Data and Privacy Policy

1. Scope and Roles

1.1 Application. This Policy applies to all users of the Platform, to the organisations on whose behalf they use it, to all information processed through it, and to the people who are not users but whose information the Platform gathers or holds (Section 10).

1.2 Controller and Processor. In respect of account and billing information, and information about how the Platform is used, Echo International acts as a controller (or equivalent under applicable law). In respect of User Content, including any personal data contained in briefs, uploads, knowledge base documents, and client materials that you submit, you (or the organisation you represent) act as the controller and Echo International acts as a processor, processing that content only on your documented instructions and as described in this Policy.

1.3 Your clients’ data. Where you upload material belonging to your own clients, that material remains theirs as between you and them, and yours as between you and us. We do not acquire ownership of it, and we do not deal with it other than as set out in this Policy.

1.4 Media monitoring and social listening. Where you set up a watch over press coverage or public social media, you are the controller of that watch: you decide what is watched and for what purpose. Echo International acts as a controller for the gathering, storage, and analysis it carries out to run the watch, because it chooses the sources and the tools, and some of what it learns (such as which journalist writes for which outlet) serves more than one customer. Contact details you type into a watch yourself are your data, and we hold them as your processor.

2. Information We Process

2.1 Account information. Name, email address, workspace and organisation details, role and permission level, authentication metadata, and preferences.

2.2 User Content. Briefs, uploaded documents, knowledge base materials, brand assets, prompts and instructions you enter, generated Outputs, and any personal data you choose to include in them. You control what you submit.

2.3 Billing information. Subscription and usage records, invoices, and payment status. Card details are handled directly by our payment processor and are not stored on our systems.

2.4 Technical and usage information. Log data, IP address, browser and device information, timestamps, feature usage, request identifiers, and error diagnostics.

2.5 Communications. Correspondence with our support and sales teams, and the email addresses you give us to receive reports and alerts.

2.6 Information about people who are not users. Press coverage, public social media posts and comments, messages to accounts you connect, and the details of people who take part in a crisis simulation. Section 10 describes this information, where it comes from, and why we hold it.

3. How We Use Information, and What We Will Not Do

3.1 Permitted uses. We use the information described in Section 2 to operate, secure, support, and improve the Platform; to authenticate users and administer workspaces; to generate Outputs you request; to run the watches you set up; to process payments; to communicate with you about the service; to detect, investigate, and prevent abuse, fraud, and security incidents; and to comply with legal obligations.

3.2 No model training on your content. We do not use your User Content, your Outputs, or your uploaded materials to train, fine-tune, or otherwise develop artificial intelligence or machine learning models, whether our own or a third party’s. We contract with our artificial intelligence sub-processors on terms under which content submitted through their interfaces is not used to train their models.

3.3 No cross-customer use. We do not use your User Content or your Outputs to generate, inform, enrich, or benchmark Outputs for any other customer, and we do not incorporate them into any shared, pooled, or aggregated dataset, corpus, knowledge base, or product made available to any other customer or to the public. This applies to your content in original, derived, summarised, de-identified, anonymised, and aggregated forms alike.

3.4 No sale of data. We do not sell, rent, or trade personal data or User Content, and we do not disclose it for advertising or marketing purposes.

3.5 Workspace isolation. Each workspace is logically separated, and access is restricted to the users your administrators authorise. Our personnel do not access User Content except where strictly necessary to provide support you have requested, to investigate a security incident, to maintain or restore the service, or where required by law, and such access is limited to personnel who need it and is subject to confidentiality obligations.

3.6 Aggregated usage data. You acknowledge and expressly consent that we may use only anonymized, de-identified, and aggregated information derived from your workspace activity (such as request volumes, feature usage counts, error rates, and performance timings) to operate, secure, measure, and improve the Platform. This permission extends to activity and usage metadata only. It does not extend to your User Content, your uploaded materials, or your Outputs, and nothing in this Section qualifies Sections 3.2 or 3.3.

3.7 No automated decisions. We do not make any decision about you by automated means that produces legal effects concerning you or similarly significantly affects you.

