Privacy Policy — EchoPilot
Operator: ChatLogic Insights Ltd, registered in England and Wales, company no. 15593166 · Applies to: echopilot.echorank360.com · Effective: September 2026 · v1.0
EchoPilot audits the public online presence of a business you specify, scores it against a published rule set, and on paid plans drafts content and actions for your approval. This policy explains what we hold about you and why. The Service is not offered in the European Union, the European Economic Area, or the United Kingdom (see Terms of Use §2); we use location signals to enforce that restriction.
1. What we collect
- Intake data you submit: business name, website, business type, city and country, ticket band, Google Business Profile URL, social handles, ad-spend band, and the yes/no answers in the setup wizard.
- Scraped public business data: pages fetched from the website you specify (at most 60 pages per audit, honouring robots.txt), DNS records, PageSpeed results, search results, Google Business Profile details and public reviews, public social-profile metadata, and directory listings. We store the facts extracted for each rule (titles, counts, flags, short snippets) and a log of every fetch; we do not keep full page bodies.
- Connected social tokens (paid plans, optional): if you connect a social account, the access token is stored encrypted (AES-256-GCM) and used only to read your own posts and, after your explicit approval of each item, to publish drafts you approved. You can revoke a connection at any time.
- Generated content: memos, drafted posts, brand-voice profiles and research briefs produced for your account, together with your approval or rejection of each item.
- Account data: email address, Google account identifier if you use Google sign-in, sign-in link records (hashed), tenant membership, plan and billing status.
- Free score data: the domain and email address you enter, the result, and the network address used for rate limiting.
- Payment data (from Phase 3): processed by Stripe; we receive a customer ID, amount, status, card brand, last four digits and billing country — never full card numbers.
- Technical and location data: IP address and its country (as passed by Cloudflare), user agent, timestamps and request logs — for rate limiting, abuse prevention, security, debugging, and enforcing the territorial restriction.
2. Why, and on what legal basis
| Purpose | Basis |
|---|---|
| Auditing the business you specify and producing scores, memos and drafts | Contract |
| Sign-in links, audit-complete and account email | Contract |
| Billing, receipts, refunds, disputes | Contract; legal obligation (accounting records) |
| Rate limiting, security, abuse prevention | Legitimate interests |
| Enforcing the territorial restriction (IP and billing country) | Legitimate interests; contract |
| Aggregate funnel statistics (counts of events, no profiles) | Legitimate interests |
We do not sell personal data and do not use it for advertising.
3. Processors
Cloudflare (proxy, TLS, geolocation) · Stripe (subscriptions, from Phase 3) · Google (sign-in if you choose it; PageSpeed Insights; Places API for Business Profile data) · Anthropic (language-model classification of page text, review themes and drafts; prompts contain extracted business text, never your account credentials) · a search-results provider (SerpApi or DataForSEO) · Brevo (email) · EchoRank (AI-visibility queries) · RackNerd (hosting). We disclose data if legally compelled and will tell you unless prohibited.
4. Shareable results
A scores-only summary of an audit can be shared through an unguessable link that you create and can revoke. It shows category and overall scores and nothing else. Full reports, evidence and drafts require login.
5. Retention
- Free score results: 7 days for the cached result, then may be pruned; the email address up to 90 days.
- Audit history, evidence and generated content: for the life of the account; a business you remove is hidden, its history is kept, and it is deleted only on an explicit deletion request or account deletion.
- Connected tokens: until you revoke the connection or delete the account.
- Account data: deleted or anonymised within 30 days of account deletion.
- Payment records: 7 years (UK tax law). Logs: up to 90 days.
6. Your rights
Access, correction, deletion, restriction, objection, portability, and — where consent applies — withdrawal. Email us from your account address; we answer within one month. As we are established in the United Kingdom you may complain to the UK ICO (ico.org.uk); you may also have rights under the law of the place where you live.
7. Cookies
Strictly necessary only: a session cookie when logged in and a short-lived cookie during Google sign-in. No advertising or cross-site tracking.
8. Transfers and security
Hosting is in Utah, United States. Stripe, Google, Anthropic, Brevo and Cloudflare may process data in the US and elsewhere under their standard contractual safeguards. TLS everywhere, hashed sign-in and share tokens, encrypted integration tokens, database bound to localhost, nightly rotated backups. If a breach affects your data we notify you and, where required, the ICO within 72 hours.
9. Children, changes, contact
Not intended for anyone under 18. Changes are posted here with a new version and date; subscribers are emailed for material changes.
Contact:
ChatLogic Insights LTD — EchoRank Agent:
Frederic Desjardins 1321 Upland Dr. PMB 10673, Houston, Texas 77043, United States
Legal: [email protected]
Support: [email protected]