AEO Accelerator · Cohort 1 starts 30 NovemberLearn more
Start for free

Data processing agreement

Version of 6 November 2026

This agreement applies whenever Echo processes personal data on behalf of a customer. It's part of Echo's terms and takes effect when the customer starts using Echo; nothing needs to be signed. Customers who need a signed copy can write to hello@echo-aeo.com.

1. Parties and roles

Controller: the customer, meaning the company or person that holds an Echo workspace (the "customer").
Processor: Benjamin Libor, trading as Echo, Grünberger Straße 17, 10243 Berlin, Germany ("Echo").

For its own customers' accounts (sign-in, billing, emails to users) Echo is the controller, as described in the privacy policy. This agreement covers the personal data the customer brings into Echo or lets Echo collect for it, listed in Annex 1.

2. Subject, duration and purpose

Echo processes personal data only to provide the service the customer uses: tracking how AI assistants describe the customer's brand, suggesting and drafting actions, measuring visits from AI assistants, and the other features the customer switches on. Processing lasts as long as the customer uses Echo, and ends with deletion under section 10.

3. Instructions

Echo processes personal data only on the customer's documented instructions: this agreement, the terms, and what the customer sets up and does in Echo. Echo processes it otherwise only where EU or German law requires it, and then tells the customer first unless that law forbids it. If Echo thinks an instruction breaks data protection law, it tells the customer and may wait until the customer confirms or changes it.

4. Confidentiality

Everyone at Echo who can access personal data is bound to confidentiality. Nobody at Echo looks into a workspace unless the customer asks for support, for security or because the law requires it.

5. Security (Art. 32 GDPR)

Echo takes the technical and organisational measures in Annex 2 and keeps them up to date. It may change them as long as the level of protection doesn't fall. The current measures are also described on /security.

6. Subprocessors

The customer authorises Echo to use the subprocessors in Annex 3. Echo tells the customer about a new or replaced subprocessor at least 14 days before it starts, by email to the workspace owners and on /security. The customer may object on reasonable data protection grounds within that time; if no solution is found, the customer may end the affected service. Echo puts each subprocessor under the same data protection duties as in this agreement and stays responsible for it.

Services the customer connects itself (for example Google Analytics, HubSpot, Attio, Framer, Webflow, WordPress, Slack, or Claude and ChatGPT through Echo's connector) aren't Echo's subprocessors: the customer chooses them and uses them under its own terms.

7. Transfers outside the EU

Where a subprocessor processes personal data outside the EU and the European Economic Area, Echo makes sure the transfer is lawful under Chapter V GDPR: through the EU-US Data Privacy Framework where the recipient is certified, and otherwise through the European Commission's Standard Contractual Clauses (2021/914, module 3, processor to processor), with extra measures where needed.

8. Helping the customer

Echo helps the customer, as far as it can, to answer requests from data subjects (access, correction, deletion, restriction, portability and objection), mostly through Echo itself: most data can be exported as CSV, changed or deleted in the app. Echo passes on any request it receives directly. Echo also helps with security, breach notifications, data protection impact assessments and consulting a supervisory authority (Art. 32 to 36 GDPR), with the information it has.

9. Personal data breaches

Echo tells the customer without undue delay, and within 48 hours of becoming aware, of a breach affecting the customer's personal data, with what it knows: what happened, which data and people are likely affected, the likely consequences and what Echo does about it. Echo adds what it learns later.

10. Deletion at the end

When the customer deletes a workspace, a brand or single records, Echo deletes them at once. When the customer's use of Echo ends, Echo deletes the remaining personal data within 30 days, unless the law requires keeping it. The customer can export its data before that. Automatic database backups expire within 30 days.

11. Proof and audits

Echo gives the customer the information needed to show that it meets this agreement. The customer may audit Echo, or have an independent auditor bound to confidentiality do it, once a year with 30 days' notice and during working hours, and at any time after a breach. Audits are done mainly through documents and must not disrupt the service or reveal other customers' data. Each party bears its own costs.

12. Final terms

Liability follows the terms. Where this agreement and the terms differ on data protection, this agreement wins. German law applies; the courts of Berlin are competent where the law allows. If a clause is invalid, the rest stays in force.