4. Legal Bases for Processing

4.1 Where the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) or the UK Data Protection Act 2018 applies, we rely on the following legal bases: performance of a contract (to provide the Platform to you); legitimate interests (to secure the Platform, prevent abuse, and improve reliability, and the interests described in Section 10 for media monitoring, social listening, and crisis simulation, in each case balanced against the rights of the people concerned); compliance with a legal obligation; and consent, where consent is required and has been given.

4.2 Where the Personal Data Protection Act 2012 of Singapore (“PDPA”) applies, we collect, use, and disclose personal data with consent or as otherwise permitted under the PDPA.

4.3 Where we process User Content as a processor, the legal basis for the underlying processing is determined by you as controller, and you are responsible for ensuring that an appropriate basis exists.

5. Disclosure and Sub-Processors

5.1 When we disclose. We disclose information only: to sub-processors engaged to deliver the Platform, as described below; to your own workspace administrators and authorised users; to professional advisers under confidentiality obligations; where required by law, regulation, court order, or a binding request from a competent authority; to establish, exercise, or defend legal claims; and in connection with a merger, acquisition, or sale of assets, subject to Section 5.5.

5.2 Categories of sub-processor. We engage third-party providers in the following categories: cloud hosting and application delivery (including serverless functions, scheduled jobs, service logs, and cookieless page analytics); database, authentication, and file storage; artificial intelligence providers (language models, text embeddings, image and video generation, translation, and web search run on our behalf); payment processing; transactional email delivery; error monitoring; news search and web search providers used for media monitoring; providers that collect public social media posts and comments for social listening; the social platforms whose accounts you connect to the Platform, on your authorisation; and image search by keyword.

5.3 The list of sub-processors by name. This Policy names categories rather than companies. A business customer may ask us for the current list of sub-processors by name, and we provide it under the confidentiality clause of the Terms of Service (Section 10 of the Terms). We give notice of additions and replacements to the customers who hold the list. Where applicable data protection law gives you a right to object to a change, you may exercise it by writing to us at the address in Section 14. Except where applicable data protection law requires otherwise, nothing in this Policy entitles a customer to approve a sub-processor, and we may add, replace, or remove sub-processors as the service requires.

5.4 Obligations we impose. Each sub-processor is engaged under a written contract imposing obligations of confidentiality and data protection no less protective than those in this Policy, and is permitted to process information only to deliver the service we have engaged it for. We remain responsible to you for the performance of our sub-processors.

5.5 Change of control. If Echo International is involved in a merger, acquisition, financing, or sale of assets, User Content may be transferred as part of that transaction only where the recipient agrees in writing to be bound by commitments no less protective than those in this Policy, including Sections 3.2, 3.3, and 3.4. We will give notice of any such transfer.

6. International Transfers

6.1 The Platform’s database and file storage are hosted in Singapore. Its application functions run in South Korea. Its providers are in the United States and the European Union. Your information is therefore processed in Singapore, South Korea, the United States, and the European Union, which may be outside your own jurisdiction.

6.2 Where personal data subject to the GDPR or the UK data protection regime is transferred outside the European Economic Area or the United Kingdom, the transfer is made under an appropriate safeguard, which may include the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision.

6.3 Copies of the relevant transfer mechanisms are available on request to the contact address in Section 14.

7. Retention and Deletion

7.1 You control retention. We do not apply automatic time-based deletion anywhere on the Platform. Your material remains available in your workspace until you or your administrator chooses to remove it, or until your access ends and Section 7.5 applies.

7.2 How long we keep each kind of information. We keep account and workspace information until it is deleted at your request. We keep User Content until you remove it or ask us to delete it. We keep the rows gathered by a media monitoring or social listening watch, and the comments and messages collected from an account you connect, for the life of that watch, until the watch or the connection is deleted. Journalist bylines learned per outlet are shared across customers and stay until the outlet record is removed. We keep error reports, activity records, and service logs for security and audit purposes for as long as the account they relate to exists. We keep invitations and access requests until they are removed. We keep backups for a limited period after deletion (Section 7.4). We keep billing records for as long as tax law requires (Section 7.6).

