EchoFlo Platform Privacy

Effective 1 May 2026. This notice applies to the EchoFlo software platform (the “Platform”, accessed at app.echoflo.ai), operated by Echo Collective Pte. Ltd. (UEN 202321542W) (“EchoFlo”, “we”, “us”, or “our”). It supplements our website Privacy Policy and governs how we handle data processed through the Platform — including messages from connected communication channels such as the WhatsApp Business Platform (Meta Cloud API), Instagram, Facebook (Messenger), TikTok, and email (Gmail / Microsoft Outlook).

1. Our Role: Data Processor, Not Controller

EchoFlo provides the Platform to business customers (“Tenants”). When a Tenant connects a communication channel, the Tenant is the data controller of the messages and customer data flowing through that channel, and EchoFlo acts solely as the Tenant’s data processor under the Singapore Personal Data Protection Act 2012 (as amended) (the “PDPA”). We process channel data only on the Tenant’s documented instructions and to provide the Platform’s features.

If you are an end customer who messaged a business using EchoFlo, please direct privacy requests to that business in the first instance; we will assist them in responding.

2. Data We Process on a Tenant’s Behalf

Through connected channels we process:

• Message content — text, and media or attachments such as images, audio, video, and documents
• Sender identifiers — name, display name, phone number, social handle or platform user ID, and profile information made available by the channel
• Message metadata — timestamps, delivery and read status, channel, and provider message IDs
• Contact information the Tenant maintains about the sender

We do not request or require more data than is necessary to display and manage the conversation.

3. Why We Process It

We process channel data solely to provide the Platform to the Tenant: to surface incoming messages in the Tenant’s unified inbox, attribute them to the correct contact and team, enable the Tenant’s authorised users to read and reply, and to classify and route conversations for the Tenant’s own operational use. We process channel data only for these purposes and the Tenant’s instructions.

4. What We Never Do With Channel Data

We do not:

• use it for advertising or to build advertising or marketing profiles;
• use it to train, fine-tune, or develop machine-learning or AI models;
• sell, rent, or trade it;
• share it across Tenants or with any other Tenant’s users; or
• disclose it to third parties except the sub-processors in Section 7, or where required by law.

Access by EchoFlo personnel is restricted, logged, and limited to support, security, and legal-compliance purposes.

5. Security and Hosting

Tenant data is isolated at the database level using row-level security so that one Tenant cannot access another’s data. Message content and structured personal data are encrypted at rest using AES-256-GCM with per-tenant keys. The Platform is hosted on DigitalOcean App Platform in the Singapore (SGP1) region; we do not move Platform personal data offshore in the ordinary course.

6. Retention and Deletion

• Media and attachments in conversations are accessed through short-lived links that expire after 48 hours; the underlying media is retained as part of the conversation record and deleted on the same schedule as message content (below).
• Message content and conversation records are retained while the Tenant’s account is active or as configured by the Tenant, and are deleted within 30 days of the Tenant’s deletion instruction, account termination, or a valid deletion request, except where retention is required by law.
• On termination, we delete or return Tenant data in accordance with the Tenant agreement.

7. Sub-Processors

We rely on the following sub-processors to provide the Platform:

• Meta Platforms — WhatsApp Business Platform (via the Meta Cloud API), Instagram, and Facebook, for channel connectivity
• TikTok — for channel connectivity
• Google LLC / Microsoft Corporation — for connected email (Gmail / Outlook)
• DigitalOcean, LLC — for Platform hosting (Singapore region)

Our handling of data obtained from Meta complies with the Meta Platform Terms and Developer Policies and applicable WhatsApp Business policies. We use Meta Platform Data only to provide the Platform feature the user engaged with, and not for the prohibited purposes in Section 4.

8. Your Rights and Deletion Requests

End customers may request access to, correction of, or deletion of their personal data. Because the Tenant is the controller, we will either route your request to the relevant Tenant or, on the Tenant’s instruction, action it directly. To make a request, or for any question about Platform data, please contact us:

We respond to verified requests within the timeframes required by the PDPA. We may need to verify your identity before processing your request.

9. Governing Law

This notice is governed by the laws of Singapore. Any disputes arising out of or in connection with it shall be subject to the exclusive jurisdiction of the courts of Singapore.

© 2026 Echo Collective Pte. Ltd. All rights reserved.