Privacy Policy

Section 01

Introduction & Scope

EchoNote AI ("EchoNote," "we," "our," or "us") is a voice note-taking application that automatically creates action items and tasks, and associates them with contacts and companies. We operate the application at app.echovoicenote.com and any related mobile applications (collectively, the "Service").

This Privacy Policy applies to all users of the Service and explains how we collect, use, store, disclose, and protect personal information — including Google user data obtained through the Google People API. By using EchoNote AI, you agree to the practices described in this policy.

EchoNote AI is operated by ALTIOR Virtual Marketing LLC, a Georgia limited liability company. Contact: support@echovoicenote.com.

Section 02

Information We Collect

We collect only the information necessary to provide the Service. The categories below reflect the CCPA/CPRA categories of personal information.

• Account Identifiers Your name and email address obtained via Google OAuth 2.0 sign-in. This constitutes an "Identifier" under CCPA and personal data under GDPR.
• Voice Notes & Audio Audio recordings you create within the Service and the text transcriptions generated from them. This is "audio/visual information" under CCPA.
• Tasks & Action Items Structured task data extracted from your notes, including deadlines, priorities, and associated contacts or companies you create or import.
• Google Contacts Data (People API) With your explicit prior consent, we access contact names, email addresses, phone numbers, and company names from your Google Contacts solely to allow you to associate notes and tasks with those individuals. This is a sensitive restricted scope under Google's OAuth framework. See Section 4 for full disclosure of how this data is used.
• Exported Contact Cards Contact card records you create or export within the Service, which may include names, emails, phone numbers, and company affiliations.
• Technical & Usage Data Server logs, error reports, browser/device type, and IP address collected for security and reliability purposes. Retained for a maximum of 90 days. This constitutes "internet or network activity information" under CCPA.

Data Minimization: We do not request access to permissions we do not need. We do not "future-proof" our access by collecting data for features not yet built. We do not access Gmail, Google Drive, Google Calendar, or any other Google service beyond what is explicitly described in this policy.

Section 03

Sources of Information

We collect personal information from the following sources:

• Directly from you — when you create an account, record a voice note, create tasks, or export contact cards.
• Google OAuth / People API — when you grant EchoNote AI permission to access your Google Contacts during the OAuth consent flow.
• Automatically — technical log data generated when you use the Service, collected for security and reliability purposes only.

We do not purchase, acquire, or receive personal information from data brokers, third-party marketing firms, or any external list providers.

Section 04

Use of Google User Data (People API)

What we access: Contact names, email addresses, phone numbers, and company/organization names from your personal Google Contacts address book, read-only.

Why we access it: Solely to allow you to search and link your existing Google Contacts to voice notes and tasks within EchoNote AI, and to pre-populate contact card fields so you do not have to re-enter information you already have.

What we do NOT do with Google Contacts data:

• We do not sell, rent, lease, or otherwise transfer Google Contacts data to any third party for their independent use.
• We do not use Google Contacts data for serving advertisements, retargeting, personalized advertising, or interest-based advertising of any kind.
• We do not use Google Contacts data to determine creditworthiness or for any lending purpose.
• We do not use Google Contacts data to train, improve, or develop any generalized or non-personalized AI or machine-learning models.
• We do not allow any EchoNote AI employee or contractor to read, review, or access your Google Contacts data, except in the four limited circumstances recognized by Google's policy: (a) with your affirmative agreement for specific support purposes; (b) for security investigations; (c) to comply with applicable law; or (d) when data is aggregated and anonymized for internal operational reporting.
• We do not store raw Google Contacts data in a permanent database. Contacts are fetched from the Google API at your request during an active session and are not retained beyond the immediate use.
• We do not scrape, build permanent databases of, or create copies of Google user data beyond what cache headers permit.

Limited Use Compliance: Our use of Google Contacts data is strictly limited to providing and improving the user-facing features of EchoNote AI that are explicitly described in this policy. All use complies with the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access: You may revoke EchoNote AI's access to your Google Contacts at any time by visiting myaccount.google.com/permissions and removing EchoNote AI. Revoking access will not delete notes or tasks already created; you can request full account deletion as described in Section 8.

Section 05

How We Use Your Information

We use the personal information we collect for the following purposes only:

• Service Delivery To provide voice note transcription, task creation, contact association, and contact card export features. Legal basis (GDPR): performance of a contract.
• Account Management To create and maintain your account, authenticate your identity, and allow you to access your data. Legal basis (GDPR): performance of a contract.
• Security & Fraud Prevention To detect, investigate, and prevent unauthorized access, abuse, or other security incidents. Legal basis (GDPR): legitimate interests.
• Service Improvement To analyze aggregated, anonymized usage patterns to improve the Service. No individual personal data is used for this purpose.
• Legal Compliance To comply with applicable law, respond to lawful government or legal requests, or enforce our Terms of Service. Legal basis (GDPR): legal obligation.
• Communication To respond to your support requests, send account-related notices, and notify you of material changes to this policy. Legal basis (GDPR): legitimate interests / legal obligation.

We do not use your personal information for advertising, marketing profiling, or any purpose not explicitly listed above.

