Privacy

Who we are

EchoLogic is provided by Harborly Technologies, Inc., doing business as EchoLogic, a California corporation. For anything about personal data, write to privacy@echo-logic.ai. We have not appointed a representative in the European Union or the United Kingdom; if we do, this page will name them.

EchoLogic provides a continuity layer for team decisions, sold to organizations by the seat. We wear two hats, and this page says which hat each section is about:

• Your content — we are a processor. Whiteboards, entries, canvases, notes, transcripts, files and the people named in them belong to the organization that set up the workspace. That organization is the controller (in US state-law terms, the business) and decides why it is processed. We process it only to run the service on its instructions, under our Terms and the Data Processing Addendum available from privacy@echo-logic.ai. If you have a question about content in a workspace, your organization is the right first call; we will help it answer you.
• Everything else — we are the controller. Your account and sign-in, billing, our own activity and audit logs, bug reports and emails you send us, and visits to this website. For that data the rest of this page explains our purposes, our legal bases and your rights against us directly.

What we collect

Account data

An email address, the name you choose to show your team (optional), and the organization and department you belong to. We do not ask for a phone number or a job title. Passwords are handled by Supabase Auth and stored only as hashes there; we never see them.

Content you create

Whiteboards, entries, canvases, notes, meeting transcripts you upload, and files you attach. A note you speak is kept as its text, the same as one you type; the recording itself is not stored. This is the substance of the product: the record exists because you wrote it.

Billing data

Your subscription status and how many seats your organization holds. Card details never reach our servers — checkout happens on Stripe and we store only the identifiers Stripe gives back.

Operational logs

Ordinary server logs, an audit trail of our own administrative actions, and your organization’s activity log, which its owners and admins can read and download. Server errors are recorded with the page they happened on and your account identifier, but not your email address, IP address, cookies or what you typed.

Agreeing to our terms

When an owner or admin agrees to our Terms for their organization — by starting a trial, or with the button we show after the Terms change — we record who agreed, for which organization, which version of the Terms and of this page they were shown, when, and the IP address and browser identification string the request came from. It is our evidence of the agreement, and nothing else uses it. When we email owners and admins a notice we owe them (a change to these pages, a price change, a security incident), we record that we sent it to their address.

Support and bug reports

What you write to privacy@, security@ or sales@, and bug reports you send from inside the app, which carry your description, the page you were on and your browser’s identification string.

Booking a demo

If you book a demo on our demo page, Google Calendar’s booking form asks for your first and last name, email address, company and role, and you pick a time. Google takes the booking and sends the invitation and the Google Meet link; we receive it in our calendar. The booking calendar is Google’s own page, and it loads only when you choose to see the available times.

Page visits

We count visits to our pages with Vercel Web Analytics, so we can tell which pages help people and which do not. It sets no cookies and does not identify you. Before a visit is sent, its address is cut down: the part after a question mark is removed (except, on our public pages, the campaign tags such as utm_source that we add to links we post ourselves, so we can tell which post brought a visit), and invite links, share links, unsubscribe links and whiteboard or canvas identifiers are replaced with a placeholder. We also count two steps of signing up — starting checkout and returning from it — how far people get through the guided tour, how many people view the example whiteboard and click on from it, and which buttons at the foot of our guides are clicked, as totals, not per person.

In the categories California law uses, the personal information we collect as a controller is: identifiers (email address, account identifier, and the IP address recorded when you agree to our Terms), customer records (display name, organization), commercial information (subscription and seat history), internet activity (server logs, page-visit counts, the pages a bug report or error came from), and professional information only to the extent your organization and department say something about your work, or the company and role you give when you book a demo. We collect it from you, from the organization that invites you, and from the systems that run the service. We do not collect sensitive personal information as a controller, and we do not ask you to put any into the product.

Why we use it, and on what basis

For data we control, each use has a purpose and — for people in the European Economic Area, the United Kingdom and Switzerland — a legal basis under Article 6 of the GDPR:

We do not send marketing email lists today. If we start, we will only email people who have asked for it or who are existing customers, every such email will have an unsubscribe link, and this page will say so. We do not use your content, account or usage data to build profiles for advertising.

