1. Processing of personal data on EchoYou

In this privacy policy, you can read about EchoYou ApS’ (hereafter “EchoYou”, “we”, “us” or “our”) processing of your personal data in relation to your use of EchoYou, including associated services, products, and features, the EchoYou website and mobile/tablet applications. On EchoYou you can connect your email account to AI-powered assistant that helps you manage your inbox by summarizing incoming emails, generating reply drafts, detecting intent, organizing messages, and suggesting calendar events based on email content, with all actions performed only upon your request and control.

Read more about this in the Terms and Conditions.
‍
EchoYou, as the legal entity, is the data controller responsible for processing your personal data related to your use of the EchoYou website.
‍
Our contact information is:
‍
EchoYou ApS
CVR.no.: 45967794
Strandgade 14, 1. th
1401 Copenhagen
Denmark

E-mail: ar@echoyou.co

You can read more about how EchoYou, as a data controller, processes your personal data in section 2 below.

2. Regarding the content of services from external service providers

When you use EchoYou, certain services are provided by external service providers. These external services providers act as independent data controllers for their own processing of your personal data and the content of such services. For more information on how they process your personal data when using their services, we refer to their privacy policies and terms of use.

Purpose

#1 – User creation

We process your personal data for the purpose of creating your user profile on EchoYou for you to be able to use the platform.

#2 – Updating contact information

We process your personal data to be able to update your contact information.

#3 – Your continuous use of EchoYou

We process your personal data for the administration of your continuous use of EchoYou.

Administration of your continuous use includes the processing of personal data when you login to EchoYou, for security reasons, including verification of your identity by the login on EchoYou, as well as the processing of personal data in relation to the maintenance of EchoYou.

Additionally, we anonymise your personal data for the purpose of creating statistics and analysis of the use of EchoYou.

#4 – Support

If you contact our customer support, we process your personal data to support you in relation to your use of EchoYou.

#5 – Use of EchoYou's website

When you visit our website, we collect personal data about your user behaviour by using cookies.

The purpose of the processing of the personal data is to provide you with access to the website and optimise and develop the user experience on our website.

You can read more about our use of cookies in our cookie policy here.

#6 – Communication

We process your personal data in relation to our communication with you, e.g., by sending push messages, notifications, service messages, reminders, or messages regarding validation.

#7 – Newsletter and Contact form

We process your personal data to send you our newsletter if you have subscribed to receive news about EchoYou.

Categories of personal data

We process the following categories of personal data about you:

Ordinary personal data:

Name
Address
Consent to processing name and address (EchoYou)
Email address
Telephone number
Acceptance of Terms and Conditions
Public user ID
EchoYou user ID
IP addresses
Accesstoken
Notification settings
Device ID
Device type
Access rights
UUID
Application (web/app)
Operating system (iOS/android)
Cookie consent
Visitor ID
IP address
Preference settings, e.g. language
Browser type and version
Operating system (iOS/android)

Sources

We collect your personal data from the following sources:

Directly from you
Public entities, registries, and/or advisors
External service providers

Legal basis for the processing

We process your personal data based on the following legal bases:

Ordinary personal data:

Consent: Our processing of your name and address is based on your consent, pursuant to GDPR Article 6.1.a to be able to identify you as a user if you have consented to EchoYou.

‍Contract: Except for personal data listed below in relation to legitimate interest, we process your ordinary personal data for the purpose of fulfilling an agreement to which you are a party, cf. GDPR Article 6.1.b.

‍Legitimate interests: To pursue our legitimate interest, as described below, we process information about your notification settings and we retain your acceptance of the Terms and Conditions, as well as your consent to the processing of your national identification number and EchoYou based on GDPR Article 6.1.f.

We store your acceptance of the Terms and Conditions.

We process personal data regarding your notification settings to send you notifications.

Recipients

We may share your personal data with:

[insert]

Data retention

We will retain your personal data for as long as necessary for the purposes mentioned.

We will retain your personal data as long a user profile has been created on EchoYou and until 12 months from deactivation of the user profile.

