1. Introduction
This Privacy Policy explains how EchoNext ("we", "us", "our") collects, uses, shares, and protects personal data when you use our testimonial collection and display service. We are committed to protecting your privacy and ensuring GDPR compliance.
EchoNext
Operated by Whatcomesnext
info@whatcomesnext.se
2. Data We Collect
Testimonial Submitters
- Name, email address (optional), role, and company
- Testimonial content (text or video)
- Video recordings including face and voice (biometric data)
- Rating and consent records
Business Clients
- Name, email, and company information
- Payment information (processed by Stripe)
- Usage data and subscription details
Website Visitors
- Contact form submissions
- Cookie consent preferences
3. How We Use Your Data
- Displaying testimonials on client walls and widgets
- Processing payments and managing subscriptions
- Sending transactional emails (confirmations, notifications)
- AI-powered content moderation and analysis (Pro plan)
- Improving our services and user experience
4. Legal Basis for Processing
- Consent - For testimonial submissions, marketing communications, and video recordings
- Contract - For client accounts, payments, and service delivery
- Legitimate Interests - For security, fraud prevention, and service improvement
5. Data Sharing & Transfers
We share your data with the following service providers who help us operate our platform:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and file storage | EU/US |
| Stripe | Payment processing | US |
| Resend | Email delivery | US |
| OpenAI | Content moderation | US |
| Google (Gemini) | AI analysis features | US |
For transfers to countries outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) and verify adequate safeguards are in place.
For complete details about our sub-processors, including their privacy policies and data processing agreements, see our Sub-Processors page
6. Data Retention
- Testimonials: Retained until consent is withdrawn or the wall is deleted
- Contact requests: 12 months
- Payment records: As required by tax laws (typically 7 years)
- Audit logs: 24 months
7. Your Rights
Under GDPR, you have the following rights regarding your personal data:
- Right to access your data
- Right to correct inaccurate data
- Right to delete your data ("right to be forgotten")
- Right to restrict processing
- Right to data portability
- Right to object to processing
- Right to withdraw consent at any time
To exercise your rights, please use our Data Request Form
8. Cookies & Local Storage
We use cookies and browser storage for the following purposes:
- Necessary - Session management, security, and consent preferences
- Functional - Form progress saving (localStorage) to preserve your input if you navigate away
9. Security
We implement appropriate technical and organizational measures to protect your data, including encryption in transit (HTTPS), secure authentication, access controls, and regular security reviews.
10. Children's Privacy
Our service is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our website. The "Last updated" date at the top indicates when the policy was last revised.
12. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
Supervisory Authority
You have the right to lodge a complaint with a data protection authority. In Sweden: Integritetsskyddsmyndigheten (IMY)