Privacy Policy

The short version

We collect what you give us on our website and in the app, plus basic technical details, and use it to run ECHOPS and talk to you.
When a contractor uses ECHOPS, the information about their clients, crews and jobs belongs to that contractor. We handle it only for them.
We don't sell personal information for money, and we don't use anyone's personal information to train AI models.
Our website uses Google and Meta tags, and we send scrambled (hashed) contact details, to measure and target our own ads. We never send them the phone number of anyone who agreed to get texts from us. You can opt out with “Your privacy choices”.
Your mobile number and your consent to receive texts are never shared with third parties for their marketing.
We publish how long we keep information and who processes it for us.
You can ask to see, correct or delete your information by emailing info@echops.com.

1. Who we are and what this policy covers

ECHOPS is software for contractors, operated by CTU Consulting LLC ("ECHOPS", "we", "us"), 1775 Tysons Blvd, McLean, VA 22102. You can reach us at info@echops.com.

We play two roles:

For our own business, we decide how information is used (we're the "controller"). That covers visitors to our website, people who ask about ECHOPS, the people who use ECHOPS at our customers' companies, billing contacts, and our own calls, texts and emails.
For our customers, we handle the information a contractor puts into its ECHOPS workspace only on that contractor's behalf (we're its "processor" or "service provider"). That includes the contractor's leads, clients, subcontractors and crew. Our Terms of Service set out how we handle it.

2. If a contractor uses ECHOPS to work with you

If you're a homeowner, a client, a subcontractor or a crew member of a company that uses ECHOPS, that company decides what information about you goes into ECHOPS and how it's used. Calls, texts and emails you get from it come from that company, even when they're sent through ECHOPS. To see, correct or delete your information, or to stop its messages, contact that company. Reply STOP to its texts to stop texts from that company's number. If you contact us instead, we'll pass your request to the company and help it respond.

Facebook and Instagram lead ads. A contractor can connect its Facebook Page to ECHOPS so that leads from its Facebook and Instagram lead ad forms arrive in its ECHOPS workspace. When it does, Meta gives ECHOPS an access token for that Page, which we keep encrypted. Each time someone submits one of that contractor's lead forms, we read that lead from Meta (the answers on the form, such as name, phone, email, ZIP code and project details, and which ad and form it came from) and place it in that contractor's workspace only. We use this information only to deliver the lead to the contractor who ran the ad. We don't sell it, use it for our own advertising, or share it with anyone except the service providers that run ECHOPS. The contractor can disconnect the Page at any time in Integrations, which erases the token and stops new leads. Leads already delivered stay in the contractor's workspace until the contractor deletes them or the workspace is deleted as section 10 describes. To have lead information deleted, contact the contractor whose ad you answered, or email info@echops.com and we'll help.

3. What we collect

On our website

What you type into our forms: your name, company, email, phone number, trade, team size, the plan you're interested in, your message, and whether you agreed to receive texts.
How you found us: the page you landed on, the site that sent you, and campaign tags such as utm_source or ad click IDs. These are kept in your browser during your visit and sent with any form you submit.
Technical details our website host records, such as your IP address, browser type and the pages you visit.

When you use ECHOPS

Your account details: name, email, phone number, job title, photo, time zone and email signature, if you add them.
How you sign in: email links, passkeys, your Google or Microsoft account if you use it to sign in, your second-step settings, and sign-in records such as the time, IP address and browser.
Connections you set up, such as your email account, calendar or other tools. We store the keys these services give us, encrypted, and not your passwords.
How you use ECHOPS: the features you use, when you're active, and error details. Owners and admins of your company can see activity in their workspace, including active time.
Business details phone carriers ask for if we register a business number for your company, such as its legal name, tax ID, address and a contact person.
Billing details: your plan, invoices and payment status. Stripe processes payments, and we never see or store full card numbers.
Messages and calls with us: support requests, emails, texts, voicemails and, with a spoken notice, recordings of calls with our team.
Your location, only if you allow your browser to share it when you use On my way or the route planner’s “My location”. It’s used once to work out an arrival time and isn’t stored (section 13).

If you connect your Google account

Sign in with Google: your name, email address and profile photo, to sign you in.
Gmail (send only): to send the emails you write in ECHOPS from your own Gmail address. ECHOPS can't read, search or delete your email.
Google Calendar: to add, update and remove your appointments and meetings from ECHOPS in your calendar, and to read the start and end times of your other events so you aren't booked when you're busy. We never read or keep their titles, descriptions or guests.

We store the keys Google gives us encrypted. We don't sell Google user data, use it for advertising or use it to train AI models, and no one at ECHOPS looks at it unless you ask us for help, it's needed for security, or the law requires it. You can disconnect Gmail or Google Calendar in ECHOPS at any time, which deletes the keys and busy times we hold, or remove ECHOPS's access at myaccount.google.com/permissions.