We will retain documentation of your acceptance of the Terms and Conditions for 5 years after termination of your profile on EchoYou to document the legal basis for processing.

The retention period for personal data may in certain situations be shorter or longer, e.g., if the processing is necessary for the pursuit, exercise, or defence of a legal claim, or if necessary to comply with legal obligations of erasure or retention.

‍Specifically for private users of EchoYou:

‍We will retain documentation of your consent to the processing of your national identification number for 5 years after your user profile on EchoYou has been terminated.

We will retain your consent of the Terms and Conditions for 6 years after your user profile on EchoYou has been terminated.

We will retain your consent for EchoYou as long as you are signed up for EchoYou and we will erase your consent immediately after you withdraw it. The consent will remain in the application log for up to 12 months following the withdrawal.

Purpose

Categories of personal data

Sources

Legal basis for the processing

Recipients

Data retention

#1 – User creation

We process your personal data for the purpose of creating your user profile on EchoYou for you to be able to use the platform.

#2 – Updating contact information

We process your personal data to be able to update your contact information.

#3 – Your continuous use of EchoYou

#4 – Support

If you contact our customer support, we process your personal data to support you in relation to your use of EchoYou.

#5 – Use of EchoYou's website

#6 – Communication

We process your personal data in relation to our communication with you, e.g., by sending push messages, notifications, service messages, reminders, or messages regarding validation.

#7 – Newsletter and Contact form

We process your personal data to send you our newsletter if you have subscribed to receive news about EchoYou.

We process the following categories of personal data about you:

Ordinary personal data:

Name
Address
Consent to processing name and address (EchoYou)
Email address
Telephone number
Acceptance of Terms and Conditions
Public user ID
EchoYou user ID
IP addresses
Accesstoken
Notification settings
Device ID
Device type
Access rights
UUID
Application (web/app)
Operating system (iOS/android)
Cookie consent
Visitor ID
IP address
Preference settings, e.g. language
Browser type and version
Operating system (iOS/android)

We collect your personal data from the following sources:

Directly from you
Public entities, registries, and/or advisors
External service providers

We process your personal data based on the following legal bases:

Ordinary personal data:

We may share your personal data with:

Cloud infrastructure and hosting providers that operate the technical systems required to deliver the EchoYou service
Trusted AI processing providers like Microsoft Azure Open AI to process limited email content for generating summaries, reply suggestions, and insights. These providers act as data processors and are prohibited from using the data for any purpose other than providing services to EchoYou.
Limited data access with authorized EchoYou personnel only when explicitly required for debugging with user consent, or when necessary to comply with legal obligations.

3. Recipients outside EU/EEA

We may transfer personal data outside the EU/EEA for the purpose of providing the services and using external service providers.

4. Your rights

According to data protection regulation you have several rights in relation to our processing of your personal data. If you wish to exercise your rights, please contact us. You can find our contact information in Section 1 or contact our Data Protection Officer in Section 5. We will respond to your request without undue delay and no later than one month after receiving it. If we are unable to respond to your request within one month, we will notify you no later than one month after receiving your request.

You have the following rights in relation to our processing of your personal data:

Right to Access, Rectification, Erasure: You have the right to request access to, rectification, or erasure of your personal data
Restriction: You also have the right to obtain restriction of the processing of your personal data
Withdrawal of consent: If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Your withdrawal will not affect the lawfulness of the processing carried out before you withdrew your consent. You can withdraw your consent and make use of your rights as described below.rasure: You have the right to request access to, rectification, or erasure of your personal data
Data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format
Object: Furthermore, you have the right to object to our processing of your personal data as follows:
- If our processing of your personal data is based on article 6.1.f. (legitimate interests), see above regarding legal basis, you have the right to object to the processing of your personal data at any time, on grounds related to your particular situation
- o Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data about you for such marketing. You can withdraw your consent by contacting us by e-mail at Support@echoyou.co. By withdrawing your consent to the processing of your national identification number, your account will be deleted as a result. There may be conditions or limitations to these rights. For instance, it is not certain that you have the right of data portability in the specific case. This depends on the specific circumstances of the processing activities.
Complaint: You can always file a complaint with a data protection supervisory authority, such as the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby.

