Building enforced retention periods is on the roadmap for general availability. Until then, if you want something removed, ask — see section 10 — and we will remove it.
9. How we protect it
Traffic is encrypted in transit (TLS, certificates issued by Let's Encrypt). Passwords are stored only as bcrypt hashes. Interview link tokens are stored only as hashes, so a database copy does not yield working links. Sessions can be revoked centrally. Access to production is limited to the people who need it. Volumes are backed up nightly.
Clause 14 of the Terms sets out our security commitments, and clause 13.5 our breach notification duty — without undue delay and in any event within 48 hours of becoming aware.
10. Your rights
Where we are the controller (section 1.1), you have the right to:
- access the personal data we hold about you, and get a copy;
- rectify it if it is wrong or incomplete;
- erase it, where one of the grounds in Article 17 applies;
- restrict our processing, in the circumstances in Article 18;
- portability — receive the data you gave us in a structured, machine-readable form, and have it sent to another controller where technically feasible;
- object to processing we base on legitimate interests (section 3.2), on grounds relating to your particular situation;
- withdraw consent, where we rely on consent — which, as section 3 shows, we currently do not.
Write to privacy@agenticagency.dev. We answer within one month, and will tell you if we need the extension Article 12(3) allows. We may ask you to confirm who you are before we act, so we do not disclose your data to someone else.
11. Complaints
If you think we have handled your personal data wrongly, tell us first — we would rather fix it. You also have the right to complain to a supervisory authority, in the EU/EEA country where you live, work, or where you think the problem happened.
Ours is:
Datatilsynet (the Danish Data Protection Agency) Carl Jacobsens Vej 35, 2500 Valby, Denmark +45 33 19 32 00 · dt@datatilsynet.dk · datatilsynet.dk
12. If you were contacted by an Echo Agent
You received a link because an organisation using Echo put your name and email address into their project and asked an Agent to reach you. That organisation is the controller. They chose to contact you, they decide what happens to your answer, and your rights under section 10 run against them, not against us.
The interview page names the organisation and states the purpose before the conversation starts. If it does not, or you cannot work out who is asking, write to privacy@agenticagency.dev with the link and we will identify the customer and pass your request on without undue delay. We will act on it ourselves where the customer instructs us to, and we will tell you what happened.
You are never obliged to answer. The interview page carries a decline option, and declining ends the link.
13. Changes
We will update this notice when the service changes. The version number and effective date at the top always identify the current text, and each published version is tied to the release it shipped in, so it is always possible to establish which text applied when.
Where a change materially affects how we process your personal data, we will tell account holders by email before it takes effect.
14. Contact
Agentic Agency ApS · privacy@agenticagency.dev Gammel Kongevej 152 B, 3., 1850 Frederiksberg C, Denmark · CVR 46326458