7.3 Hard deletion. Where you delete User Content through the Platform using a deletion function described as permanent, we delete the underlying record and associated stored files from our live production systems. Deletion of this kind is irreversible and cannot be undone by us or by you.

7.4 Backups. Deleted material may persist in encrypted backups and disaster recovery snapshots for a limited period, after which it is overwritten in the ordinary course. During that period the material is not accessible through the Platform, is not restored other than as part of a full system recovery, and is not used for any purpose.

7.5 On termination. When your access ends, your workspace is deactivated at once and its content is no longer accessible to its members. On your written request made within thirty (30) days of termination, we return your User Content to you or delete it, except for the records described in Section 7.6 and the backup copies described in Section 7.4. If you make no request, the content stays stored and inaccessible until you ask us to delete it, which you may do at any time.

7.6 Records we must keep. We retain account, billing, transaction, and audit records for as long as required to comply with legal, tax, accounting, and regulatory obligations, and to establish, exercise, or defend legal claims. Such records are retained for that purpose only.

7.7 Deletion on request. You may request deletion of User Content or of personal data by contacting us at the address in Section 14, and we will action verified requests within one month, or within any shorter period required by applicable law.

8. Security

8.1 We implement technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, role-based access control, workspace-level access restrictions, authentication controls, network and application-level protections, audit logging of administrative actions, and monitoring for anomalous activity.

8.2 Access to production systems is limited to personnel who require it to perform their duties, is subject to confidentiality obligations, and is logged.

8.3 Incident notification. If we become aware of a personal data breach affecting your information, we will notify you without undue delay, aiming to do so within seventy-two (72) hours of becoming aware of it, providing the information reasonably available to us to assist you in meeting your own notification obligations.

8.4 No system is completely secure. While we take the measures described above, we do not warrant absolute security, and you are responsible for maintaining the confidentiality of your credentials and for the access rights your administrators grant.

9. Cookies, Analytics, and Error Monitoring

9.1 Cookies we set. The Platform sets only the cookies it needs to work: the sign-in session cookies set by our authentication provider, which keep you signed in; a language cookie (alpha-locale), which remembers the language you chose for one year; a project language cookie (alpha-project-locale), which remembers the language of the project you are working in for the browser session; a workspace cookie (current_workspace_id), which remembers which workspace you have open for 180 days and cannot be read by scripts in the page; a short-lived password reset cookie (alpha-recovery-grant), set only while you reset your password; and a share cookie (rp_share), set only when you open a report through a share link, so the link keeps working as you move through the report.

9.2 Browser storage. The Platform keeps interface state in your browser, such as which panel is open or which view you last used. It does not keep User Content there and does not use browser storage to track you.

9.3 Analytics. We measure page visits and page speed through our hosting provider’s analytics, which set no cookie, hold no identifier for you, and cannot follow you across sites.

9.4 Error monitoring. When something goes wrong in the Platform, an error report goes to our error monitoring provider. The report carries your user ID so that we can find and fix the fault; personal fields are removed before it is sent.

9.5 No advertising or tracking. We set no advertising cookies and no tracking cookies, and we do not share your activity with advertising networks. Because every cookie we set is strictly necessary to run the Platform, we do not ask for cookie consent.

10. People Who Are Not Our Users

10.1 Who this section covers. The Platform gathers and holds information about some people who have no account with us: journalists and other people named in press coverage; authors of public posts and comments on social media; people who comment on or send messages to an account that a customer has connected to the Platform; and people who take part in a crisis simulation exercise run by a customer.

10.2 What we hold and where it comes from. From the public press we hold headlines, summaries, bylines, the outlet, the link, and our assessment of the tone of an article. From public social media we hold the text of a post or comment, the author’s public name or handle, and public counts such as likes and shares. From an account a customer connects, on that customer’s instruction, we hold the comments and direct messages sent to that account, with the sender’s name or identifier as the platform provides it. From a crisis simulation we hold the name a participant gives when joining, their role, a random token that keeps their seat in the browser they joined from, and their answers and scores. Journalist names and bylines are public professional information. Contact details that a customer types into its own watch are that customer’s data (Section 1.4).

