Legal
Privacy notice
Last updated: 8 August 2026
Who we are
echoUX is a service operated by M Digital Labs, trading as echoUX, a sole trader established in the United Kingdom.
Address for service: Office 14160, 182-184 High Street North, East Ham, London, E6 2JA, United Kingdom.
Contact for anything in this notice: hello@echoux.ai.
Two different roles, and why the difference matters
echoUX handles two kinds of personal data, and our legal role is different for each. Please read both.
1. Your account details. We are the controller.
If you sign up, we decide what to collect and why. That covers your email address, your organisation name, your billing relationship and the technical records of your use of the service.
2. The feedback you send us. We are a processor.
echoUX reads customer feedback that you already hold, from sources such as Slack, CSV files, pasted text, or a webhook. That feedback is usually written by your customers, not by you. Those people are not our customers and we have no relationship with them. You decide what to send us and why. We only act on your instructions.
For that content, you are the controller and we are your processor. The terms of that arrangement are in our data processing addendum, not in this notice.
The rest of this notice is mainly about the first role. It also tells you plainly how we treat the second, because you have to be able to answer your own customers.
What personal data we hold
Account data (we are the controller):
Your email address, and your organisation or tenant name.
Your role in the account, and when you last signed in.
Sign in records. We do not use passwords. We email you a one time link. We store a hash of that link, not the link itself, plus when it was created, when it expires and when it was used.
Session records. When you sign in we create a session and store the IP address and browser user agent that created it, plus a hash of the session token.
Records of emails we sent you, such as the welcome email or a data export notification.
Support and connector requests you send us through the app.
Billing records. Stripe holds your payment details. echoUX stores the Stripe customer and subscription identifiers, your plan, your subscription status and a log of subscription events. echoUX never sees or stores your card number. Payment happens on Stripe’s own hosted checkout page.
Feedback content (we are your processor):
The raw text of every feedback item you send, exactly as you sent it.
Any metadata attached to it, for example a channel name, an author handle or a timestamp, depending on the source you connected.
The artefacts echoUX produces, which contain verbatim quotes taken from that feedback.
We do not redact, mask or anonymise this content. There is no code in echoUX that does so. If a feedback item contains a name, an email address, an order number or anything else personal, echoUX stores it as written and includes it in prompts sent to our language model provider. What you send is what we hold. Filtering before you send is your decision to make, not ours to make for you.
Technical records:
An error log, holding details of failures inside the service.
A log of deliveries to your chosen destinations.
A log of feedback items the noise filter rejected.
What we do not do
These are worth stating because they are true today and easy to check:
The echoUX application runs no analytics or product telemetry of any kind. There is no analytics service in the application’s codebase. (Our marketing website is different; see “Cookies” below.)
We run no third party error tracking service.
We do not sell personal data, and we do not share it for advertising.
We do not use your feedback content to train our own models. We have no model of our own to train.
Why we use it, and our lawful basis
What
Why
Lawful basis
Your email address
To sign you in, and to send you service emails you need, such as your welcome link or an export being ready
Performance of a contract with you
Session and sign in records
To keep you signed in and to let us revoke access
Performance of a contract, and our legitimate interest in keeping accounts secure
Billing identifiers and subscription events
To take payment and to run your subscription
Performance of a contract, and legal obligation for tax records
Error and delivery logs
To find and fix faults
Our legitimate interest in running a service that works
Feedback content
We process it only on your instructions
You decide the basis, as controller. See the data processing addendum
If you want the balancing test behind any legitimate interest claim, ask us.
Where your data is processed
Service
What it receives
Where
Our application server and database
Everything: account data, raw feedback, artefacts
United Kingdom (London)
OpenRouter
The raw text of your feedback, inside prompts, plus the artefacts written from it
OpenRouter routes each call on to a model provider, primarily in the United States. The onward provider’s exact location is not under our control
MailerSend
Recipient email addresses and the text of service emails
European Union (Belgium), with UK transfers under the Data Privacy Framework
Stripe
Your billing details, which you give to Stripe directly
Per Stripe’s own terms, primarily the United States
DigitalOcean Spaces
Data export archives, which contain your artefacts and your raw feedback
Not yet in use. When the export storage is enabled it will be a UK or EU region
Slack, Notion, Linear
Finished artefacts, including the verbatim quotes that ground them, but only to the destinations you connect
Per each provider’s own terms
Cloudflare
Web traffic to the site
Cloudflare’s global network sits in front of production
echoUX is hosted in the United Kingdom: the application and its database run on servers in London, so your feedback data and everything derived from it is stored there. Some operations involve subprocessors in other regions. Here is where things actually go.