Annex 1: Data and people

Depending on which features the customer uses:

  • The customer's team: names, email addresses and roles of members and guests, and what they do in Echo.
  • Visitors to the customer's website (the Echo tag, landing pages hosted by Echo): page paths, where a visit came from, UTM tags, country, device type and a daily visitor code that can't be traced back. No IP addresses are stored and no cookies are set.
  • Leads and contacts the customer adds: name, email, company, role, website, notes, consent records, and messages to and from them.
  • People who fill in the customer's forms: what they enter, the consent text, the time and a hash of their IP address.
  • Customer contacts in customer stories: name, role, email, answers and approval records.
  • Data from tools the customer connects: for example deals and contacts from HubSpot or Attio, and visits from Google Analytics.
  • Files and documents the customer uploads, and public posts and pages that name the customer's brand or competitors (author names where the site shows them).

Echo processes no special categories of personal data (Art. 9 GDPR) unless the customer puts them in; it should not.

Annex 2: Technical and organisational measures

  • Hosting: Cloudflare Workers, D1 and R2; database and files stored in Cloudflare's Western Europe region, encrypted at rest by Cloudflare.
  • Encryption: HTTPS for every connection; keys and access tokens additionally encrypted by Echo with AES-256-GCM; API keys stored only as a fingerprint.
  • Access: sign-in only with Google or one-time email links (no passwords), sessions that end after 7 days without use, owner and member roles, rate limits on sign-in and public forms.
  • Separation: every request is checked against the signed-in person's workspace; automated tests check this on every change.
  • Minimisation: no IP addresses from the Echo tag, pseudonymous visitor codes from a key deleted after two days, prompts sent to AI providers without data about people.
  • Availability: automatic database backups for 30 days, Cloudflare's network against outages and attacks, a public status page.
  • Human oversight of AI: AI output is a draft in review; publishing, posting and sending outside the workspace need a person.
  • Secrets: kept in Cloudflare's secret store, never in the code; every AI call logged with its cost.

Annex 3: Subprocessors

  • Cloudflare (Cloudflare, Inc., USA). For: Hosting, database, file storage, email forwarding, protection against attacks. Receives: Everything stored in Echo: accounts, workspaces and their data, files. Where: Worldwide network; EU-US Data Privacy Framework and Standard Contractual Clauses.
  • Resend (Resend, Inc., USA). For: Sending Echo's emails (sign-in links, reports, alerts, invites). Receives: Recipient's email address and the email's content. Where: USA; Standard Contractual Clauses.
  • OpenAI (OpenAI, L.L.C., USA). For: ChatGPT's answers, analysis of answers and websites, drafts, the Echo agent. Receives: Brand details, prompts, website text; for the agent, the chat and members' names (never email addresses). Not used for training. Where: USA; Standard Contractual Clauses.
  • Anthropic (Anthropic PBC, USA). For: Claude's answers to the prompts. Receives: The prompts and the country they're asked from, nothing about people. Where: USA; Standard Contractual Clauses.
  • Perplexity (Perplexity AI, Inc., USA). For: Perplexity's answers to the prompts. Receives: The prompts and the country they're asked from, nothing about people. Where: USA; Standard Contractual Clauses.
  • Google (Google Ireland Ltd., Ireland). For: Gemini's answers (paid Gemini API); Sign in with Google. Receives: The prompts and their country; for sign-in, name, email address and profile picture. Where: EU and USA; EU-US Data Privacy Framework.
  • xAI (X.AI LLC, USA). For: Grok's answers to the prompts. Receives: The prompts, nothing about people. Where: USA; Standard Contractual Clauses.
  • DataForSEO (DataForSEO (dataforseo.com)). For: Google's AI Overviews and AI Mode, SEO data, competitors' Google ads, Google searches for Mentions, Google listings and reviews. Receives: Prompts, keywords, website addresses and their country and language, nothing about people. Where: Standard Contractual Clauses where data leaves the EU.
  • Brave Search (Brave Software, Inc., USA). For: Whether Brave's search has the brand's pages, and where the brand ranks there for its tracked keywords. Receives: Website addresses, page titles and tracked keywords; nothing about people. Where: USA; Standard Contractual Clauses.
  • Stripe (Stripe Payments Europe, Ltd., Ireland). For: Payments, invoices and VAT. Receives: Billing name, email and address, VAT ID; card details go straight to Stripe. Where: EU and USA; EU-US Data Privacy Framework and Standard Contractual Clauses.

See also security, the privacy policy and the imprint.