This Privacy Policy describes how EchoUGC ("we," "us," or "our") collects, uses, and shares information when you visit echougc.com, use our applications, or otherwise interact with our AI UGC advertising platform (the "Service").
EchoUGC is responsible for the personal information described in this policy (where GDPR or UK GDPR applies, EchoUGC is the controller). You can reach us about it at legal@echougc.com.
1. Information we collect
Account and profile. Name, email, password hash, organization details, billing contact, and settings you provide.
Content and creative inputs. Brand kits, product images, scripts, prompts, avatars, generated videos, exports, and workflow metadata you upload or create in the Service.
Usage and device data. Log data, IP address, browser type, pages viewed, feature usage, credit consumption, errors, and approximate location derived from IP.
Payment information. Subscription status, plan, and transaction identifiers. Whop (whop.com) collects your card and billing details at checkout and processes payments for EchoUGC under its own terms and privacy policy. With each payment, Whop sends us the plan, payment status and transaction identifiers, and the name, email address, billing address and card summary (such as card brand and last four digits) on the payment. We keep that copy for up to 400 days, then only the payment record (amounts, dates and identifiers). When we measure ads on Meta or TikTok (section 4), we also keep the country of your billing address with your account. We do not store full payment card numbers.
Communications. Support messages, feedback, your email and text-message preferences, and, for our emails, whether a message was delivered, opened or a link clicked, and whether you unsubscribed.
Mobile number and SMS consent. If you choose to join one of our optional text-message programs: your mobile number, which programs you joined or left, the exact consent wording you agreed to and its version, the page you agreed on, the time, and your IP address and browser user agent at that moment.
Consent records. When you accept the Terms, Privacy Policy, refund or billing acknowledgments, or text-message programs: the exact wording you agreed to and its version, the button you clicked, the plan and price shown, the time, your email address at that moment, your IP address, browser user agent and browser language, and, when we can detect it, the country of your connection.
Marketing email choice. Whether you agreed to or declined marketing email, or were told at signup that we may send it, and any later change or unsubscribe: the wording you saw and its version, the page, the time, your IP address and browser user agent, and the country we detected from your connection and your browser time zone, which decide whether we ask for your agreement first.
Video delivery records. For each finished video: when it was made, its length, the credits it used, a SHA-256 fingerprint of the file, and when it was downloaded or saved (see section 7).
2. How we use information
We use information to:
- Provide, operate, and secure the Service
- Process subscriptions, credits, and billing
- Run AI generation pipelines, deliver your videos, and store the assets you save
- Measure our own advertising on Meta and TikTok (section 4)
- Improve models, features, and reliability (including de-identified analytics)
- Send account messages, such as receipts, password resets, and billing, account, security and video-ready notices, reminders before a trial ends, and notices when your credits run low
- Send lifecycle and marketing email, such as onboarding tips, a reminder when you started a checkout but did not finish it, upgrade reminders, win-back emails and product news, and measure how they perform (section 4). Where the law requires consent, we send marketing email only if you agreed. Every marketing email includes an unsubscribe link.
- Detect fraud, abuse, and violations of our Terms
- Comply with law and enforce our agreements
3. Legal bases (EEA/UK)
Where GDPR or UK GDPR applies, we process personal data based on contract (providing the Service), legitimate interests (security, improvement, analytics, and account and service messages), consent (marketing email where the law requires it, and text messages), and legal obligation.
5. AI and third-party processing
To generate content, prompts and assets may be transmitted to third-party AI and media providers. Those providers process data according to their policies and our agreements. Do not submit sensitive personal data you are not authorized to share. You are responsible for rights related to likeness, voice, and brand materials in your inputs.
7. Data retention
Finished videos: 24 hours. We keep each finished video on our servers for 24 hours after it finishes so you can download it, and then we delete it. In your browser, EchoUGC starts the download by itself when a video finishes if the page you started it from is still open. Otherwise, the next time you open the EchoUGC studio or the My videos page within those 24 hours, it starts up to three of those downloads by itself and lists every video not downloaded yet with a download button. The My videos page works even without an active plan. Your browser may ask you to allow downloads. The browser also keeps a copy in My videos, a library stored only on that device; clearing your browser data removes that copy. After the 24 hours we no longer hold a copy of the video, so keep yours safe. Backups of our servers can still contain a deleted video until each backup expires, at most about 3 months later. If our own storage fails and a video is delivered through the temporary file host of our video provider instead, that host deletes it on its own schedule, usually within about a day. The AI provider that generates the clips, images and voice a video is made from keeps them for up to 14 days, and its request logs for up to 2 months, under its own policy, then deletes them. Videos made before this change keep a one-time period of 14 days that starts when we email you the exact date, which the app then shows as well.
Uploads and saved assets. A photo or file you upload for one video, such as a product photo, is sent to the file host of our video provider so the video can be made, and that host deletes it on its own schedule, usually within about a day. What the provider generates from it (clips, images and voice) it keeps for up to 14 days under its own policy. Our working copies of a job (uploads, reference images and raw clips) are deleted within a day after the video finishes or fails. Actors, products, voice clones and brand kits you save to reuse, and the images you generate, stay in your account until you delete them or ask us to delete your account, because new videos are made from them.
Delivery records. To answer billing questions, refund requests and payment disputes, we keep a record of each video: when it was made, its length, the credits it used, a SHA-256 fingerprint of the file, and when it was downloaded or saved. The record does not contain the video. We keep these records while your account is open and afterwards for as long as we need them for billing, refunds, payment disputes and our legal obligations. If we record the IP address and browser of a download, we delete them after 30 days, and we never record them for a browser that sends a Global Privacy Control signal.
We retain account and billing records as long as your account is active and as needed for legal, tax, and dispute purposes. Usage and website-visit analytics are deleted after 13 months (the record of which link or ad brought an account or a payment is kept with that account), and the IP address and browser details stored with usage analytics are erased after 90 days. Other logs and security data are kept for a limited period consistent with operational needs. Text-message consent and opt-out records are kept for at least four years after you leave a program, so we can show what you agreed to and when; if you remove your number, we stop using it for messages straight away. Consent records (section 1), including your marketing email choices and opt-outs, are kept while your account is open and for at least four years after it closes, so we can show what you agreed to and when.
8. Security
We implement administrative, technical, and organizational measures designed to protect information, including encryption in transit, access controls, and monitoring. No method of transmission or storage is 100% secure.
9. Your rights and choices
Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, or port your data, and to withdraw consent where processing is consent-based. You may update account details, including text-message choices, in your Account page. To exercise rights, contact legal@echougc.com. We will verify requests as required by law. You may lodge a complaint with your local supervisory authority.
You can stop marketing email at any time with the unsubscribe link in any marketing email, by turning off Tips, offers and product news in Settings, or by writing to legal@echougc.com. We will still send account messages, such as receipts, password resets, billing and security notices, reminders before a trial ends, and notices when your credits run low. Unsubscribing with the link in a marketing email (or marking one as spam) also stops our marketing text messages; account text alerts continue until you reply STOP or turn them off on your Account page.
California residents may have additional rights under the CCPA/CPRA, including knowing categories collected, requesting deletion, and opting out of sharing. We do not sell personal information for money. Sending event data to Meta and TikTok for ad measurement may count as sharing; you can opt out as described in section 4, and we honor Global Privacy Control signals.
10. International transfers
We may process data in the United States and other countries where we or our providers operate. Where required, we use appropriate safeguards such as standard contractual clauses.
11. Children
The Service is not directed to children under 16 (or under 13 where COPPA applies). We do not knowingly collect personal information from children. Contact us to request deletion if you believe a child provided data.
12. Changes to this policy
We may update this Privacy Policy. If we make a material change, we will tell you by email or in the app, and ask for your agreement where the law requires it. The date at the top shows when this version took effect.
13. Contact
Privacy questions or requests: EchoUGC, legal@echougc.com. See also our Terms of Service.