On OpenRouter, one thing we can state precisely. Every call echoUX makes sends a routing preference that restricts the call to providers that do not store or train on prompts. This is set on every request in the application, is on by default, and we have verified live that every model we use routes successfully under it. It is a routing restriction OpenRouter enforces. It is not a contract we hold with each model provider, and it does not control where in the world the call is served.
If your organisation requires data never to leave the UK or the EU, echoUX is not currently able to give you that. Please do not sign up on the assumption that it will change.
How long we keep it
These numbers come from the code, not from an aspiration. They are the defaults, and the first one can be changed per customer by agreement.
Raw feedback: 180 days by default.
A sweep runs once a day and deletes feedback items, rejected items and pipeline checkpoints older than the window. It also deletes queued items that were never processed once they pass the window, so nothing sits in a queue forever. The window is a setting, RAW_RETENTION_DAYS, and we can set a shorter one for your account if you need it.
Artefacts: kept while your account is open.
Artefacts are the findings echoUX produces, and they embed the quotes that support them as text rather than as pointers. That is deliberate: a finding you received a year ago still shows you the evidence behind it. It also means deleting raw feedback does not delete the quotes already inside artefacts. If you want those gone, delete the artefacts or close the account.
Processed queue rows: deleted once they reach a finished state and pass their own expiry.
Sessions: deleted 90 days after they expire. One time sign in links: deleted 30 days after they expire. Email records: 180 days. Error log: 180 days. Delivery records: payload removed after 7 days, failed rows deleted after 30 days, delivery failure records after 180 days. Data export archives: the download link expires 7 days after the export is ready.
When you close your account: we schedule deletion for 30 days after your subscription ends. On that date a job deletes your rows across the database, deletes the derived files we hold on disk for you, and revokes the connector connections we hold. Your tenant record itself is marked deleted rather than removed, so that we keep a record that the account existed and was purged.
Billing records sit with Stripe and are kept for six years, as UK tax law requires.
Cookies
The echoUX application sets one cookie, echoux_app_session. It exists so that you stay signed in. It is HTTP only, so page scripts cannot read it, it is marked secure so it only travels over HTTPS, and it lasts 30 days. The application sets no analytics, advertising or tracking cookies.
Our marketing website at echoux.ai measures visits using Umami and the website platform’s built in analytics. Neither tool sets cookies or generates persistent identifiers, so no cookie consent banner is needed for either.
Your rights
If we hold personal data about you as the controller, which in practice means your account details, you can ask us to:
give you a copy of it,
correct it,
delete it,
restrict or object to how we use it,
give it to you in a portable form.
For the last one there is a button. Ask for a data export in the app and you get a ZIP holding your artefacts, your raw feedback within the retention window, your subscription and email records, your delivery log and your configuration. Connector access tokens are deliberately excluded and webhook tokens are removed.
Email hello@echoux.ai for anything else. We will reply within one month.
You can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first, but you do not have to.
The gap we are not hiding
If your feedback was collected by one of our customers, we cannot delete just your part of it.
echoUX can delete a whole customer account, and it deletes raw feedback on a rolling schedule. It has no way, today, for an individual person to say “delete everything about me” and have that carried out for that person alone. The product does not have that path built.
If you are a person whose feedback ended up in echoUX and you want it removed, contact the company you gave the feedback to. They are the controller. They can ask us to delete specific feedback, or delete their whole account, and we will carry that out. Our contact address is above if you cannot reach them and need to know who we are.
If you are a customer of echoUX and a data subject comes to you with an erasure request, email us. We will do it by hand. There is no self service route for it and we are not going to pretend otherwise.
Security
What we do:
Sign in is by one time email link. There are no passwords to steal, and the link is stored hashed.
Session tokens are stored hashed. Sessions can be revoked immediately.
OAuth access tokens for your connected tools are held in a connection layer and are never included in a data export.
Each customer’s data is separated by tenant and topic identifiers applied in the application and enforced in the database.
Traffic between your browser and echoUX uses HTTPS, and the session cookie is marked secure in production.
What we do not have, stated plainly because you will ask eventually:
No SOC 2, no ISO 27001, no independent penetration test.
No multi factor authentication.
No application level encryption of the feedback content we store, beyond the encryption our hosting provider applies to its disks.
No customer facing log of who inside echoUX accessed what.
echoUX is run by one person. If you are buying it into an environment that needs the items in the second list, it is not ready for you yet, and we would rather tell you now than at renewal.
Changes to this notice
If we change how we handle personal data, we change this notice and date it. If the change is significant we will email account holders. We will not retroactively make this notice describe something the code does not do.