Privacy

Everything below is the detail behind that. If any of it is unclear, ask us — a privacy notice nobody understands is not doing its job.

The data controller is E8 Labs Ltd (company number 17497405), contactable at hello@echoback.world. Full contact details are at the bottom of this page.

We are small enough that we are not required to appoint a Data Protection Officer. Privacy questions go to the same address as everything else and are answered by a person.

• Account: your email address, the name you chose, your password stored only as a hash, and whether you joined as a creator, artist or producer.
• Profile: anything you choose to add — location, genres, a line about your craft, a short bio. You decide what goes here and you can change or empty it at any time.
• Uploads: the audio you upload, plus what we derive from it — a content fingerprint, a waveform, its duration, and the numerical vectors the matching engine compares.
• Activity: which tracks matched which people, the requests you send or receive, and the messages in your conversations.
• Billing: whether your subscription is active, which plan, and when it renews. Stripe handles the payment itself — we never see or store card numbers.
• Technical: minimal server and error logs, which include an IP address, so we can keep the service secure and find out why something broke.

We do not ask for and do not want special category data — health, politics, religion, sexuality and the rest. Please do not put any in your profile or your messages.

UK GDPR requires us to have a specific legal basis for each thing we do with your data. These are ours:

Notification emails are transactional — they tell you that a real person has contacted you. You can switch them off in your account settings at any time. We do not send marketing email, so there is nothing else to unsubscribe from.

Where we rely on legitimate interests, you can object. Tell us and we will stop unless we have a compelling reason not to, which we would then have to explain to you.

Matching is automated. Your audio is turned into numerical vectors that describe how it sounds — the character of the vocal, the production, the overall style — and those vectors are compared with everyone else’s. Nothing about you as a person goes into it: not your name, not your location, not your profile. It is a judgement about sound.

It produces suggestions, not decisions. No result blocks you from anything, changes what you pay, or has any legal or similarly significant effect, so it is not the kind of automated decision-making that Article 22 of the UK GDPR restricts. A human decides everything that matters here: whether to send a request, and whether to accept one.

If you think a match is wrong, you are welcome to tell us. It helps.

These companies process data on our behalf, under contracts that limit them to doing what we ask. They are not allowed to use it for their own purposes.

We use UK and EU regions where our providers offer them. Some of them nonetheless run parts of their infrastructure, or provide support, from outside the UK and EEA — most often the United States.

Where that happens, the transfer is covered by the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, or by UK adequacy regulations, together with the technical protections below. You can ask us for a copy of the safeguards that apply to a particular provider.

Deleting a track removes the audio file, its fingerprints, its vectors and every match built from it. Deleting your account removes your profile, your uploads, your fingerprints, your matches and your requests.

Backups are overwritten on a rolling cycle, so deleted data can persist in a backup for a short period after it disappears from the service. It is not restored to the live service except as part of recovering from a failure.

• Everything travels over HTTPS, and is encrypted at rest by our storage and database providers.
• Passwords are stored only as salted hashes. Nobody at EchoBack can read yours.
• Audio is never public. Every request for a file re-checks who you are and what you are allowed to hear, and unmatched members cannot reach it at all.
• Access to production data is limited to what is needed to run and repair the service.

No service can promise perfect security, and anyone who tells you otherwise is selling something. If you find a weakness in EchoBack, please tell us at hello@echoback.world before telling anyone else. We will not take legal action against anyone who reports a problem in good faith and gives us a chance to fix it.

If there is a breach of personal data that is likely to be a risk to you, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will tell you directly, without undue delay, if the risk to you is high. We will say what happened, what we know, and what you should do.

Over your personal data you have the right to:

• Be told what we hold and get a copy of it.
• Have anything inaccurate corrected.
• Have it erased. Deletion is immediate and self-service in your account settings.
• Restrict or object to how we use it.
• Receive it in a portable, machine-readable form, or have it sent to another service.
• Withdraw consent, where we relied on consent.

Email hello@echoback.world and we will respond within one month. It is free. If a request is unusually complex we may take up to two months more, and we will tell you why within the first month if that happens.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, by phone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would much rather you came to us first so we can put it right.

We set cookies to keep you signed in, and for nothing else. There is no analytics, no advertising and no cross-site tracking on EchoBack, which is why there is no consent banner to click through — cookies strictly necessary to provide a service you asked for do not need one.

Blocking these will stop you being able to sign in, but you are welcome to clear them whenever you like.

EchoBack is for people aged 18 and over, as the terms of use say. We do not knowingly collect data about anyone younger. If you believe a child has given us their data, tell us and we will delete it.

The date at the top is the date this last changed. If we change anything that materially affects you, we will email you before it takes effect rather than quietly editing the page.