Echlo privacy policy
Last updated: 7 October 2026
This policy explains what personal data Echlo Ltd ("Echlo", "we") collects, why, and what your rights are.
Echlo Ltd, company number 17505175, registered office 128 City Road, London EC1V 2NX. Contact for anything about your data: info@echlo.co. ICO registration number: [ICO NUMBER].
Who this covers
- Businesses that use Echlo, and the people who work for them.
- Customers of those businesses who are asked for a review through Echlo.
- Visitors to echlo.co.
1. Businesses using Echlo
What we collect: your name, business name, email, phone number, the details of your business you enter (such as your team list and the platforms you use), and billing details. Direct Debit bank details are collected and held by GoCardless, not by us.
Why, and our lawful basis: to provide Echlo under our contract with you; to take payment; to contact you about your account; and to improve Echlo (our legitimate interest in making the product work well).
How you use your dashboard: we record how the dashboard is used with Microsoft Clarity, as described in "How we record page use" below.
How long: while your account is open, then 12 months. Billing records are kept for six years, as the law requires.
After you leave: we keep your name, business name, email and the date you left for up to 24 months so we can occasionally tell you about changes to Echlo that might bring you back (our legitimate interest). Every message has a one-click opt-out, and you can ask us to stop at any time by emailing info@echlo.co. When you opt out, we delete those details too.
2. Customers asked for a review
If a business sends you a review request through Echlo, that business decides how your data is used. It is the controller, and Echlo processes your data on its behalf, under a contract that stops us using it for anything else. Questions about why you were contacted should go to the business first. You can also contact us and we will pass your request on.
What we process for the business: your name and the contact details the business gave us, the job it did for you, your answers, the review draft, the review you approve, and which platforms you posted to.
- A draft is written from your own answers. Nothing is posted unless you approve it, and you post it yourself.
- If you answer the question about what could have been better, that answer goes only to the business. It is never put into your review.
- We never put your address, postcode, phone number or email into a review.
We also record how the review screens are used, such as where people tap, scroll or stop, so the business's review requests work well. This uses Microsoft Clarity, as described in "How we record page use" below. Your name, the job, your answers and your review are hidden from these recordings. Opting out changes nothing about your review or the screens you see.
3. Visitors to echlo.co
We record how our pages are used with Microsoft Clarity, as described in "How we record page use" below. What you type into the pilot form is hidden from these recordings.
If you contact us, we use what you send to reply.
If you apply for the pilot, we use the details you give to contact you about it, and keep them for 12 months unless you join, when they become part of your account. If you ticked the box for updates, we send you occasional news about Echlo; every message has a one-click opt-out.
How we record page use
We use Microsoft Clarity on echlo.co, on the review screens customers see, and on the business dashboard, to understand how people use them, for example where they get stuck. Clarity records taps, clicks, scrolls and the pages visited, with details of your device and browser, and uses cookies. On the review screens and the dashboard, everything people type or that is about them (names, jobs, answers, reviews and customer details) is hidden in the recordings; only Echlo's own fixed wording, such as headings, questions and buttons, is shown. Our lawful basis is our legitimate interest in making Echlo easy to use.
A notice tells you this when you arrive, and you can opt out from it, or at any time from the Cookie opt-out link in the footer. Opting out is remembered in that browser.
Clarity keeps session recordings for 30 days; recordings we mark as favourites, and a small random sample, may be kept for up to 9 months.
Who else processes data for us
We use these service providers. Each is bound by contract to protect the data and use it only for our instructions.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database | Data stored in the UK (London); Supabase is a US company |
| Vercel | Hosting the website and app | US and worldwide; the app's server functions run in the UK (London) |
| OpenAI | Drafting reviews from the customer's answers. Under OpenAI's API terms this data is not used to train its models | US |
| GoCardless | Direct Debit payments | UK / EU |
| Microsoft Clarity | Recording how the website, review screens and dashboard are used, with personal details hidden; you can opt out | Provided by Microsoft Ireland Operations Ltd; data stored on Microsoft Azure and may be transferred to the US (Microsoft Corporation) under Microsoft's Standard Contractual Clauses |
| Resend | Sending our emails, including pilot sign-up details to us | EU (Ireland); Resend is a US company |
Where data goes outside the UK, we rely on safeguards the UK recognises: an adequacy decision, the UK Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement.
We never sell personal data.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it to another service. Email info@echlo.co. If your data came to us from a business using Echlo, we will help that business answer you.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
Changes
If we change this policy we will update the date at the top. If a change matters to you, we will tell you.