Privacy Policy

This Privacy Policy explains how EchoNext ("we", "us", "our") collects, uses, shares, and protects personal data when you use our testimonial collection and display service. We are committed to protecting your privacy and complying with the privacy laws that apply to you, including GDPR and the CCPA.

Testimonial Submitters

• Name, email address (optional), role, and company
• Testimonial content (text or video)
• Video recordings including face and voice (biometric data)
• Rating and consent records

Business Clients

• Name, email, and company information
• Payment information (processed by Stripe)
• Usage data and subscription details

Website Visitors

• Contact form submissions
• Cookie consent preferences
• Unless you turn Analytics off in the cookie banner: the page you viewed, where you came from, and your browser, operating system, device type and approximate location. No cookie, and no identifier that outlives the day.

• Displaying testimonials on client walls and widgets
• Processing payments and managing subscriptions
• Sending transactional emails (confirmations, notifications)
• AI-powered content moderation and analysis (Pro plan)
• Improving our services and user experience
• Measuring how the website is used, in aggregate, so we can improve it

• Consent - For testimonial submissions, marketing communications, video recordings, and website analytics
• Contract - For client accounts, payments, and service delivery
• Legitimate Interests - For security, fraud prevention, and service improvement

We share your data with the following service providers who help us operate our platform:

For transfers to countries outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) and verify adequate safeguards are in place.

For complete details about our sub-processors, including their privacy policies and data processing agreements, see our Sub-Processors page

• Testimonials: Retained until consent is withdrawn or the wall is deleted
• Contact requests: 12 months
• Payment records: As required by tax laws (typically 7 years)
• Audit logs: 24 months
• Analytics: aggregated statistics only — nothing that identifies a visitor is stored, so there is nothing to delete

If you are in the EU, EEA or UK, the GDPR gives you the following rights regarding your personal data (California residents: see the California Privacy Rights section below):

• Right to access your data
• Right to correct inaccurate data
• Right to delete your data ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time

Self-serve erasure through the form removes what you submitted to us: testimonials, interview feedback, contact requests, and consent records. It does not close an EchoNext account or delete account data — to close your account, email hello@echonext.app.

To exercise your rights, please use our Data Request Form

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following rights regarding your personal information:

• Right to know what personal information we collect, use, and disclose
• Right to delete the personal information we hold about you
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of your personal information
• Right to non-discrimination for exercising your privacy rights

To exercise your California privacy rights — to know, delete, or correct your personal information — please use our Data Request Form

This is everything we run in your browser, and what each one is for. Not all of it uses cookies:

• Necessary - Session management, security, and consent preferences
• Functional - Form progress saving (localStorage) to preserve your input if you navigate away
• Analytics - Visitor statistics for the EchoNext website, via Plausible Analytics. It sets no cookie and stores nothing on your device, so it is the one item here that uses neither, and it runs by default. The banner's Analytics toggle turns it off — and off means off: nothing is sent.

It does not run in the testimonial widgets and wall embeds we serve onto our customers' own websites: those embed addresses never load it.

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (HTTPS), secure authentication, access controls, and regular security reviews.

Our service is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our website. The "Last updated" date at the top indicates when the policy was last revised.

If you have questions about this Privacy Policy or our data practices, please contact us: