Privacy Policy

Last updated: March 17, 2026

Sentimental OÜ ("Echo", "we", "our", or "us") operates a team wellbeing platform that helps organisations monitor team pulse, prevent burnout, and surface early warning signals — delivered via Slack and Microsoft Teams. This Privacy Policy explains how we collect, use, and protect data for both organisations ("Customers") and their team members ("Users").

1. Who This Policy Applies To

This policy covers:

• Customers: Organisations, HR teams, and team leads who subscribe to Echo and manage a workspace
• Users: Employees and team members who submit check-ins ("Signals") via Slack, Microsoft Teams, or the Echo web app
• Visitors: Anyone who visits findyourecho.app

2. Data We Collect

From Users (individual employees):

• Account Information: Email address, display name, and linked Slack or Teams identity
• Signal Data: Daily check-ins including five performance vectors (Energy, Focus, Social, Anxiety, Satisfaction) on a 0–100 scale, and optional activity tags (e.g. "deep work", "meetings heavy")
• Personal Insights: Pattern analysis and rhythm data derived from a User's own Signal history, visible only to that User

From Customers (organisations):

• Organisation Details: Company name, billing email, and subscription information
• Team Structure: Workspace or team identifiers used to group Signals for aggregated reporting
• Usage Data: Aggregated platform usage metrics (number of check-ins, response rates) to support Customer dashboards

Automatically collected:

• Browser type, device type, and anonymised IP address for security and analytics purposes

3. What Managers and HR Can See

Echo is built on a clear separation between individual privacy and organisational insights:

• Individual Signals are private. A User's raw check-in data is never exposed to managers, HR, or other team members.
• Team dashboards show aggregated data only. Leaders see team-level trend scores, response rates, and early warning alerts — derived from anonymised, aggregated Signal data across the team.
• Minimum group size: Aggregated team data is only surfaced when a sufficient number of team members have submitted check-ins, preventing identification of individuals in small groups.
• Your account stays personal. Each employee's personal trend analysis, AI insights, and historical patterns are visible only to that individual.

4. How We Use Your Data

For Users:

• Delivering your personal account — energy trends, pattern insights, and rhythm visualisations
• Sending scheduled check-in prompts via Slack or Microsoft Teams
• Generating personal insights from your Signal history

For Customers:

• Providing the team pulse dashboard, burnout early warning signals, and engagement trend reporting
• Processing subscription billing and managing account access
• Sending product updates, onboarding guidance, and support communications

For all:

• Improving the Echo platform and developing new features
• Ensuring security and preventing abuse

5. Data Storage & Security

All data is stored on Google Firebase infrastructure (Firestore), hosted in the European Union. We apply appropriate technical and organisational security measures including encrypted data transmission (TLS), access controls, and regular security reviews.

Signal data is stored linked to a User's account. Organisational aggregates are computed server-side and stored separately from individual records.

6. Third-Party Services

• Google Firebase / Firestore: Authentication and data storage (EU hosting)
• Google Analytics: Anonymous visitor statistics on the marketing website
• Stripe: Subscription billing for Customer accounts. Payment card data is handled entirely by Stripe and is never stored by Echo.
• Slack / Microsoft: OAuth integration for authentication and in-platform message delivery. Echo does not store Slack or Teams message content beyond the structured Signal data Users explicitly submit.

7. Data Sharing

We do not sell personal data. We do not share individual User Signal data with Customers, third parties, or other Users. We may share aggregated, anonymised, non-identifiable statistical data for research or product improvement purposes.

We may disclose data if required by law or to protect the rights, property, or safety of Echo, our Customers, or Users.

8. Data Retention

User Signal data is retained for as long as an account is active. Customers may request deletion of all organisational data upon contract termination. Individual Users may delete their account and all associated data at any time from within the app.

9. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Request an export of your data in a machine-readable format
• Restriction: Request that we limit processing of your data
• Objection: Object to processing based on legitimate interests

To exercise any of these rights, contact us at echo@findyourecho.app. We will respond within 30 days.

10. Data Processing Agreements

For enterprise Customers who require a Data Processing Agreement (DPA) under GDPR Article 28, please contact us at echo@findyourecho.app. Sentimental OÜ acts as a data processor on behalf of the Customer organisation, which acts as the data controller for its employees' data.

11. Children's Privacy

Echo is a workplace tool intended for use by adults in professional settings. We do not knowingly collect data from anyone under 16 years of age.

12. Changes to This Policy

We may update this Privacy Policy as the product evolves. Material changes will be communicated to active Customers via email. The current version is always available at this URL.

13. Contact

Sentimental OÜ
Registry code: 17067534
Estonia

Privacy enquiries: echo@findyourecho.app