EchoMind Privacy Policy

1. Who we are

EchoMind ("we," "us," "our") provides an AI voice wellness companion application (the "Service") accessible via web and mobile. This policy explains what personal data we collect, why, how we protect it, and what rights you have over it.

2. Data we collect

3. Why we process your data

• To provide the Service: Running voice sessions, tracking your minute balance, processing payments.
• To personalize your experience: With your explicit, separate consent, we use summaries of past sessions (and, if you submit them, mood check-ins) to give the AI companion context about previous conversations, so it can reference them naturally. You can withdraw this consent at any time, which stops this personalization going forward.
• To operate and improve the Service: Aggregate, non-identifying product analytics.
• To comply with legal obligations: Retaining payment/transaction records for the period required by applicable tax and financial regulations.

4. Who we share it with

We use the following service providers (sub-processors) to operate EchoMind. Each processes only the data necessary for their function:

We do not sell your personal data, and we do not share it with advertisers. Some of these providers process data outside India. Where that happens, we rely on the contractual and security safeguards those providers offer, consistent with the DPDP Act's provisions on transfers outside India (which, as of this writing, permits such transfers except to countries specifically restricted by the Central Government).

5. How long we keep your data

• Session summaries and mood check-ins: Kept until you delete the individual session, or request deletion of your account.
• Account profile (name, email, plan): Kept while your account is active.
• Payment/transaction records: Retained after account deletion for the period required by applicable Indian tax and financial record-keeping laws (retained in a format that is no longer linked to an active account or usable to identify you within the Service).
• Raw transcripts: Not retained — deleted immediately after summary generation.

6. Your rights

Under the DPDP Act, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correct: Request correction of inaccurate or outdated data.
• Erase: Request erasure of your data, including deleting individual sessions or your entire account.
• Withdraw consent: Withdraw consent to session-memory personalization at any time, without affecting the lawfulness of processing before withdrawal.
• Grievance redressal: Raise a complaint about how we have handled your data.

How to exercise these rights: You can exercise these rights directly within the application under Settings. There, you can view your stored data, toggle session personalization memory, delete individual sessions, or request complete deletion of all session records. If you are unable to access these controls or need further assistance, you can email us at support@echomind.ai, and we will respond and act on requests within 30 days.

7. Children's use of the Service

EchoMind is intended for users who are 18 years of age or older. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

8. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS) for all data in transit, signature verification on all payment and voice-platform webhooks, rate limiting, and access controls scoping every user's data to their own account.

9. Cookies and tracking

We use essential cookies for authentication (via Clerk) and privacy-respecting product analytics (via PostHog, with IP collection and session recording disabled). We do not use third-party advertising cookies.

10. Grievance Officer

In accordance with the DPDP Act, our designated contact for privacy-related grievances is:

11. Changes to this policy

We'll update the date at the top of this page when this policy changes, and for material changes, we'll make reasonable efforts to notify you directly (e.g., by email or in-app notice).