Data Request Policy

1. Rights you can exercise

2. How to submit a request

Use the Data Request form, or email [email protected]. Tell us: the name/email or phone on the account, the right you want to exercise, and the scope (all of your data, or a specific area — profile, simulations, records, stories, conversations, billing, or notifications). Many changes are also self-service: edit your profile in-app, manage notifications in Settings, or delete your account from your profile. You don't need a lawyer to make a request.

3. Verifying your identity

To protect your data we confirm a request comes from you (or someone authorised). We will normally ask you to act from, or confirm control of, the email or phone number on the account. For high-risk requests (for example, where the account's contact details were recently changed) we may ask for additional verification. We won't disclose or delete data until we are satisfied of your identity, and any identity material is used only to verify the request and then discarded.

4. Our timelines

We acknowledge requests promptly and aim to complete them within 7 working days (NDPA/NDPR). Statutory maximums are 30 days under GDPR (extendable by a further 60 days for complex requests) and 45 days under CCPA (extendable by 45). If a request is complex we'll tell you and keep you updated.

5. Right to access & portability

On an access or portability request we provide a copy of your data in a portable format — typically your profile, your simulations and their records and steps, your conversations, your published stories, your notification preferences, and a summary of your billing (transaction references and amounts, never card numbers). We do not include AI-provider prompt logs, which are not retained by us as a separate record.

6. What deletion means

You can delete your account at any time from your profile, or by request. When we action a deletion we anonymise the identifying parts of your account and revoke access:

• your email is replaced with a non-identifying value and your phone number is removed;
• your password is cleared and all sessions are revoked, so the account can no longer be signed into;
• your profile fields — name, display name, bio, photo, date of birth — are scrubbed.

We retain only what we must, in a form no longer linked to your identity:

• Payment & transaction records — kept to meet tax and accounting obligations, tied to an anonymised account.
• Content you created — simulations, conversations, and any published stories persist in a de-identified form (or are removed where they would otherwise identify you).
• Limited security/audit records — kept briefly to prevent abuse and meet legal duties.

We do not retain identifying data longer than necessary or required by law. Anonymised data cannot be reversed back to you.

7. AI and your data

Echo's guidance is generated by third-party AI providers, to whom the necessary simulation content is sent at the time you use a feature (see Privacy Policy, Section 5). Once you delete your account or stop using AI features, we stop sending your content. Content already processed by a provider is handled under that provider's terms; we do not authorise providers to train their models on it where a setting to that effect is available.

8. Restriction, objection & withdrawing consent

You can ask us to stop a specific kind of processing without deleting your account — for example, turning off push notifications, unpublishing a story, or limiting non-essential processing. Where processing is based on consent, you can withdraw it at any time; withdrawal doesn't affect processing already carried out.

9. Fees

Requests are normally free. For manifestly unfounded or excessive requests (for example, repetitive exports), we may charge a reasonable fee or decline, as the law permits, and we'll explain why beforehand.

10. Requests from authorities

We disclose personal data to law-enforcement or government authorities only where legally required — for example, a valid court order or a lawful demand from an authorised regulator. We review each request, disclose only what is necessary, decline overbroad demands, and — where lawful and appropriate — notify the affected user before complying.

11. Children's data

Echo is not for children under 13 (see the Privacy Policy). If we're told an account belongs to a child under that age, we will verify and delete it, and a parent or guardian may contact us to request deletion.

12. Accounts of deceased users

A next of kin or estate representative may contact us to request deletion of a deceased user's account. We'll ask for proof of death and of authority before acting, and we handle any financial records under applicable estate and tax law.

13. Appeals & complaints

If you're unhappy with how we handled a request, reply to our response or email [email protected] and we'll escalate it to our Data Protection Officer. You may also lodge a complaint with the Nigeria Data Protection Commission (ndpc.gov.ng), your EU/UK supervisory authority under GDPR, or the California Privacy Protection Agency under CCPA.

14. Contact

Data requests and DPO enquiries: [email protected]. We acknowledge within a few working days.