ECHOPS's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use it

To answer your request, book your demo, open your trial and provide ECHOPS.
To contact you about your request or your account by email, phone, or text if you agreed to texts.
To bill you and keep business records.
To keep ECHOPS secure, prevent fraud and abuse, and fix problems.
To understand which pages, campaigns and features work, so we can improve them.
To measure and target our own advertising, as section 7 describes.
To meet legal obligations and protect our rights, our users and the public.

We collect only what we need for these purposes.

5. AI

ECHOPS includes AI features, such as ECHO, the AI teammate, Write with AI, call summaries, transcripts and design images. When you use them, the AI providers listed in our Trust center process the information needed to return a result, under business terms that don't let them train their models on it.

We don't use personal information to train large language models or other AI models. We don't use personal information to make automated decisions that have legal or similarly significant effects on anyone. ECHO proposes changes and makes them only after a person confirms.

6. Calls and texts

If you check the box on one of our forms, we may text you about your request. Message frequency varies. Message and data rates may apply. Reply STOP to opt out and HELP for help. Our SMS Terms have the details.
We may record calls with our team, and you'll hear a notice first. Companies that use ECHOPS can record their own calls, with a spoken notice, and those recordings belong to that company.
No mobile information will be shared with third parties or affiliates for their marketing or promotional purposes. All the categories of sharing in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. If you agreed to get texts from us, we never send your phone number to Google or Meta, including to measure our ads. We may still send them a hashed copy of your email address, as section 7 describes.

7. Advertising

Our website and our sign-up and booking pages use Google Analytics, Google Ads and Meta tags. They tell Google and Meta which pages you visit and what you do there, such as starting a trial, requesting a demo or booking a call (never what you type into a form), along with cookie and device identifiers and the ad that brought you, so we can measure our ads and show them to the right people. You can turn off the advertising tags in your browser with “Your privacy choices” at the bottom of our pages, and we treat a Global Privacy Control signal from your browser the same way. To learn which of our ads lead to a booked demo or a new customer, and to show our ads to the right people, we also send Google and Meta scrambled (hashed) copies of contact details from our own sales records: email addresses, and for measuring results, phone numbers, names, and city, state and ZIP code. We leave out the phone number of anyone who agreed to get texts from us; for them we may send only the hashed email address. Hashing turns details into codes that these companies can only match to people already on their services. We never send them information from a contractor’s workspace for our own ads.

Some state laws call this "targeted advertising", "sharing" or a "sale" (section 13 has California's details). To turn off our advertising tags, use “Your privacy choices” or send a Global Privacy Control signal. To keep your contact details out of what we send, email info@echops.com with the subject "Ad opt-out" and the email address and phone number to exclude.

8. Cookies

Our website and our sign-up and booking pages use cookies they need to work; analytics from Google Analytics and Microsoft Clarity, which show how pages are used (Clarity records clicks, scrolling and page views); and advertising cookies from Google Ads and Meta, as section 7 describes. They also use your browser's storage for the campaign tags described in section 3. “Your privacy choices” turns the advertising cookies off for that browser. The ECHOPS app uses cookies to keep you signed in, keep your session on your company's own address, and remember settings such as light or dark display. We don't use analytics or advertising cookies inside a company's workspace.

Service providers who run parts of ECHOPS for us, such as hosting, the database, email delivery, phone and texting, AI features, video meetings and error tracking. They're listed in our Trust center, and they may use the information only to provide their service to us. Our website is hosted by Webflow.
Stripe, which processes payments under its own Privacy Policy.
The phone carriers' registry, through our phone provider, when we register a business number for your company.
Services you connect, such as Google or Microsoft for sign-in, email and calendars, QuickBooks Online for your books, or tools like CallRail and Zapier, when you choose to connect them.
Google and Meta, for our own advertising, as section 7 describes.
Authorities, when the law requires it, or to protect our rights, our users or the public.
A buyer or successor, if our business is sold or reorganized, under this policy.

We don't sell personal information for money, and we never use one company's workspace data for another company or for our own marketing.

10. How long we keep it

A company’s workspace data: while it subscribes. After a paid subscription is cancelled, the workspace stays read-only for 90 days so the company can download its data, and we delete the data within the next 30 days. Backups roll off on their normal schedule, currently within 7 days after that.
Trial workspaces that don't choose a plan: deleted 30 days after the trial ends.
Sign-ups that are started but never finished: deleted after 30 days.
Raw lead submissions, exactly as they arrived from a company's forms, webhooks and lead emails: 90 days, then deleted. The leads themselves stay with the workspace.
In-app notifications: 60 days.
Uploaded files that are never attached to anything: deleted every night.
Records of people who asked not to be texted: kept for at least 10 years, so we keep honoring the request.
Billing and tax records: as long as tax and accounting laws require.
Our own sales records: as long as we have a reason to keep in touch or a legal reason to keep them.