5. Data Protection Officer

If you have any questions regarding our processing of your personal data, you can contact our Data Protection Officer here:

E-mail: Data@echoyou.co

6. Use of Google Account Data

EchoYou only accesses Gmail data when the user actively uses the application and only for the purpose of providing user-facing features.

This access allows EchoYou to provide AI-powered email management features, including:

Analyzing incoming emails
Generating email summaries
Suggesting reply drafts
Suggesting calendar events based on email content
Displaying and organizing email threads within the EchoYou interface

EchoYou does not continuously monitor or scan user emails in the background beyond what is necessary to provide user-requested features.

Full email content, including message bodies, headers, and attachments, is not permanently stored by EchoYou. Instead, this data is retrieved from Gmail at request time through the Gmail API.

EchoYou stores only limited metadata necessary to support the application's functionality, such as:

Email thread identifiers
Sender information
Subject lines
Message timestamps
AI-generated summaries or suggested replies

7. AI Processing of Email Data

To provide intelligent features such as summaries, reply suggestions, and intent analysis, EchoYou processes certain email content using artificial intelligence services.

When these features are used, EchoYou may send limited email data including the subject line and message body to AI processing services hosted through Microsoft Azure OpenAI.

These services are used solely to generate summaries, suggested replies, and email insights for the user.

EchoYou ensures that any AI service provider used does not retain or use Google user data for model training, and all processing complies with enterprise-grade data protection standards.

8. Compliance with Google API Services User Data Policy

EchoYou’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

EchoYou only uses Google user data to provide and improve user-facing features within the EchoYou application.

EchoYou does not use Google user data for:

Advertising
Selling personal data
Building unrelated user profiles
Training generalized artificial intelligence models

Google user data is only accessed and processed to deliver the features requested by the user within the application.

9. Cookies and Similar Technologies

EchoYou uses limited cookies and similar technologies necessary for the operation and security of the application.

These cookies are used for purposes such as:

Maintaining user login sessions
Ensuring application security
Storing user preferences

EchoYou does not use cookies for advertising or marketing purposes.

10. Security of Personal Data

EchoYou implements technical and organizational security measures designed to protect personal data and Google account data from unauthorized access, alteration, disclosure, or destruction.

These security measures include:

Encrypted communication using HTTPS for all data in transit
Secure storage and management of OAuth authentication tokens
Automatic revocation of OAuth tokens when a user disconnects an email account or deletes their EchoYou account
Access control mechanisms that limit access to authorized personnel only
Secure session management using encrypted authentication cookies and server-side session validation
Sanitization of email content to prevent cross-site scripting (XSS) attacks
Protection of sensitive log data through hashing and context sanitization
Verification of incoming email authenticity through DKIM validation
Secure storage of authentication tokens on supported mobile platforms using encrypted system keychains

EchoYou regularly reviews and updates its security practices to ensure the protection of user data.

11. Third-Party Service Providers

EchoYou uses a limited number of trusted infrastructure and service providers in order to operate the platform.

These providers may process personal data only for the purpose of delivering the EchoYou service.

These providers include:

Cloudflare – infrastructure hosting, storage services, and application delivery
Microsoft Azure – AI processing services used to generate email summaries, reply suggestions, and message analysis

These providers process data solely on behalf of EchoYou and do not use the data for their own purposes.

EchoYou does not permanently store full email messages retrieved from Gmail. Email content such as message bodies, headers, and attachments is retrieved directly from Gmail when needed to perform requested features and is not stored in EchoYou’s primary databases.

Only limited metadata necessary to support application functionality may be stored, such as email thread identifiers, sender information, subject lines, timestamps, and AI-generated summaries or suggested replies.

12. Updates to the Privacy Policy

This privacy policy will be updated continuously. The privacy policy in force at any time can be found on our website at Echoyou.co. If substantial or material changes or amendments are made to the privacy policy, you will be notified accordingly or a transition period will be provided.

This privacy policy was last updated: January 2026