Privacy Policy

Echooo provides an AI-native operating system for influencer marketing that connects brands and agencies (“Brand Customers”) with content creators (“Creator Customers”). We also process data about prospective creators who have not yet signed up with us directly (“Potential Creators”), sourced through our creator data partner as described in Section 3.

For Brand Customers and Creator Customers who sign up directly with us, we act as the data controller. Where we process data on behalf of a Brand Customer about a Potential Creator, or on behalf of a Creator Customer, the Brand Customer or Creator Customer (as applicable) is the data controller, and our relationship with them is governed by a separate data processing agreement.

Depending on the Services we provide and how you interact with us, we may collect, use, store, and transfer the following categories of personal data:

If you sign in to our Services using a third-party account, such as Google, we may receive your name, email address, and profile picture from that provider.

You are not required to provide us with personal data. However, if you do not share certain data with us, we may not be able to provide you with our Services.

Creator data. We source and verify creator profile and social media data through InsightIQ, a third-party creator data and identity platform. InsightIQ provides us with information on creator profiles across Instagram, TikTok, and YouTube, including audience demographics and engagement metrics, to help Brand Customers identify suitable creators for their campaigns. We do not independently scrape or access these platforms’ APIs directly for this purpose.

Outreach. Where our Services facilitate outreach to creators via WhatsApp, messages are sent through Meta’s WhatsApp Business Platform (Cloud API). Your interactions through this channel are also subject to Meta’s own terms and privacy practices.

AI apps you connect. If you connect an AI app to your Echooo account, we share data with that app’s provider at your direction, as described in Section 6.

Shopify. If a Brand Customer connects its Shopify store through the Echooo Affiliate app, we receive order and storefront data about that store’s customers from Shopify, as described in Section 7.

This Policy does not apply to the privacy practices of third parties we do not own or control, including InsightIQ, Meta, Shopify, the providers of AI apps you connect, or any other third-party websites, services, or platforms that our Services may link to or integrate with. We encourage you to review the privacy policies of any third-party service you interact with through our Services.

We use personal data for the following purposes:

• Creator discovery. We use creator profile and social media data, including data on Potential Creators sourced via InsightIQ, to help Brand Customers identify and evaluate creators for campaigns. In some jurisdictions, this may be considered a “sale” or “share” of personal data under applicable law — see Section 15.
• Campaign management. Facilitating outreach, negotiation, contracting, content review, and reporting between Brand Customers and Creator Customers.
• Account and customer support. Creating and managing your account, providing customer support, and processing payments.
• Service improvement. Analyzing usage of our Services to fix issues, improve features, and develop new functionality.
• Communications. Sending service-related and, where permitted, promotional communications.
• Fraud detection and prevention. Monitoring use of the Services to detect fraud, abuse, and violations of our Terms of Service.
• Legal compliance. Meeting our legal, tax, and regulatory obligations.

Our Services use autonomous AI agents to support campaign execution, including a Discovery Agent (searching and shortlisting creators), a Partnership Agent (outreach and rate negotiation), a Content Agent (onboarding, briefs, and contract tracking), and an Analytics Agent (performance tracking and sentiment analysis).

These agents operate under human supervision. Brand Customers and our team can review, override, or reject any shortlist, message, negotiated term, or report generated by our AI agents before it takes effect. We do not use these agents to make decisions that produce legal or similarly significant effects on an individual without the opportunity for human review.

Our AI agents may analyze publicly available creator content (such as posts, captions, and video) and audience data to improve search results, recommendations, and creator discovery. This processing is limited to content and performance analysis — it does not involve biometric identification. We do not use personal data processed through our Services to train our own AI models, and we do not permit our service providers to use such data to train or improve their models.

