Privacy Policy

This Privacy Policy explains what personal data EchoRelay collects, why we collect it, how we store it, and what rights you have. It applies to echorelay.dev and the EchoRelay API service.

1. Who we are

EchoRelay is the data controller for personal data you provide directly (account email, billing details, support correspondence). For payment processing, Paddle.com Market Ltd acts as the data controller of cardholder data — we never see or store full card numbers.

2. What we collect

• Account data: email address, hashed password, TOTP secret, optional display name.
• Usage metadata: API request counts, timestamps, status codes, project identifier. Stored for billing and operational metrics.
• Billing data: tier or pack purchased, invoice IDs, billing country. Payment-card data is processed by Paddle, not by us.
• Server logs: IP addresses, user-agent strings, request paths. Kept for up to 90 days for abuse prevention and debugging.
• Cookies: authentication and trusted-device cookies. Acquisition measurement uses no cookie or browser storage.
• Acquisition records: when you arrive from a tagged link, from a search engine, or from another website, an opaque identifier, cohort, the site or tag you came from, medium, campaign tags, entry path, and timestamps. Arriving directly, or moving between our own pages, records nothing. The identifier is added to the signup link and form only; the record never contains your email, IP address, user-agent string, or the address of the page you came from. No third-party advertising trackers.
• Newsletter: if you subscribe, your email address, the exact wording you agreed to, the date and IP address the request came from, and whether you confirmed it. Until you confirm, the only mail we send you is the confirmation itself; the newsletter goes to confirmed addresses only.

3. What we do not store

Request bodies and headers are never written to a database, never logged, and never inspected for analytics or training. They transit the delivery infrastructure only — on permanent delivery failure they land in your project's dead-letter queue, where they are kept for up to 30 days or until you clear them, then purged automatically. Request logs record metadata only (method, path, status, timing) — never request content.

4. Why we process it

• To provide the service you signed up for (contract).
• To bill you and meet our accounting obligations (legal obligation).
• To prevent fraud, abuse, and security incidents (legitimate interest).
• To understand which first-party campaigns lead to signups and paid accounts, so we can evaluate and improve our marketing (legitimate interest).
• To send you the newsletter you asked for, and to keep the record that shows you asked for it (consent).
• To respond to your support requests (contract / legitimate interest).

5. Who we share it with

The complete, authoritative list of sub-processors who may process your personal data on our behalf — with the data categories, region, and transfer mechanism for each — is maintained in §5 of our DPA. We update it within 24 hours of any change. Material changes are notified by email to customers on signed DPAs at least 30 days in advance.

We do not sell personal data. We disclose data to law enforcement only when compelled by a valid legal request from a competent authority.

6. Where it lives

Production data is stored on infrastructure located in the European Union. Some sub-processors operate global networks and may process metadata outside the EU; others receive a narrow, purpose-specific slice of data outside the EU — for example, device push tokens are sent to Google and Apple solely to deliver push notifications. Transfers rely on standard contractual clauses where applicable.

7. Retention & account closure

• Account closure. When you close your account, your personal data is erased — immediately and permanently. We erase your name, email address, and any other identifying information we hold. Any unused credit value you are carrying is refunded to your original payment method (see the Refund Policy). We retain only what the law requires us to keep: invoice records and accounting data are retained for the statutory period required by applicable tax and accounting law. That data cannot identify you to any party other than the competent authorities who may require it.
• Server logs: up to 90 days.
• Request logs (the inbound API calls you relay through us): searchable for a per-plan window, then hard-deleted at expiry. These rows hold request metadata only (method, path, status, timing) — never request bodies or headers. Check your plan details in the panel for your retention window.
• Dead-letter queue entries (request bodies and headers for permanently-failed deliveries): up to 30 days from the failure time, or until you clear them — whichever is earlier. Never stored in a database; purged automatically at expiry.
• Usage metadata: aggregated indefinitely; row-level data up to 24 months.
• Unjoined acquisition sessions: up to 180 days. Joined sessions follow the account lifecycle and can be excluded from analytics on request.
• Newsletter: an address that is never confirmed is deleted after seven days. If you unsubscribe we erase your address and keep only a one-way fingerprint of it, so we can recognise it and never mail you again without holding the address itself.

8. Your rights

Under GDPR and equivalent laws you have the right to: access the personal data we hold about you; correct inaccurate data; request erasure of your personal data (the right to be forgotten); restrict or object to processing; and request portability. You can exercise your right of erasure directly by closing your account in the panel — this erases your personal data immediately. To exercise any other right, or if you prefer to make a request directly to us, email trust@echorelay.dev. We respond within 30 days. You may also lodge a complaint with your local data-protection authority.

9. Security

We use TLS for all customer-facing traffic, hash passwords with a modern KDF, encrypt sensitive secrets at rest, and require two-factor authentication for account login. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the relevant authorities as required by law.

10. Changes

Material changes to this policy will be announced by email and on the website at least 14 days in advance.

11. Contact

Privacy questions: trust@echorelay.dev.