11. Security

Each company's data is kept apart from every other company's. People sign in without passwords and owners and admins add a second step, connected services' keys are encrypted, and access is limited by role. The ECHOPS team can only open a company's workspace for support with a time-limited grant that shows in that company's activity log. Error reports leave out personal information. Our Trust center has the details. No system is perfectly secure, so we can't guarantee absolute security. If a breach affects your information, we'll notify you and the company you work with as the law requires.

12. Your rights and choices

Depending on where you live, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, you may have the right to:

know what personal information we have about you and get a copy;
correct it;
delete it;
opt out of targeted advertising, "sharing" and sale (we don't sell for money);
not be treated differently for using these rights.

We offer these choices to everyone, wherever you live. To use them, email info@echops.com with the subject "Privacy request". We'll confirm who you are before acting, and we'll answer within 45 days. If we need more time, we'll tell you, and we may take up to 45 more days. Someone you authorize can make a request for you.

If we turn down your request, you can appeal by replying with the subject "Privacy appeal" within 60 days. We'll answer within 60 days. If you're still not satisfied, you can contact your state attorney general.

You can also opt out of texts by replying STOP, and out of marketing emails with the unsubscribe link in any email. If a contractor that uses ECHOPS holds your information, see section 2.

13. California residents

This section adds the details California's privacy law (the CCPA) asks for. We give California residents these rights whether or not the law requires it of a business our size. It describes the last 12 months. It doesn't cover information a contractor keeps about you in its ECHOPS workspace: ask that contractor (section 2).

What we collect, where it comes from and who receives it

Identifiers, such as your name, email, phone number, postal address, IP address and account ID. They come from you, your browser and the sign-in service you choose. We disclose them to our service providers, and we send hashed copies of your email, phone number, name, city, state and ZIP code to Google and Meta for our advertising (section 7). If you agreed to get texts from us, your phone number is never sent to them.
Commercial information, such as the plan you're interested in, the demos you book, your plan, invoices and payment status. It comes from you and from Stripe. We disclose it to our service providers and Stripe, and we tell Google and Meta when someone books a demo or becomes a customer, with the first month's price.
Internet activity, such as the pages you visit on our website, the site that sent you, ad click IDs and how you use ECHOPS. It comes from your browser and the app. We disclose it to our service providers, including Google Analytics and Microsoft Clarity for our website, and our website's tags and our own systems send page visits, actions such as a booked demo, and ad click IDs to Google and Meta to measure and target our ads.
Audio: recordings of calls with our team, made after a spoken notice, and voicemails you leave us. We disclose them to our service providers.
Professional information, such as your company, job title, trade and team size, and the business details phone carriers ask for when we register a business number for your company. It comes from you. We disclose it to our service providers and, for a business number, to the carriers' registry through our phone provider.

We use each category for the purposes in section 4 and keep it as section 10 describes.

Sensitive information.The sensitive personal information we handle, as California defines it, is what signs you in to your account and, only when you allow your browser to share it, your phone’s precise location for On my way or the route planner’s “My location”. We use that location once to work out an arrival time and don’t store it; when Google Maps is on, it’s passed to Google’s routing to get the drive time. We use sensitive information only for these purposes, and we don’t use it to infer anything about you.

Selling and sharing. We don't sell personal information for money. Our website's advertising tags, and sending hashed identifiers and ad click IDs to Google and Meta for our ads, may count as "selling" or "sharing" under California law, so we treat them as both and let you opt out. We don't sell or share the personal information of anyone we know is under 16. We don't give personal information to other companies for their own marketing.

Your California rights. You can ask to know the categories and specific pieces of personal information we have about you, its sources, why we use it and who receives it; to correct it; to delete it; and to opt out of its sale or sharing. To opt out of our advertising tags, use “Your privacy choices” at the bottom of our pages or send a Global Privacy Control signal. To opt out for the contact details we send, email info@echops.com with the subject "Ad opt-out" and the email address and phone number to exclude. We act on opt-outs within 15 business days. For the other rights, email us with the subject "Privacy request". We verify a request by matching details we already have, and we answer within 45 days, or tell you if we need up to 45 more. Someone you authorize can make a request for you with your signed permission. We won't treat you differently for using these rights, and we don't offer financial incentives for personal information.

14. Children

ECHOPS is a business tool for adults. It isn't directed to children, and we don't knowingly collect personal information from anyone under 16. If you think we have, email us and we'll delete it.

15. Where information is stored

ECHOPS stores data in the United States, with the database in the East US region.

16. Changes to this policy

If we make a material change, we'll post it here, update the date at the top, and tell ECHOPS customers by email and in the app before it takes effect. We won't use personal information we already have in a materially new way without your consent.

17. Contact

Questions about privacy: info@echops.com, or CTU Consulting LLC, 1775 Tysons Blvd, McLean, VA 22102.