Privacy Policy
This policy explains what personal data Echoteka processes, why, for how long and who else sees it. We collect as little as the service needs. We do not sell personal data and do not use it for advertising.
1. What we process and why
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Email, password hash; your Google account email if you sign in with Google | Your account | Contract, Art. 6(1)(b) | Until you close the account |
| Uploaded audio for analysis | Measuring the track | Contract, Art. 6(1)(b) | Processed and deleted; not kept after the analysis |
| Uploaded audio and masters | Mastering and your download library | Contract, Art. 6(1)(b) | Without an account: about 1 hour after the master; free accounts: 1 day; accounts that bought credits: 30 days |
| Track clips: the stored copy of a built visualizer and AI clips | Your clip library and downloads; our team may watch clips to check generation quality | Contract, Art. 6(1)(b); quality review: legitimate interest, Art. 6(1)(f) | 30 days, then deleted automatically; immediately when you close the account |
| Track measurements and job history (loudness, peaks, settings, dates) | Showing your history and results | Contract, Art. 6(1)(b) | Until you close the account |
| Credit balance and purchase records received from Paddle | Selling credits, accounting | Contract; legal obligation, Art. 6(1)(c) | As long as Bulgarian accounting law requires (up to 10 years) |
| A track you choose to share with a rating ("send the original to help us fix it") | Investigating what went wrong and improving the processing | Consent, Art. 6(1)(a) | 30 days |
| Your Telegram user ID and language, if you link Telegram or use our bot @EchotekaAIBot | Sending your masters and job notices to Telegram, mastering inside the bot | Contract, Art. 6(1)(b) | Until you unlink Telegram (/unlink in the bot) or close the account |
| IP address, browser type, request logs | Security, abuse prevention, fair use of free masters | Legitimate interest, Art. 6(1)(f) | Logs: up to 30 days. Counters of failed sign-ins keep only a salted hash of the IP address and email |
| Analytics cookies and usage events | Understanding how the site is used | Opt-out in Cookie settings (on by default) | 2 years; deleted when you turn Analytics off |
To protect the free-master limits, the IP address is also turned into a pseudonymous 8-character code (a keyed hash) that we keep with your job records for 90 days; the address itself is not stored with them. We also keep an address without its first part in those records (IPv4 without the first number, IPv6 only its 2nd and 3rd groups). It is kept for the same 90 days and for the same purpose: preventing abuse of the limits. The full address is never stored.
Providing the data in the first four rows is needed to create an account and master a track. Analytics is on by default; you can turn it off at any time in the cookie settings, and we then delete the analytics cookies.
Temporary files created while a track is processed are deleted automatically. We never use your audio to train machine-learning models.
2. Where the data is kept
On our servers at Hetzner Online GmbH in data centres in the European Union. Encrypted backups of the database are kept in the EU for 10 days.
3. Who else receives data
- Hetzner Online GmbH (Germany) — hosting, backups and our own mail server that delivers account emails (sign-up confirmation, password reset, service notices), as our processor.
- Google Ireland Limited (Gmail) — while our own mail server cannot yet deliver directly, it passes account emails addressed to other mail providers to this service for delivery, as our processor. It receives the recipient address and the email itself.
- Paddle.com Market Limited (United Kingdom) — sells them to you as Merchant of Record and processes your payment as an independent controller under its own privacy policy. We receive your email, country, what you bought and the payment status — never your card details. The UK has an EU adequacy decision.
- Telegram (Telegram Messenger Inc. and its group companies, outside the EU) — only if you choose to use our Telegram bot or tap “Get it in Telegram”: the master file, its name and short job notices are sent to your Telegram chat at your request. Telegram processes them as an independent controller under its own privacy policy. The transfer happens because you ask for it, Art. 49(1)(b). Turn it off any time with /nodelivery in the bot.
- Google Ireland Limited — only if you choose to sign in with Google (we receive your email and name), and Google Analytics, unless you turn Analytics off in the cookie settings. Google may transfer data to the United States under the EU–US Data Privacy Framework.
AI consultant chat. If you choose to use the consultant chat on the site or in our Telegram bot, the text you type is sent to a third-party AI model provider (which may process it outside the EU) only to generate the answer, after you agree to this in the chat (consent, Art. 6(1)(a) and Art. 49(1)(a)). Please don't include personal data in your messages. The site keeps the conversation only in your browser tab; the bot keeps the last few messages in memory for up to 30 minutes so it can follow the conversation.
AI suggestions. Preset suggestions and the text of the mastering report are generated by a third-party language model from numeric measurements of the track only — loudness, peaks, dynamic range, stereo width and spectrum balance. No audio, file names, account details or other personal data are sent to it.
4. Your rights
You may ask for a copy of your data, its correction, deletion or export, restrict or object to processing based on legitimate interest, and withdraw consent at any time — withdrawing does not affect processing done before. Write to support@echoteka.ai from the email of your account; we answer within one month. Closing your account deletes the account, its history and stored audio within 30 days, except purchase records the law requires us to keep; backups roll over within 10 more days.
You may complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the data protection authority of your country.
5. Cookies and browser storage
Strictly necessary (no consent needed): your sign-in token, theme choice and a marker of a purchase in progress, kept in your browser's local storage so the site works. Analytics (on by default; you can turn it off): Google Analytics cookies _ga and _ga_*, kept for up to 2 years, which we use to understand how the site is used. You can turn Analytics off at any time with the "Cookie settings" link at the bottom of any page, and we delete these cookies. The attribution records mm_acq and mm_acq_last, which note where you arrived from, are kept only while Analytics is on; turning Analytics off deletes them. The full list of cookies and browser storage is on the Cookie policy page.
6. Children
Echoteka is not intended for anyone under 16, and we do not knowingly create accounts for them.
7. Changes
We will announce material changes in the app or by email before they take effect.