EchoBackAI ("EchoBack," "we," "us," or "our") provides a service that reads reviews left on a business's Google Business Profile and drafts or posts replies on the business owner's behalf. This Privacy Policy explains what information we collect, how we use it, and the choices you have — including when that information comes from your Google Account.
1. Information We Collect
When you connect your Google Business Profile to EchoBack, we receive:
- Basic Google profile info: your name, email address, and profile picture, used to identify your account.
- Business Profile data: the names, addresses, and categories of the locations you manage on Google.
- Review data: reviewer display names, star ratings, review text, and the timestamps of reviews left on your locations, along with any existing replies.
- Reply content: the drafts EchoBack generates and the replies you approve and post back to Google.
We also collect standard account and billing information (such as your subscription status) and basic usage data (such as when you sign in) to operate and improve the service.
2. How We Use Your Information
We use the information above solely to:
- Authenticate you and identify the Business Profile locations you manage;
- Retrieve new reviews on a regular schedule so we can draft replies;
- Generate suggested reply text using an AI language model, written in a tone that matches your business;
- Publish a reply back to Google Business Profile only when you have approved it, or automatically for reviews that meet the auto-reply criteria you've configured;
- Send you notifications (for example, when a draft reply needs your approval);
- Operate billing through our payment processor and provide customer support.
We do not use your Google user data for advertising, and we do not sell your data to third parties.
3. Who We Share Data With
We share information only with the service providers that help us run EchoBack, under agreements that limit how they may use it:
- AI drafting provider (Anthropic) — receives the text of a review so it can draft a suggested reply. It does not receive your Google credentials.
- Payment processor (Stripe) — handles subscription billing; we do not store your card details ourselves.
- Cloud infrastructure providers — host our database and servers.
We do not share your data with any other third party except where required by law.
4. Data Retention & Deletion
We retain your Google refresh token and review data only while your account remains connected, so that replies can continue to sync. If you disconnect your Google account or delete your EchoBack account, we delete your stored Google tokens and stop accessing your Business Profile. You can request full deletion of your account data at any time by emailing support@echoback.ai.
5. Data Security
Access tokens and refresh tokens are stored encrypted at rest. Access to production data is limited to the personnel who need it to operate the service.
6. Your Choices
EchoBack is read-only until you explicitly turn on auto-reply for a location. You can disconnect your Google account, change your reply preferences, or delete your account at any time from within the app.
7. Children's Privacy
EchoBack is a business tool and is not directed at, or knowingly used by, anyone under the age of 16.
8. Changes to This Policy
We may update this policy from time to time. If we make material changes, we'll notify you by email or within the app before the changes take effect.
9. Contact Us
Questions about this policy or your data can be sent to support@echoback.ai.