Brand Customers can connect their Echooo account to an AI app of their choice, such as Claude, through our connector (a remote Model Context Protocol server, described at echooo.ai/ai-connector). The connector is optional and off by default. It works only after you sign in on Echooo and approve a specific AI app, only with your own account, and only within the permissions you choose. Your role and permissions in your Echooo workspace continue to apply. This section explains how personal data is handled when you use it, and supplements the rest of this Policy.

6.1 Who is responsible for what

The AI app you connect, and the company that provides it, are chosen by you. That provider is an independent third party: it is not our service provider and does not process data on our behalf. Data we return to the AI app is disclosed to it at your direction, and its own terms and privacy policy govern how it processes, stores and uses that data. For personal data in your workspace, including data about creators, the roles described in Section 1 do not change. If you are a Brand Customer, you are responsible for ensuring that you may share that data with the AI app you choose.

6.2 Information we collect through the connector

• Requests and their inputs. The requests the AI app makes on your behalf and the information they contain, for example a campaign or creator identifier, search filters, or text you ask it to save or send, such as a campaign name, a note or the wording of an e-mail. Information saved this way becomes part of your workspace, exactly as if you had entered it in the dashboard.
• Connection details. The name and registration details of the AI app, the permissions you granted, and when the connection was created, used and ended.
• Technical data. The IP address and user agent of requests to the connector and to our sign-in and permission screens.

We do not receive or collect your conversations with the AI app, any prompt or file it does not send to our connector, or its memory or chat history.

6.3 How we use it

We use this information to carry out the actions you request; to enforce your permissions, plan credits and usage limits; to keep the Services and your account secure and to detect fraud and abuse; to fix problems; and to meet our legal obligations. We rely on the performance of our contract with you and, for security and abuse prevention, on our legitimate interests. We do not use it for advertising.

6.4 What we share with the AI app

We return the results of each request: only information you can already see in the Echooo dashboard, and only what the permissions you granted allow. Depending on your request, results may include personal data such as creator names, handles, public profile and performance data, campaign and outreach records, a creator’s e-mail address when you prepare an e-mail to them, and, if you allow “Manage payments,” payout amounts and the last four digits of the creator’s bank account. We never share your password or your Echooo access keys.

6.5 Actions that reach other people

With the “Contact creators and share” permission, the AI app can, on your instruction, send the e-mails and terms you approved to creators and create share links for your clients; recipients receive them as they would if you sent them from the dashboard. With the “Manage payments” permission, a creator is notified when you record that you have paid them. Echooo never moves money. An e-mail, terms or payment record can be sent or recorded only after the AI app has retrieved a preview of exactly that content, and we instruct the AI app to obtain your approval of it first.

6.6 Activity log and retention

We keep an activity log of each connection: the app, the tool used, the time, the outcome, identifiers of any records changed, and the IP address and user agent of the request. The log does not contain the content of your conversations, of tool results, or of messages sent. It is kept for 180 days and then deleted automatically. Expired access keys are deleted 7 days after they expire. Information you save to your workspace through the connector is kept as described in Section 11.

6.7 Security

You sign in on Echooo, never in the AI app, using the OAuth 2.1 standard with PKCE. The AI app receives an access key that works only with our connector and only within the permissions you chose. Keys expire after one hour and can be renewed for up to 30 days; we store them only in hashed form. All traffic is encrypted in transit. See also Section 12.

6.8 Your choices

• Permissions. Viewing is always included; making changes, archiving, contacting creators and managing payments are separate permissions you may leave off.
• Disconnecting. You can see and end any connection at any time in the Echooo dashboard under Settings → Connected apps; access stops within a minute. Connections also end when you reset your password or your account is deactivated or deleted.
• Data already in the AI app. Ending a connection does not delete data the AI app already received. Use that provider’s own controls to delete it.
• Your rights. You may exercise the rights described in Section 14, including a request for a copy of your connector activity log, by contacting us as set out in Section 17.

6.9 No model training

We do not use information processed through the connector to train AI models. Whether the provider of the AI app you connect uses your data to train its models is governed by your settings and agreement with that provider.