Section 06

Data Sharing & Disclosure

We do not sell your personal information. We do not share your personal information with data brokers, advertising networks, or any third party for their independent commercial use.

We may share data only in the following limited circumstances:

• Infrastructure Service Providers: Cloud hosting, database, and security vendors who process data solely on our behalf under written contracts with confidentiality and data protection obligations at least as protective as this policy. These are data processors, not independent data controllers.
• Legal Requirements: If required by applicable law, court order, or lawful governmental request, we may disclose the minimum data legally required. We will notify you of such requests to the extent permitted by law.
• Business Transfers: In connection with a merger, acquisition, or sale of substantially all assets, your data may be transferred subject to the same privacy protections. We will provide advance notice before your data is subject to a different privacy policy.
• With Your Explicit Consent: For any purpose not listed above, only with your clear, prior, affirmative consent.

In the preceding 12 months, EchoNote AI has not sold, and has not disclosed for a commercial purpose, any personal information to third parties beyond the infrastructure providers described above.

Section 07

Data Security

We implement reasonable and appropriate technical and organizational safeguards to protect your personal information against unauthorized access, loss, destruction, alteration, or disclosure. These measures include:

• TLS/HTTPS encryption for all data in transit.
• Encryption of personal data at rest using industry-standard encryption.
• Google OAuth 2.0 for authentication — we never store your Google password.
• Role-based access controls limiting internal access to personal data.
• Regular security reviews and vulnerability assessments.
• No human access to individual user data except in the limited circumstances described in Section 4.

No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify affected users and applicable regulators as required by law.

Section 08

Data Retention & Deletion

We retain your personal information only as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

• Account Data Retained while your account is active. Deleted within 30 days of an account deletion request.
• Voice Notes & Tasks Retained while your account is active. Deleted within 30 days of an account deletion request.
• Google Contacts Data Not permanently stored. Fetched from the Google API in real time during your session. Session-level references (e.g., a linked contact ID on a note) are deleted with your account data within 30 days of a deletion request.
• Technical Logs Retained for a maximum of 90 days for security and reliability purposes, then automatically purged.

To request account deletion, email support@echovoicenote.com with the subject line "Account Deletion Request." We will process your request and confirm deletion within 30 days. You will receive a written confirmation when deletion is complete.

Section 09

Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information. We honor these rights for all users regardless of location.

How to exercise your rights: Submit a request to support@echovoicenote.com. We will respond within 45 days (extendable by 45 additional days with notice for complex requests). We may verify your identity before processing your request. There is no charge for making a request.

Revoking Google API access: Visit myaccount.google.com/permissions to revoke EchoNote AI's access to your Google account at any time.

California residents may also submit requests by emailing the address above. California residents have all rights listed above under the CCPA/CPRA. We do not sell personal information, so no "Do Not Sell or Share My Personal Information" link is required; however, we will honor any such request submitted to us.

EEA / UK residents have the right to lodge a complaint with your local supervisory authority if you believe your data has been processed in violation of applicable law.

Section 10

Children's Privacy (COPPA)

EchoNote AI is not directed to children under the age of 13 in the United States, or under 16 in the European Economic Area. We do not knowingly collect personal information from children under these ages. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@echovoicenote.com and we will delete that information promptly.

We comply with the Children's Online Privacy Protection Act (COPPA) as required by the Google API Services User Data Policy.

Section 11

International Data Transfers

EchoNote AI is operated from the United States. If you access the Service from outside the United States, your data may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

For EEA and UK users, we rely on the following lawful transfer mechanisms: Standard Contractual Clauses (SCCs) with our infrastructure providers, and our own processing activities relying on SCCs or adequacy decisions where available. By using EchoNote AI, you acknowledge that your data will be processed in the United States in accordance with this Privacy Policy.

Section 12

Cookies & Tracking Technologies

EchoNote AI uses strictly necessary cookies and session tokens to maintain your authenticated session. We do not use advertising cookies, third-party tracking pixels, behavioral analytics, or any cross-site tracking technologies.

• Session cookies: Required to keep you logged in. Expire when you close your browser or log out.
• Preference cookies: Store basic UI preferences (e.g., display settings). Expire after 12 months.

We do not use Google Analytics, Meta Pixel, or any similar third-party analytics or advertising scripts within the authenticated application.

Section 13

Third-Party Services

The Service may contain links to or integrations with third-party websites or services not operated by us. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access. We are not responsible for the privacy practices of third parties.

Section 14

Changes to This Policy

We may update this Privacy Policy from time to time. For material changes — particularly any new way we access, use, or share Google user data — we will:

• Update the "Last Updated" date at the top of this page.
• Send you an email notification to the address associated with your account.
• Display a prominent in-app notice before the changes take effect.
• Obtain your affirmative consent before using your data in any materially new way not disclosed in this policy at the time you originally granted access.

Your continued use of the Service after the effective date of an updated policy constitutes acceptance of the changes. If you do not agree to the updated policy, you must stop using the Service and request account deletion.

Section 15

Contact & Data Controller

For privacy questions, data requests, or concerns: