Privacy Policy

1. Scope and responsible parties

This Privacy Policy explains how the legal entity identified above, operating EleonEcho (“we”, “us”, or “our”), handles personal information in connection with our website and the EleonEcho services we provide. “Services” includes enabled publishing, marketing, messaging, support, automation, AI and related account features. This policy covers the features you actually use; listing a feature does not mean it is active in your workspace.

We determine the purposes of processing website inquiries, our business relationships, account administration, billing and service security. For those activities, we act as a controller or equivalent business under applicable privacy law. When a customer decides whose information to import, which channels to connect, and how to use customer conversations or content, that customer is normally the controller and we process the information on its instructions. A customer may itself act for another controller.

The applicable data processing agreement governs processing on a customer’s behalf. This policy does not replace that agreement, the customer’s privacy notice, or our own legal obligations. If your employer, a business you contact, or another organization provides your workspace or support portal, its administrator controls the relevant account and should receive requests concerning its data.

2. Information and its sources

• Website and device information: IP address, request time, requested URL, browser and operating-system information, referring page where supplied, and response or error details in hosting and security logs.
• Account and business information: names, business email addresses, organization details, user identifiers, roles, authentication records, preferences, correspondence and the terms version accepted, when account services are used.
• Commercial records: selected services, orders, invoices, payment status and transaction references when paid services are used. Payment information handled directly by a payment provider is also subject to that provider’s notice.
• Customer content: posts, drafts, prompts, knowledge sources, files, attachments, recipient lists, contact details, consent and suppression records, tickets, internal notes, messages and replies supplied by you or your organization.
• Connected-service information: authorized account and destination identifiers, profile information, access permissions, authorization credentials, message content and metadata, delivery results and synchronization records, depending on the integration and permissions granted.
• AI and operational information: instructions and context submitted to enabled AI features, generated output, tool actions, usage, audit and diagnostic records, and support or abuse reports.

Information comes from you, your administrators and authorized users, the people who communicate with your organization, connected providers you authorize, and operation of the Services. Publicly accessible information is still subject to applicable privacy law and platform restrictions. Do not include passwords, authentication secrets or unnecessary sensitive information in prompts, public posts, support requests or URLs.

3. Purposes and legal grounds

We use information to deliver the selected Services: administer accounts and permissions; synchronize authorized channels; process publishing and messaging instructions; organize support requests; run requested AI features; provide support; maintain reliability and security; prevent abuse; handle billing; and meet legal obligations.

Where a legal basis is required for processing we control, we rely on performance of our contract with an individual for account and service delivery; legitimate interests for business administration, support, security, fraud prevention and technical improvement, after considering affected individuals’ rights; legal obligations for required financial records and lawful requests; and consent for optional processing that requires it. Contractual necessity is not a blanket legal basis for information about someone who is not a party to our contract.

For customer-controlled content, the customer determines the lawful purpose and legal basis, and our processing follows its lawful instructions and the applicable processing agreement. Service messages about security, billing or an account are distinct from promotional communications. Marketing consent, where required, must be obtained separately. Accepting the Terms of Use does not provide consent for every use of personal information.

Providing information is generally voluntary, but we may be unable to supply an account, process a transaction or answer a request without the information reasonably needed for it.

4. Social accounts, mailboxes and connected services

Connecting an account authorizes the enabled operations within the permissions granted, such as retrieving permitted mailbox messages, importing relevant conversations, publishing approved content, or sending replies. Workspace administrators determine the accounts, destinations, audience and users permitted to access those operations. Provider credentials are used to maintain the authorized connection; they are not intended to be visible to ordinary workspace members.

Connected platforms receive content and associated data when you instruct the Services to communicate with them. They apply their own terms, privacy rules, retention and account controls. Your audience, recipients and administrators may retain or redistribute material you share. Removing a post or record from Echo does not automatically remove a copy from a recipient’s device, an upstream mailbox or a social network.

You can withdraw provider authorization using the provider’s account controls and disconnect the integration using available workspace controls. Revoking authorization stops future access under that authorization; it is a separate action from deleting information already processed. Request deletion through the responsible workspace administrator or the contact above. The connected-platform policies also apply to your use.

5. Google and Gmail data

Where a Google or Gmail connection is enabled, EleonEcho’s use of information obtained through Google APIs must comply with the Google API Services User Data Policy and, for Workspace data, the Google Workspace API policy, including their Limited Use restrictions.

Such data may be processed only for the permitted, disclosed features authorized by the user. It must not be sold, used for advertising or credit assessment, or used to train or improve a general-purpose AI model. Transfers and human access must remain within Google’s permitted exceptions; a general content license or business-transfer clause does not override those restrictions.

Review or revoke access in your Google account connections. Request deletion of retained Echo records separately as described in this policy. These requirements are conditions of operating the integration, not a claim of Google certification.

6. AI processing and human review

When a customer enables an AI workflow, the information needed for that task may be sent to the configured model or tool provider. This can include prompts, selected messages, knowledge material, attachments, instructions and output. The customer must select appropriate tools and access permissions and provide required notices to affected individuals. Only submit information you are authorized to process in that workflow.

Provider-specific processing locations, retention and any model-improvement settings must be disclosed for the selected deployment before customer data is submitted. This policy does not authorize training a provider’s general-purpose models on customer content. Any proposed secondary use needs a separate, explicit disclosure and a lawful basis; Google data remains subject to the restrictions above.

Authorized administrators and personnel may access information where needed to provide requested support, maintain the service, investigate abuse or comply with law, subject to access restrictions and any stricter provider terms. Customers may configure automated responses or actions. They are responsible for assessing whether their workflow requires human intervention, an explanation or other safeguards under applicable law.

7. Recipients and disclosures

We disclose information only as needed for the purposes described here, including to:

• Authorized users, administrators and recipients designated by the customer.
• Service providers engaged for hosting, storage, communications, payment processing, AI, technical support and security, to the extent used in the selected service and subject to appropriate obligations.
• Connected platforms and tools when an authorized workflow requires the disclosure.
• Professional advisers, authorities or other parties where reasonably necessary to comply with law, respond to valid legal process, protect legal rights or investigate fraud and abuse.
• A proposed or actual successor in a corporate transaction, subject to confidentiality, applicable law, purpose restrictions and any provider-specific consent requirements.

The providers actually engaged, their locations and relevant safeguards must be identified in the applicable service or processing documentation. This policy does not grant permission to sell personal information or share it for cross-context behavioral advertising. The current marketing website does not include advertising pixels or third-party analytics integrations.

8. Cookies, browser storage and the website

The current static marketing website contains no third-party analytics or advertising pixels and sets no visitor-tracking cookies through its site code. Its guided examples use fictional content and do not send messages, create accounts or tickets, or publish posts. Ordinary hosting and security request logs may still be generated when a page is requested.

Separate account or portal services may require authentication cookies and security controls. An enabled third-party widget can process information under the notice shown before use. Optional tracking or analytics that requires consent must remain inactive until that consent is obtained, with a way to withdraw it. New tracking must be reflected in the applicable notice before activation.

The language switch stores only your selected language (English or Hebrew) in this browser’s local storage. Without a saved choice, the default homepage can select Hebrew from your browser language preferences. This preference is not sent to an analytics service. You can change it using the language switch or remove it by clearing this site’s browser storage.

You can control cookies and storage through your browser. Blocking necessary account cookies may prevent sign-in or other requested functionality. We do not treat continuing to browse or acknowledging this policy as consent to optional tracking.

9. Retention, disconnection and deletion

Customer workspace records follow the customer’s instructions, the applicable processing agreement and configured retention. Email and ticket records currently have no automatic expiry by default and can remain until an authorized deletion or a configured retention action. That default is not a requirement for customers to retain information indefinitely: administrators must establish a lawful retention period for their use.

For information we control, retention depends on the purpose, account relationship, statutory recordkeeping periods, dispute needs and security requirements. Operational log and backup periods depend on the deployment and those purposes. This policy does not specify a single automatic-deletion deadline for all categories of information.

Authorized deletion can cover the relevant Echo records and attachments. It does not by itself erase upstream mailbox contents or copies held by independent recipients or providers. Backups may retain limited copies until their documented lifecycle expires; legally required records and minimal suppression information may need separate retention. A withdrawal of marketing permission must not be defeated by importing a recipient again.

Closing an account, revoking a token and requesting erasure are distinct actions. We explain applicable exceptions when responding to a valid request and comply with the time limits required by law.

10. Security and incident handling

The Services use access controls and support protected credential storage and encryption controls. Their operation depends on the deployed service and its configuration. Customers must protect their own credentials and devices, restrict administrator and agent permissions, and report suspected compromise promptly.

No network, storage system or transmission method can be guaranteed completely secure. We do not promise that every incident can be prevented, but that does not remove our duties to apply legally required safeguards or give required breach notifications. The Security page describes product controls and the deployment details to verify.

11. International processing

Hosting, support, connected platforms and configured AI providers may process information in countries different from your own. The actual locations depend on the service and deployment; this policy does not promise a particular data-residency region.

Where data-transfer rules apply, the responsible parties must establish an applicable transfer mechanism and any required supplementary measures before the transfer. These may include an adequacy decision or approved contractual safeguards. We do not claim participation in a certification or transfer framework that has not been verified. Accepting these Terms is not, by itself, a substitute for required transfer safeguards. Contact support@eleonsoft.com.

12. Your rights and requests

Depending on your location and the law that applies, you may have rights to obtain information about processing; access or receive a copy of your data; correct it; request deletion, restriction or portability; object to processing, including direct marketing; withdraw consent; and challenge qualifying automated decisions. California and other applicable US state laws may also provide rights concerning sale, sharing, targeted advertising, sensitive information and appeals. Rights are subject to applicable conditions and exceptions.

Contact support@eleonsoft.com. Identify your relationship to the service, the relevant organization or workspace and the action requested. We may need proportionate identity or authority verification. Do not send passwords, access tokens or an unrequested identity document. Authorized agents may act where law permits and appropriate authority is established.

For customer-controlled information, contact the organization first; we assist it as required by law and our processing agreement. We do not deny statutory rights because you are not a paying customer. We respond within applicable legal deadlines, explain any lawful extension or refusal and provide an appeal route where required. Exercising privacy rights does not result in unlawful discrimination.

You may complain to the competent data protection or privacy authority, including in your place of habitual residence or work where applicable. In Cyprus, see the Office of the Commissioner for Personal Data Protection. Contacting us first is encouraged but is not a condition of that right.

13. Children and restricted information

EleonEcho accounts are intended for adults using the Services for business or professional purposes. We do not direct account registration to children under 18. If you believe a child has supplied information directly to us without appropriate authorization, use the contact above so that we can assess and address it.

Customers must meet any age, notice and parental-permission requirements applicable to their own audience. Do not submit regulated health information, payment-card security data, biometric identifiers or similarly restricted information unless the relevant service has expressly been agreed and configured for that use with the required protections.

14. Updates and contact

We will identify a revised policy by its revision date and provide additional notice where a material change or applicable law requires it. A new purpose that requires consent will not be activated merely by posting an updated policy. Earlier conduct is assessed under the applicable policy and law at the time.

Contact support@eleonsoft.com. See the Terms of Use for contractual responsibilities and acceptable-use requirements. Contractual limitations do not waive a person’s statutory privacy rights.