Privacy Policy

Last updated: September 17, 2026

This Privacy Policy explains how Seven Spikes Ltd, a company registered in Bulgaria under company number 201117332, with registered address at 38 Cvetna Gradina Str., Bulgaria (“Echod”, “we”, “us”), collects, uses, and protects personal data when you visit echod.ai or use the Echod application and related services (together, the “Service”).

For the purposes of the EU General Data Protection Regulation (GDPR), Seven Spikes Ltd is the data controller for personal data described in this policy. You can reach us at sales@echod.ai.

1. Data we collect

• Account data— name, email address, company name, and password (stored in hashed form) when you create an account or start a trial.
• Billing data— subscription plan, billing address, VAT number, and payment status. Card details are collected and processed directly by our payment provider, Stripe; we never store full card numbers.
• Contact data— name, email address, and message contents when you submit our contact form or email us.
• Customer data— brands, domains, keywords, and related inputs you submit to the Service for AI visibility tracking. This is usually business data but may include personal data you choose to include.
• Usage and technical data— IP address, browser type, device information, pages visited, and log data collected automatically when you use the Service, used for security, debugging, and service improvement.

2. How we use your data

We process personal data for the following purposes and legal bases under the GDPR:

• Providing the Service(account management, running visibility reports, support) — performance of a contract (Art. 6(1)(b)).
• Billing and administration— performance of a contract and compliance with legal obligations such as tax and accounting law (Art. 6(1)(b), (c)).
• Responding to inquiriessubmitted via the contact form — our legitimate interest in responding to you, or pre-contractual steps (Art. 6(1)(b), (f)).
• Security, fraud prevention, and service improvement— our legitimate interests (Art. 6(1)(f)).
• Marketing communications— your consent, which you can withdraw at any time (Art. 6(1)(a)). We do not sell personal data.

3. Sharing and processors

We do not sell or rent personal data. We share it only with service providers (processors) that help us operate the Service, under data processing agreements:

• Microsoft Azure— cloud hosting, databases, and file storage.
• Stripe— payment processing.
• Mailgun— transactional email delivery (e.g., contact form messages).
• AI and search providers— to generate visibility reports, we query third-party AI systems using the brands, domains, and keywords you configure. We do not send your account or billing data to these providers.

We may also disclose data where required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets (with notice where required). An up-to-date list of sub-processors is available on request at sales@echod.ai.

4. International transfers

Where possible, data is stored within the European Economic Area (EEA). Some of our processors may process data outside the EEA (for example, in the United States). In such cases we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an adequacy decision (including the EU–US Data Privacy Framework where applicable).

5. Retention

• Account and customer data— retained for the duration of your account, and deleted or anonymized within a reasonable period after account closure, unless a longer period is required by law.
• Billing records— retained as required by Bulgarian tax and accounting law (generally up to 10 years).
• Contact form messages— retained as long as needed to handle your inquiry and for a reasonable period thereafter.
• Logs and technical data— retained for a limited period for security and debugging purposes.

6. Cookies

The marketing website uses only cookies and similar technologies that are strictly necessary for it to function. The Echod application uses cookies required for authentication and session management. If we introduce analytics or marketing cookies in the future, we will ask for your consent where required and update this policy.

7. Security

We apply appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, and secrets management. No system is completely secure; if we become aware of a personal data breach affecting you, we will notify you and the competent authority as required by law.

8. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data (“right to be forgotten”);
• request restriction of processing;
• receive your data in a portable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, without affecting prior processing.

To exercise these rights, contact us at sales@echod.ai. We will respond within one month. You also have the right to lodge a complaint with a supervisory authority — in Bulgaria, the Commission for Personal Data Protection (cpdp.bg), or the authority in your EU country of residence.

9. Children

The Service is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a revised “Last updated” date and, for material changes, notify you by email or in-app notice.

11. Contact

Seven Spikes Ltd (company no. 201117332)
38 Cvetna Gradina Str., Bulgaria
sales@echod.ai