6.10 International transfers

The AI app provider may process data in countries other than your own, under its own terms. Our own processing follows Section 10.

Brand Customers that sell on Shopify can install the Echooo Affiliate app from the Shopify App Store and connect their store to Echooo. Echooo then attributes the store’s orders to the creators whose discount codes or referral links were used, calculates each creator’s commission, and reports creator-led sales to the Brand Customer. The app is optional. It works only after the store owner installs it and approves the requested permissions on Shopify. This section explains how we handle data about the store’s customers and visitors (“Shopify Customers”), and supplements the rest of this Policy.

7.1 Who is responsible for what

The Brand Customer that owns the store is the controller of its Shopify Customers’ personal data. Echooo processes that data on the Brand Customer’s behalf, as its processor or service provider, only to provide the Services described in this section and under the Brand Customer’s instructions. Shopify Customers who want to exercise a privacy right should contact the store they bought from; we assist the store in responding.

7.2 Information we receive

• Order data. Order number and identifier, products, quantities, prices, discounts and discount codes used, totals and currency, payment, fulfilment and delivery status, and refunds and cancellations.
• Customer contact data on orders. The customer’s first and last name and e-mail address. We do not request Shopify Customers’ phone numbers or postal addresses.
• Storefront events. Where the Brand Customer turns on Echooo’s web pixel, the store sends us page views, product views, add-to-cart and checkout events together with the creator referral code, a random session identifier and the browser’s user agent. These records do not contain names, e-mail addresses or IP addresses. The pixel runs within Shopify’s customer privacy settings and follows the consent choices visitors make on the store.
• Creator link clicks. When someone opens a creator’s link, we record the click with a one-way hash of the IP address and user agent (never the IP address itself), the referring page and the landing page, and set a first-party cookie that remembers the referral code for 30 days.
• Store details. The store’s domain and name, the permissions granted, and an access key that Shopify issues to the app.

7.3 How we use it

We use this information only to attribute orders to creators, calculate, hold and reverse commissions, show the Brand Customer creator-wise sales and traffic reports, show each creator the orders attributed to their own codes and links so they can verify their commission, and detect fraud such as a creator buying with their own code. We do not use Shopify Customers’ data for marketing or advertising, we do not sell it, and we do not use it to train AI models.

7.4 Who can see it

The Brand Customer’s authorized users can see the store’s attributed orders in the Echooo dashboard. A creator can see only the orders attributed to their own codes and links, including the products, amounts and the customer’s name. Creators never see the customer’s e-mail address. We do not share Shopify Customers’ data with anyone else, except our service providers that host and operate the Services and where required by law.

7.5 Security

All data is encrypted in transit and at rest. The store’s access key is stored in encrypted form, every message Shopify sends us is verified with Shopify’s signature before it is processed, and access to Shopify Customers’ data is limited to staff who need it. Test and production data are kept in separate environments. See also Section 12.

7.6 Retention and deletion

• While connected. We keep order data while the store is connected, so that commissions and reports stay accurate.
• After uninstalling. When the store uninstalls the app, the connection ends and we stop receiving data. When Shopify then asks us to erase the store’s data, usually 48 hours later, we erase Shopify Customers’ names, e-mail addresses and any other contact details from the store’s orders and delete the store’s access key.
• Customer requests. When a Shopify Customer asks the store to delete their data, Shopify tells us and we erase that customer’s contact details from the store’s orders. When a Shopify Customer asks the store for a copy of their data, we help the store provide what we hold.
• Records we keep. Order amounts, discount codes and commission records, without the customer’s contact details, are kept as long as needed for creator payouts, accounting and tax, as described in Section 11.

7.7 Your choices

A Brand Customer can disconnect its store at any time by uninstalling the Echooo Affiliate app in the Shopify admin, and can turn off the web pixel from the Echooo dashboard. Shopify’s own handling of data is governed by Shopify’s privacy policy.

