1. Introduction
Echoed Moments is operated by Echoed Moments Ltd ("Echoed Moments", "we", "our" or "us"), which is responsible for operating the Platform and acts as the data controller for the personal information described in this Privacy Policy.
This Privacy Policy explains how we collect, use, store and protect your personal information when you use our website and related services (the "Platform"). By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy. It should be read alongside our Terms & Conditions, Acceptable Use Policy and Refund & Cancellation Policy.
2. Information We Collect
Information you provide
- Full name
- Email address
- Password (stored as a secure cryptographic hash and never in plain text)
- Date of birth
- Profile information
- Membership details
Content you create
- Written messages and reflections
- Letters to future recipients
- Photographs and images
- Audio recordings
- Video recordings
- Scheduled release dates
- Delivery instructions
- Personal notes
Recipient information
Where you choose to send content to another person in the future, we may collect the recipient’s name, email address, relationship to you, and delivery instructions.
Technical information
- IP address
- Device type
- Browser information
- Operating system
- Login history
- Usage information
- Cookies and similar technologies
Payment information
Payments are processed through Stripe, our third-party payment provider. We do not store full debit or credit card details; these are handled directly by Stripe.
Metadata
We may also collect information relating to the operation of the Platform, including file sizes, upload dates, delivery status, message status, login timestamps, device identifiers and security logs.
Information we do not collect
Echoed Moments does not intentionally collect personal information beyond that reasonably required to provide, maintain and secure the Platform. We do not sell, rent or trade personal information and do not use private user content for advertising, profiling, marketing or artificial intelligence model training. User content is encrypted in transit and at rest using industry-standard encryption, and access is strictly controlled and limited to authorised circumstances in accordance with our policies and applicable law.
3. How We Use Your Information
We use your information to create and manage your account; store and secure your content; schedule and deliver messages; verify your identity; process membership payments; provide customer support; improve, maintain and troubleshoot the Platform; monitor platform security; prevent fraud and misuse; comply with legal obligations; and investigate suspected breaches of our policies.
4. Special Category and Sensitive Content
The content stored within Echoed Moments may contain highly personal, emotional or sensitive information. Where the content you choose to store includes special category data (for example, information revealing health, religious or philosophical beliefs, or details of your relationships), you provide and control that content, and we process it only to provide the Platform to you, in accordance with your instructions and on the basis of the explicit consent you give by choosing to upload it. You may withdraw that consent at any time by deleting the content or closing your account.
Echoed Moments does not proactively inspect, monitor, analyse or profile the contents of private user content during the ordinary operation of the Platform. Users remain solely responsible for the content they choose to upload.
5. Legal Basis for Processing
We process personal data under one or more of the following legal bases: contractual necessity (to provide the services you request); consent (including your explicit consent for any special category content you choose to store, and for non-essential cookies and re-engagement emails); legitimate interests (to improve, maintain and secure the Platform, prevent fraud, investigate misuse and protect users); and legal obligations (where processing is required to comply with applicable laws).
6. Future Delivery
Echoed Moments enables you to schedule content for future delivery on a date or milestone you choose. To facilitate this, we may store scheduled release instructions, recipient names and contact details, and delivery status records. We will only process and release content in accordance with the instructions you establish and applicable law.
7. Data Storage and Security
We take reasonable technical and organisational measures to protect personal information, which may include industry-standard encryption for personal information and user content in transit and at rest; secure cloud infrastructure; password protection; multi-factor authentication where available; access controls; security monitoring; routine backups; audit logging; and security incident monitoring. No method of electronic transmission, storage or processing can guarantee absolute security. Users are responsible for maintaining the confidentiality of their account credentials and using available security features.
8. How Long We Retain Information
We retain personal information only for as long as necessary to provide our services and fulfil legal obligations. Content may remain stored while an account remains active, until scheduled delivery has occurred, until you request deletion, or until account closure and deletion procedures have been completed.
Where a membership lapses, your content is preserved for a period of 12 months, during which you may reactivate your membership or export your content. After the 12-month preservation period, the account may be closed and content returned to you and then removed, in accordance with our Refund & Cancellation Policy and the applicable membership terms. Certain information may continue to be retained for a limited period where required for legal, regulatory, fraud prevention, audit or security purposes, including within secure backup systems, limited to the minimum necessary.
9. Sharing Information
We do not sell, rent or trade personal information. We share information only with third-party providers who act as our processors and only for authorised purposes consistent with this Privacy Policy. Our current processors include:
- Amazon Web Services — cloud hosting and storage
- Stripe — payment processing
- Postmark — transactional and service email delivery
We may also share information with professional advisers and with law enforcement authorities where legally required. We take reasonable steps to ensure that third-party providers process personal information securely, confidentially and only for authorised purposes.
10. International Data Transfers
Some of our service providers, including certain technology and development providers, may process data outside the United Kingdom. Where personal data is transferred outside the UK, we put in place a lawful transfer mechanism — such as an International Data Transfer Agreement or the UK Addendum to the standard contractual clauses — together with a written data processing agreement, so that your information continues to be protected.
11. Automated Decision-Making
Echoed Moments does not use solely automated decision-making or profiling to make decisions that produce legal or similarly significant effects on users. Where automated technologies support platform security, fraud prevention or operational processes, they will not replace appropriate human oversight where required by applicable law.
12. Your Rights
Subject to applicable law, you may have the right to access your personal information; correct inaccurate information; request deletion; restrict processing; object to processing; withdraw consent; request data portability; and lodge a complaint with the Information Commissioner’s Office. Requests can be submitted using the contact details below.
13. Cookies
We use essential cookies that are necessary for the Platform to function, such as keeping you logged in. Where we use any non-essential cookies (for example, analytics), we will ask for your consent through a cookie banner and set out the detail in a separate Cookie Policy. You can manage your preferences at any time.
14. Account Deletion
Users may request deletion of their account. Deletion requests may result in the permanent removal of account information, uploaded content, scheduled messages and associated delivery instructions, and may affect future scheduled deliveries. Certain records may continue to be retained for a limited period where required for legal, regulatory, fraud prevention, audit or security purposes, including within secure backup systems. Where content has already been delivered to a recipient, Echoed Moments may be unable to retrieve or delete copies already received.
15. Children’s Privacy
Echoed Moments is intended for account holders aged 18 years and over. We do not knowingly collect personal information from, or create accounts for, anyone under 18. If we become aware that an account has been created by a person under 18 without appropriate authorisation, we may suspend or delete the account.
A vault may, however, be scheduled for delivery to a recipient who is under 18, including a young child. In that case no account is created for the recipient; the content is delivered to the contact details you provide, and you are responsible for ensuring that delivery to that recipient is appropriate and lawful, and that consent for a child recipient sits with you or the child’s parent or guardian.
16. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to the Platform, applicable law, regulatory requirements or our processing activities. The latest version will always be available through the Platform and website. Where changes are material, we may notify users using the contact details associated with their account.
17. Contact Us
If you have questions regarding this Privacy Policy, please contact us using the details below. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection matters, if you believe your personal information has been handled unlawfully or improperly.
Echoed Moments Ltd.Email: info@echoedmoments.co.uk Website: www.echoedmoments.co.uk
Echoed Moments Ltd. Company No: 17439686. Registered Office: 1 Kensington Avenue, Ashton-Under-Lyne, United Kingdom, OL6 8EH.