Who else processes it

Nine sub-processors. Five of them handle the content you write; the rest see far less, as the last column says. Each is bound by a written data-processing agreement with us, and the service itself runs in the United States; the country in each row is where that company is based:

Extraction is how the Continuity Index is built, so text you capture and transcripts you upload are sent to those model providers to be turned into structured events. Two things reach OpenAI before you have saved anything: when you pause while writing in the Scratchpad, the draft is sent so Echo can say what it is close to, and when you speak a note, your voice is streamed to OpenAI while you talk so the words can appear on screen, and the recording is sent again when you stop to be written down properly. When you finish speaking a note, its text — with the one earlier record Echo found related to it, if any — is sent to Anthropic so Echo can ask you one question about it; you can turn that off under the question or on your Account page. Neither the draft nor the audio is stored by us. The model providers act as processors and do not train on any of it; under their business terms each may hold what it received for up to 30 days to detect abuse, then deletes it. If that is a problem for your organization, tell us before you start — it is not something we can switch off per-account today.

We may also disclose personal data to professional advisers, to a buyer or successor if the business is sold (we would tell account Executives first), and where the law requires it. We will tell your organization about a legal demand for its content unless we are legally prevented from doing so.

Automated processing

The AI extraction reads what your team wrote and proposes decisions, risks and questions, each shown with the exact words it came from and correctable by the people on the whiteboard. It does not make any decision about you with legal or similarly significant effects, and we do not use it to evaluate individuals. The one record about people that the product keeps on its own is “who touched an item”, described under retention below, and it is visible to the person it is about.

What we do not do

• We do not sell your personal information, and we do not share it for cross-context behavioral advertising, in the sense those words have under California law — and have not done so in the preceding twelve months. Because there is nothing to opt out of, we do not show a “Do Not Sell or Share” link. If your browser sends a Global Privacy Control signal, nothing changes, because we were not selling or sharing to begin with.
• We do not train our own models on your content, and our model providers may not train on it either.
• We do not use third-party advertising or tracking cookies, and we do not respond to browser “Do Not Track” signals, because we track nothing they would switch off.
• We do not read your whiteboards. Support access requires your explicit consent, granted from your account settings and revocable there, and every such session is recorded in the audit trail and in your organization’s activity log.

Cookies and browser storage

The app sets only cookies it needs to work, so there is no cookie banner to click through:

• Sign-in session cookies, set by Supabase Auth when you sign in and refreshed automatically. Without them you cannot stay signed in. They last for your session and are cleared when you sign out.
• hb_anon_id, a random identifier set when you open a Scratchpad session so that a session can be found again. It carries no personal data, is not readable by scripts, and expires after one year.
• Two cookies that exist only in our own staff’s browsers: one that marks a consented support-access session and one that remembers where a staff member was before opening the demo workspace. Neither is ever set for a customer.

We also keep a few conveniences in your browser’s own storage and never send them anywhere: whether you collapsed the sidebar, the last few places you opened from the command palette, and a one-session flag so a trial-started count is not sent twice. Vercel Web Analytics sets no cookies and uses no persistent identifier.

On our demo page, the booking calendar is Google’s own page shown inside ours, and Google may set its own cookies there under Google’s privacy policy. It loads only when you choose to see the available times; until then nothing of Google’s is loaded.

Who can see what

Content is scoped to your organization and, inside it, to departments. Nothing crosses that boundary unless someone in your organization explicitly shares it. An Executive role sees across departments; a member sees their own, plus whatever has been shared with them. A whiteboard turned into a public link is exactly that — public to anyone holding the link, until it expires or is turned off. A link can be set to expire after 7, 30 or 90 days, and one button on your Account page turns off every link you have. More on how this is enforced is on the security page.

How long we keep it

Content lives as long as your organization does. When you delete a whiteboard or a file it goes to your Trash: hidden from everyone straight away, and restorable by you for 30 days. After that it is deleted for good. A deleted whiteboard can still appear in a daily database backup for up to seven days after that, after which that backup is gone. Uploaded files are not kept in those backups at all, so once a file leaves the Trash the only copy is gone.

Everything else has a limit, and a daily job deletes what has passed it:

• Your organization’s activity log: one year. You can download it as a spreadsheet at any time from the Company page.
• Records of EchoLogic staff actions, including any support access to your workspace: two years. These exist so we can account for what we did.
• Notifications: 90 days. They only point at something — what they point at stays.
• Error logs: 90 days. We use these to fix faults.
• Saved AI answers: 7 days. When you ask a canvas the same question over the same items, we reuse the earlier answer instead of running it again. Changing any item starts afresh.
• Who touched an item: 90 days. When somebody on your team opens, comments on, settles or unblocks an open question or a risk, we record that they did and when, so a whiteboard can say “Dana commented yesterday” instead of guessing. Anyone who can read the whiteboard can see it, including the people it is about. It is never sold, never used for advertising, and never leaves EchoLogic.
• AI usage records: 13 months. How much AI each request used and what it cost, so we can keep costs in check. They hold counts and amounts, never what you wrote.
• Bug reports you send us: one year.
• Records of agreeing to our Terms, and of notices we sent you: as long as your account exists. They are deleted with the account or the organization they belong to.
• Chats you never saved to a whiteboard: 90 days. A chat saved to a whiteboard is content, and stays with the whiteboard.
• Demo bookings: one year after the call. They live in our Google Calendar; we delete them after that, or sooner if you ask.
• Payment records: seven years, because tax and accounting law requires it. Stripe holds them.
• Email you send us: as long as the matter is open, and then as long as we need it to show what we did.

When an owner closes your organization’s account, everyone has 30 days to download their data, and an owner can change their mind during that time. After 30 days we permanently delete the organization, every whiteboard shared with it or filed in its departments, and the whiteboards and accounts of members who belong to no other organization. We keep only what we must for tax and accounting, which Stripe holds.

You can also delete your own account from your Account page, on the same terms: 30 days to download your data and change your mind, then your account, every whiteboard you own and your sign-in are permanently deleted.

Where it goes

We are a US company and the service runs in the United States, so if you are in the EEA, the UK or Switzerland your personal data is transferred there. For data we process on an organization’s behalf, our Data Processing Addendum incorporates the European Commission’s Standard Contractual Clauses (Decision 2021/914, Module Two and, where the organization is itself a processor, Module Three), the UK Information Commissioner’s Addendum to them, and the Swiss adaptations. For data we control, we rely on the same clauses with our sub-processors. Several of our sub-processors are also certified under the EU-US Data Privacy Framework (Vercel, Stripe, Resend, Sentry, GitHub and Google state that they are); EchoLogic itself is not. You can ask privacy@ for a copy of the clauses.

Your rights

You can download everything on your own whiteboards from your Account page, and your organization’s owners and admins can download its data from the Company page. You can change your display name and delete your account from the Account page. For anything else, write to privacy@echo-logic.ai. If your request is about content inside a workspace, we will pass it to your organization’s Executive, who controls that data, and help them answer it.

If you are in the EEA, the UK or Switzerland, you have the right to access your personal data and to receive a copy, to have it corrected or erased, to restrict or object to processing we base on legitimate interests, to data portability for data processed under a contract or consent, and to withdraw any consent you have given. You also have the right to complain to a supervisory authority — in the UK the Information Commissioner’s Office, in the EU the authority of the country where you live or work — though we would rather you wrote to us first so we can put it right.

If you are a California resident, the CCPA gives you the right to know what personal information we collect, use and disclose about you, to delete it, to correct it, to opt out of its sale or sharing (we do neither), to limit the use of sensitive personal information (we collect none), and not to be discriminated against for exercising any of these. Residents of other US states with privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others) have broadly similar rights, including a right to appeal our decision by replying to it. The data we hold about you as an employee or contractor of a customer organization is covered by our contract with that organization, which is the business under those laws.

How requests work. Email privacy@echo-logic.ai; because we operate only online and have a direct relationship with the people whose data we hold, email is our designated method. We verify a request by matching it to the email address on the account, and may ask you to confirm from that address or from inside the app. An authorized agent may submit a request on your behalf with your signed permission; we may still confirm it with you directly. We answer within one month under the GDPR and 45 days under US state laws, and tell you if we need longer. We do not charge for requests unless they are manifestly unfounded or excessive. We will not treat you differently for making one.

Children

EchoLogic is a workplace tool for organizations. It is not directed to children, and we do not knowingly collect personal data from anyone under 16 (or the higher age that applies where you live). If you think a child has an account, write to privacy@ and we will remove it.

Security

Data is encrypted in transit and at rest, access is scoped to your organization in the data layer, staff cannot open a workspace without your consent, and our admin area needs a second factor. The security page sets out what is built, and just as plainly what is not yet. If we learn of a breach affecting your personal data, we will tell the organizations concerned without undue delay, and individuals where the law requires it.

Changes

If we change how any of this works we will update the date at the top, and material changes will reach account Executives by email rather than appearing quietly here. The current version always lives at this address, and we review it at least once a year.