Privacy Policy
This policy explains what personal data Echoteka processes, why, for how long and who else sees it. We collect as little as the service needs. We do not sell personal data and do not use it for advertising.
1. What we process and why
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Email, password hash; your Google account email if you sign in with Google | Your account | Contract, Art. 6(1)(b) | Until you close the account |
| Uploaded audio for analysis | Measuring the track | Contract, Art. 6(1)(b) | Processed and deleted; not kept after the analysis |
| Uploaded audio and masters | Mastering and your download library | Contract, Art. 6(1)(b) | Free accounts: 1 day after the master; accounts that bought credits: 30 days |
| Track measurements and job history (loudness, peaks, settings, dates) | Showing your history and results | Contract, Art. 6(1)(b) | Until you close the account |
| Credit balance and purchase records received from Paddle | Selling credits, accounting | Contract; legal obligation, Art. 6(1)(c) | As long as Bulgarian accounting law requires (up to 10 years) |
| A track you choose to share with a rating ("send the original to help us fix it") | Investigating what went wrong and improving the processing | Consent, Art. 6(1)(a) | 30 days |
| IP address, browser type, request logs | Security, abuse prevention, fair use of free masters | Legitimate interest, Art. 6(1)(f) | Logs: up to 30 days. Counters of failed sign-ins keep only a salted hash of the IP address and email |
| Analytics cookies and usage events | Understanding how the site is used | Consent, Art. 6(1)(a) | 14 months; only if you accept analytics |
Temporary files created while a track is processed are deleted automatically. We never use your audio to train machine-learning models.
2. Where the data is kept
On our servers at Hetzner Online GmbH in data centres in the European Union. Encrypted backups of the database are kept in the EU for 10 days.
3. Who else receives data
- Hetzner Online GmbH (Germany) — hosting, backups and our own mail server that delivers account emails (sign-up confirmation, password reset, service notices), as our processor.
- Google Ireland Limited (Gmail) — while our own mail server cannot yet deliver directly, it passes account emails addressed to other mail providers to this service for delivery, as our processor. It receives the recipient address and the email itself.
- Paddle.com Market Limited (United Kingdom) — sells credits to you as Merchant of Record and processes your payment as an independent controller under its own privacy policy. We receive your email, country, what you bought and the payment status — never your card details. The UK has an EU adequacy decision.
- Google Ireland Limited — only if you choose to sign in with Google (we receive your email and name), and Google Analytics only if you accept analytics cookies. Google may transfer data to the United States under the EU–US Data Privacy Framework.
AI suggestions. Preset suggestions and the text of the mastering report are generated by a third-party language model from numeric measurements of the track only — loudness, peaks, dynamic range, stereo width and spectrum balance. No audio, file names, account details or other personal data are sent to it.
4. Your rights
You may ask for a copy of your data, its correction, deletion or export, object to processing based on legitimate interest, and withdraw consent at any time — withdrawing does not affect processing done before. Write to support@echoteka.ai from the email of your account; we answer within one month. Closing your account deletes the account, its history and stored audio within 30 days, except purchase records the law requires us to keep; backups roll over within 10 more days.
You may complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the data protection authority of your country.
5. Cookies and browser storage
Strictly necessary (no consent needed): your sign-in token, theme choice and a marker of a purchase in progress, kept in your browser's local storage so the site works. Analytics (only after you accept): Google Analytics cookies _ga and _ga_*, kept for up to 14 months. You can change your choice at any time with the "Cookie settings" link at the bottom of the home page, the app and this policy.
6. Children
Echoteka is not intended for anyone under 16, and we do not knowingly create accounts for them.
7. Changes
We will announce material changes in the app or by email before they take effect.