10.3 Why we hold it and on what basis. We hold this information so that a customer can understand public coverage and public conversation about itself, its competitors, and its issues; respond to people who contact its own accounts; and rehearse its response to a crisis. The legal basis is legitimate interests: ours, in providing the service, and the customer’s, as the controller of its watch, in following what is said about it in public. We balance those interests against the rights of the people concerned by taking only what is already public or already sent to the customer’s own account, by holding it for the life of the watch and no longer (Section 7.2), by showing it only to the customer’s authorised users, and by never using it for advertising or for any purpose beyond the watch.

10.4 Why we do not notify each person. The information comes from public sources, or from messages sent to a customer’s own account. Telling every journalist, author, and commenter individually would involve a disproportionate effort, as Article 14(5)(b) of the GDPR recognises. This Policy is the notice. A participant in a crisis simulation gives their name to the host directly when joining; the host sees each participant’s own scores, and the shared screen shows totals only.

10.5 Who receives it. The customer’s authorised users; and the sub-processors in Section 5.2 that we use to gather, store, and analyse it, in the countries listed in Section 6.

10.6 Your rights. If you are one of the people this section covers, you have the rights described in Section 11, and you may exercise them by writing to the address in Section 14. We may need to verify your identity. Where the information is held for a customer as its processor (contact details the customer typed in), we refer your request to that customer and help it respond.

11. Your Rights

11.1 Subject to applicable law, you may have the right to access the personal data we hold about you; to correct inaccurate or incomplete data; to request erasure; to restrict or object to certain processing; to receive your data in a portable format; and to withdraw consent where processing is based on consent.

11.2 To exercise any of these rights, write to us at the address in Section 14. We respond within one month, or within any shorter period required by applicable law. We may need to verify your identity before acting on a request.

11.3 Where we process User Content as a processor on your behalf and we receive a request from an individual whose personal data is contained in it, we will not respond directly except to confirm receipt, and will refer the request to you, assisting you in responding as reasonably required.

11.4 You may lodge a complaint with a supervisory authority. In Singapore this is the Personal Data Protection Commission. In the European Economic Area or the United Kingdom, it is the supervisory authority in your country of residence or place of work.

12. Data Processing Agreement

12.1 Section 7 of the Terms of Service, together with this Policy, is our standard data processing agreement for the purposes of Article 28 of the GDPR and equivalent provisions of applicable data protection law. It is incorporated into the Terms of Service and takes effect on acceptance of them; no separate signature or execution is required. If you need a signed copy for your records, we provide one on request to the address in Section 14. Standard Contractual Clauses apply to transfers as described in Section 6.

12.2 If we agree in writing to a separate Data Processing Agreement, that agreement governs the processing of personal data to the extent of any inconsistency with this Policy.

13. Children

13.1 The Platform is a business tool and is not directed to individuals under the age of eighteen (18). We do not knowingly collect personal data from children. If we become aware that we have done so, we will delete it.

14. Contact

14.1 Questions about this Policy, requests to exercise rights, requests for our sub-processor list or transfer mechanisms, and requests for a signed Data Processing Agreement should be sent by email to support@alpha8to12.com or by post to Echo International Communications Pte. Ltd., 16 Raffles Quay, #16-02, Hong Leong Building, Singapore 048581.

EU representative

14.2 We have appointed Anthony Larmon, Museumstraße 4 Top 3, 1010 Vienna, Austria, as our representative in the European Union under Article 27 of the GDPR. People in the European Union and supervisory authorities may contact the representative at support@alpha8to12.com on any matter covered by this Policy, as well as or instead of contacting us directly.

15. Changes to This Policy

15.1 We may update this Policy from time to time. Where a change materially reduces the protections afforded to you, we will give reasonable prior notice through the Platform or by email before the change takes effect.

15.2 The version identifier at the head of this page indicates the currently effective version. Continued use of the Platform after a change takes effect constitutes acceptance of the updated Policy.