Privacy Policy.

Echonomics AI ("Echo," "we," "our," or "us") operates the Echo Catalogue at echocatalogue.com. This Privacy Policy explains what information we collect when you use the Catalogue, how we use it, and the choices you have. We keep this simple — no dark patterns, no selling your data.

1. Information We Collect

Information you provide

• Account registration: When you create an account, we collect your email address, first name, last name, and a password. This information is stored in Shopify's customer database and is used to authenticate you and display your order history.
• Checkout & payment: When you complete a purchase, you provide your name, shipping address, email address, and payment details. Payment information is transmitted directly to Stripe, Inc. and is never stored on Echo's servers. Echo receives a payment confirmation and order details but does not receive or store your full card number or CVV.
• Subscriptions: If you enroll in a subscription, your billing information is stored by Stripe under a secure customer token. Echo stores a reference to your Stripe subscription ID to manage renewals and cancellations.
• Newsletter sign-up: If you subscribe through the footer form, we collect your email address only.
• Contact enquiries: Name, email, and message content submitted through the contact page.

Information collected automatically

• Session cookies: When you sign in, we set a secure httpOnly cookie on your browser to maintain your session. This cookie contains an encrypted access token and does not contain personally identifiable information in readable form. It is scoped to echocatalogue.com and is deleted when you sign out.
• Cart & wishlist (local only): Items you add to your cart or wishlist are stored in your browser's localStorage and are not transmitted to our servers unless you proceed to checkout.
• Usage analytics: We use Vercel Analytics to understand page performance and visitor trends. Vercel Analytics does not use cookies and does not track you across sites. All data is aggregated and anonymised.
• Meta Pixel: We use the Meta Pixel to measure the effectiveness of advertising campaigns. The Pixel may collect your IP address, browser information, and browsing behaviour on this site, and may link that to a Meta account if you are logged in to Facebook or Instagram. You can opt out at facebook.com/settings.
• Server logs: Our hosting provider Vercel automatically logs standard server data — IP address, browser type, referring URL, and pages visited. Logs are retained for up to 30 days for security and debugging purposes.

2. How We Use Your Information

• To process and fulfill your orders
• To manage your account and authenticate your identity
• To process subscription billing through Stripe and send renewal reminders
• To send transactional emails (order confirmations, shipping updates, password resets) via Resend
• To send the newsletter you subscribed to (you can unsubscribe at any time)
• To respond to contact enquiries
• To measure and improve the performance of the Catalogue
• To detect and prevent fraud or abuse
• To comply with applicable law

We do not sell your personal data to third parties. We do not use your data for automated decision-making that produces legal effects without human review.

3. Sharing Your Information

We share data only with the following service providers:

• Stripe — processes all payment transactions and stores billing information for recurring subscriptions. Governed by Stripe's Privacy Policy.
• Shopify — powers our product catalog and customer account infrastructure. Governed by Shopify's Privacy Policy.
• Resend — delivers transactional emails (password resets, order confirmations, subscription notices). Governed by Resend's Privacy Policy.
• Vercel — hosts the Catalogue and aggregates anonymous analytics.
• Meta — receives Pixel events for advertising measurement as described above.
• Legal requirements — if required by law, court order, or to protect the rights and safety of Echo, our users, or the public.

4. Cookies & Session Tokens

Echo Catalogue sets one first-party httpOnly cookie (echo_session) when you are signed in. This cookie is essential for maintaining your login session and cannot be used to track you across other websites. It is automatically deleted when you sign out or when it expires.

The Meta Pixel and Vercel may set additional cookies or use similar technologies as described in their respective privacy policies. Your browser settings allow you to block or delete cookies at any time.

5. Data Retention

• Account data: retained while your account is active and for up to 3 years after deletion, for legal and fraud-prevention purposes
• Order & subscription records: retained for 7 years to comply with financial record-keeping requirements
• Newsletter subscriptions: retained until you unsubscribe
• Contact enquiries: retained for up to 12 months
• Server logs: purged after 30 days
• Cart & wishlist data: exists only in your browser; never stored on our servers

6. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Port your data to another service
• Withdraw consent (e.g., unsubscribe from newsletters)

To exercise any of these rights, email privacy@echonomicsai.com. We will respond within 30 days. We may need to verify your identity before processing your request.

7. California Residents (CCPA)

If you are a California resident, you have rights under the CCPA including the right to know what personal information we collect, the right to delete it, and the right to opt out of its sale. Echo does not sell personal information as defined by the CCPA. To submit a verifiable consumer request, contact privacy@echonomicsai.com.

8. European Residents (GDPR)

If you are located in the European Economic Area or United Kingdom, our legal bases for processing your data are: contract performance (order fulfillment, subscription billing), consent (newsletter, marketing), and legitimate interest (analytics, fraud prevention, security). You have the right to withdraw consent at any time and to lodge a complaint with your local supervisory authority.

9. Children

The Echo Catalogue is not directed at children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy periodically. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated via email to registered account holders and via a notice on the site.

11. Contact

Questions about this Privacy Policy or your data? Reach us at privacy@echonomicsai.com or through the contact page.