We may send service-related and promotional communications via email, WhatsApp, or in-platform messages. To stop receiving WhatsApp messages, reply “STOP” to the conversation. To unsubscribe from marketing emails, use the unsubscribe link included in the email. You cannot opt out of communications that are required as part of your use of our Services, such as notices about changes to this Policy.

Our Services use cookies and similar technologies to operate core features, remember your preferences, and understand how our Services are used. This includes essential cookies (required for the Services to function), functionality cookies (remembering preferences), and analytics cookies (understanding aggregate usage). You can control or disable cookies through your browser settings; doing so may affect how our Services function.

Echooo operates from Pakistan and the United Arab Emirates and works with Brand Customers and Creator Customers globally. Your personal data may be transferred to, stored, and processed in countries other than your own, including Pakistan and the UAE. Where required by applicable law, we rely on Standard Contractual Clauses, an applicable adequacy decision, or another valid data transfer mechanism to ensure your data receives an adequate level of protection wherever it is processed.

We retain personal data only as long as necessary to provide our Services and fulfill the purposes described in this Policy. When determining specific retention periods, we consider the type of data, the nature of our relationship with you, and any legal or regulatory retention requirements. For example:

• Account data: retained while your account is active, and for a limited period after account closure to resolve disputes and enforce our agreements.
• WhatsApp and messaging data: message content and the associated contact details exchanged through Meta’s WhatsApp Business Platform are retained for 180 days, after which they are automatically purged from our systems.
• AI connector activity log: retained for 180 days, after which it is automatically deleted (see Section 6.6).
• Shopify customer data: retained while the store is connected; customers’ names and e-mail addresses are erased after the store uninstalls the app or on request, as described in Section 7.6.
• Invoicing and financial data: retained as required by applicable tax and accounting law.
• Fraud prevention: following account deletion, we may retain a minimal record (such as a hashed email address) for a limited period to prevent repeated sign-ups or misuse of our Services.

You may request deletion of your account at any time by contacting us. Upon deletion, we delete or irreversibly anonymize your personal data across our active systems, revoke access tokens, and cancel any active subscriptions, except where retention is required as described above.

We maintain reasonable technical and organizational safeguards designed to protect the personal data we process. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Our Services are intended for users who are 18 or older, or who are at least 13 years old with verifiable parental or guardian consent. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us using the details in Section 17 so we can investigate and delete the information as appropriate.

Depending on where you live, you may have some or all of the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Deletion: Request that we delete your personal data, subject to legal retention requirements described in Section 11. Our Data Deletion Instructions set out how to make this request.
• Objection / restriction: Object to or request that we limit certain processing, including for direct marketing.
• Withdraw consent: Where processing is based on your consent, withdraw it at any time.
• Complaint: If you are in the European Economic Area, you may lodge a complaint with your local data protection authority (see the European Data Protection Board’s member list). If you are in the UK, you may contact the Information Commissioner’s Office. We would appreciate the opportunity to address your concerns directly before you contact a regulator.

To exercise any of these rights, contact us using the details in Section 17. We may need to verify your identity before responding to your request.

Because we source Potential Creator data through InsightIQ to help Brand Customers identify creators, this may be considered a “sale” or “share” of personal data under the California Consumer Privacy Act (CCPA) and similar U.S. state laws, even though no money changes hands. California residents have the right to opt out of this processing and to non-discrimination for exercising their privacy rights. To opt out, contact us using the details in Section 17. We do not knowingly sell or share the personal data of individuals under 16.

We may update this Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If a change materially affects your rights, we will provide additional notice, such as an email or a prominent notice on our Services.

For questions about this Policy or to exercise a privacy right, contact us at:

Klout Technologies (Private) Limited
Email: muzakir@echooo.ai

Pakistan office: 4115 Delta 4, NASTP, Cantt, Lahore, Pakistan
Dubai office: Creators HQ, Jumeirah Emirates Towers Boulevard, Dubai, UAE