Data Protection & Consent

Last updated: August 22, 2026

This Data Protection Policy explains how EchoStream collects, uses, and protects your personal data, and describes the consent you provide when using our Service. It is provided in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and other applicable data protection laws.

1. Data Controller

The data controller responsible for your personal data is:

  • Name: Polina Yamova
  • Address: Av. Trabajadores Inmigrantes 10, 1A, Sevilla, España, 41009
  • Email: yamovapolina@gmail.com

By using the Service, you consent to the processing of your personal data as described in this Policy.

2. Your Consent

By creating an account, uploading audio files, and using EchoStream's features, you freely, specifically, and unambiguously consent to the collection and processing of your personal data as described in this Policy.

You have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. To withdraw consent, contact yamovapolina@gmail.com or delete your account from Settings.

Specifically, you consent to:

  • Account data: Your name and email address are collected to create and manage your account.
  • Audio data: Audio files you upload are processed to generate transcripts and AI-powered insights.
  • Usage data: Information about how you use the Service (e.g., minutes used, feature usage) is collected to provide and improve the Service.
  • Technical data: IP address, browser type, and device information are collected for security and operational purposes.

3. Legal Basis for Processing

We process your personal data under the following legal bases (GDPR Art. 6):

  • Consent (Art. 6(1)(a)): For analytics, marketing communications, and optional features such as Client Memory and Cross-Cultural Risk Detector.
  • Contract (Art. 6(1)(b)): For processing necessary to provide the transcription and analysis services you requested.
  • Legal obligation (Art. 6(1)(c)): For retaining records required by law (e.g., tax records for payments).
  • Legitimate interests (Art. 6(1)(f)): For security, fraud prevention, and service improvement.

4. Categories of Personal Data

  • Identification data: Name, email address
  • Content data: Audio files, transcripts, AI-generated analysis
  • Payment data: Billing information processed by Stripe (we do not store your card details)
  • Usage data: Subscription plan, minutes used, feature usage
  • Technical data: IP address, browser type, device information

5. Purposes of Processing

  • Providing transcription, translation, and AI-powered analysis of your audio files
  • Managing your account and subscription
  • Processing payments through Stripe
  • Improving the Service and developing new features
  • Ensuring security and preventing abuse
  • Complying with legal obligations

6. Data Retention

  • Audio files: Retained until you delete the transcription or close your account
  • Transcripts & AI analysis: Retained until you delete them or close your account
  • Account data: Retained while your account is active; deleted within 90 days of account closure
  • Payment records: Retained as required by applicable tax law (typically 4–7 years)
  • Usage logs: Retained for up to 12 months for security and analytics

You can request deletion of your data at any time from within the app or by contacting yamovapolina@gmail.com.

7. Data Sharing & Recipients

We do not sell your personal data. We share data only with the following categories of processors:

  • Stripe — payment processing (PCI-DSS compliant; we never store your card details)
  • OpenAI — transcription (Whisper) and AI-powered analysis (under their data processing agreement; content is not used to train their models)
  • Cloud infrastructure providers — hosting and storage

Each processor is bound by a data processing agreement and processes data only on our instructions.

8. International Data Transfers

Your data may be processed by our service providers in countries outside your country of residence (e.g., the United States). Such transfers are made under appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, or under an adequacy decision for the receiving country.

9. Automated Decision-Making & Profiling

EchoStream uses AI to generate transcripts, summaries, and analysis from your audio files. This is not automated decision-making that produces legal or similarly significant effects about you. All AI-generated insights are advisory — you are responsible for reviewing and verifying them before acting.

The Client Memory feature builds a relationship profile from your stored transcriptions. This is processing of data you provided, for your own use, and does not involve profiling of third parties.

10. Your Rights Under GDPR

You have the following rights regarding your personal data:

  • Right of access (Art. 15): Request a copy of your personal data
  • Right to rectification (Art. 16): Correct inaccurate or incomplete data
  • Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten")
  • Right to restriction (Art. 18): Limit the processing of your data
  • Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
  • Right to object (Art. 21): Object to processing based on legitimate interests
  • Right to withdraw consent (Art. 7(3)): Withdraw consent at any time

To exercise any of these rights, contact yamovapolina@gmail.com. We will respond within one month of your request.

11. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with this Policy, you have the right to lodge a complaint with your local data protection supervisory authority. You can find your local authority through the European Data Protection Board.

12. Data Security

We implement industry-standard security measures including:

  • Encryption in transit (HTTPS/TLS) for all data transfers
  • Encrypted storage for audio files and transcripts
  • Strict access controls — your data is only accessible to you and authorized administrators
  • Row-level security policies that prevent users from accessing each other's data
  • Regular security reviews and updates

13. Children's Data

EchoStream is not intended for children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact yamovapolina@gmail.com and we will delete it.

14. Changes to This Policy

We may update this Data Protection Policy to reflect changes in our practices or legal requirements. We will notify you of significant changes by email or a prominent notice on the platform. Your continued use of the Service after changes constitutes acceptance of the updated Policy.

15. Contact

For any questions about this Data Protection Policy or your personal data, contact us at yamovapolina@gmail.com.