Privacy and data

What Echo stores

• AI answers: the text, the brands named, the cited pages and the searches, for your prompts.
• Your website: pages Echo reads from your sitemap and your public site, the same way a visitor would, respecting robots.txt.
• Competitors' websites: public pages only.
• AI crawler visits: the crawler, the path, the status and the time. Nothing about people.
• The Echo tag: page views and visits without cookies or IP addresses; a visitor is recognised for one day only.
• Connections: what you allow, read-only for Google, with tokens and keys encrypted.

Who sees it

Only members of your workspace. Industry benchmarks use anonymised middle values from many brands; the workspace owner can switch contributing off.

AI providers

Prompts are sent to the assistants your plan includes through their APIs. Writing and analysis run on OpenAI, or on your own OpenAI key if you added one.

Echo never acts outside your workspace

Echo never publishes, posts or emails outside your workspace by itself. Drafts arrive in your website builder as drafts; replies and pitches are for you to send.

Delete your data

Delete a market, a brand or your whole account at any time; see Team, brands and workspaces. Disconnecting Google deletes what Echo imported from it.

Security

How Echo protects your data, and the list of service providers it uses, is on the security page. The status page shows whether Echo's systems and each AI assistant are answering, and uptime. The data processing agreement is at /dpa; it applies with the terms, without signing. To report a security issue, write to security@echo-aeo.com.