Privacy Policy

Echo Collective Pte. Ltd. (UEN 202321542W), a private limited company incorporated in Singapore with its registered office at 60 Paya Lebar Road, #06-28, Paya Lebar Square, Singapore 409051 (“Echo Collective”, “we”, “us”, or “our”), is committed to protecting your personal data in accordance with the Singapore Personal Data Protection Act 2012 (as amended in 2026) (the “PDPA”).

This Privacy Policy describes how we collect, use, disclose, and protect personal data we receive through our corporate website at echoflo.io (the “Site”). It applies only to the Site and not to the EchoFlo SaaS platform, EchoFlo FM, or any other service we provide — those are governed by separate agreements.

By using the Site, you consent to the collection and use of your personal data as described in this Privacy Policy.

1. Personal Data We Collect

1.1 Information you provide directly

When you book a demo through our scheduling tool (Calendly) or contact us via email, we collect personal data you choose to provide, including:

• Your name
• Your business email address
• Your company name and role (if provided)
• Phone number (if provided)
• Any other information you choose to share with us in the course of correspondence or in scheduling a demo

1.2 Information collected automatically

When you visit the Site, we automatically collect limited technical information through Vercel Analytics, including:

• Pages viewed and the order in which you view them
• Referrer URL (the website you came from, if any)
• Approximate geographic region (country / city level — derived from IP address but not stored as your IP address)
• Browser type and operating system
• Timestamp of your visit
• Device type (mobile, tablet, desktop)

Vercel Analytics is privacy-first by design. It does not use cookies, does not track you across websites, and does not collect personally identifying information. We do not store your IP address. You can read more about how Vercel Analytics handles data at vercel.com/legal/privacy-policy.

1.3 What we do not collect

We do not use Google Analytics, Facebook Pixel, advertising trackers, behavioural advertising cookies, or session-replay tools on this Site.

2. How We Use Your Personal Data

We use the personal data described above for the following purposes:

We will not use your personal data for purposes that are inconsistent with the purposes set out above, unless we obtain your consent or are required or permitted to do so by law.

3. Marketing Communications

If you book a demo or contact us, we may send you follow-up communications about EchoFlo, EchoFlo FM, or related Echo Collective offerings. We will only send marketing communications where:

• You have provided your business email address in connection with a demo booking or enquiry, and
• The communications relate to the products or services that prompted your enquiry.

You can opt out of marketing communications at any time by clicking the “unsubscribe” link in any email we send, or by contacting us at tech@echoflo.io. Opting out of marketing will not affect our ability to contact you about a specific request you have made (for example, to confirm a demo booking).

4. Disclosure of Personal Data

We do not sell, rent, or trade your personal data. We may disclose your personal data only in the following limited circumstances:

4.1 Service providers

We use trusted third-party service providers to operate the Site and our business. These providers process personal data on our behalf and are contractually obliged to handle it securely and in accordance with applicable data protection laws. They include:

• Vercel Inc. (United States) — website hosting and privacy-first analytics
• Sanity (Sanity.io AS, Norway) — content management system for Site content
• Calendly LLC (United States) — demo booking and scheduling
• Resend (Resend Inc., United States) — transactional email delivery (e.g., demo confirmations)
• Google Workspace (Google LLC, United States) — business email and document collaboration

4.2 Legal and regulatory requirements

We may disclose your personal data where required by law, court order, or by a competent regulatory authority (including the Personal Data Protection Commission of Singapore).

4.3 Business transfers

If Echo Collective is involved in a merger, acquisition, financing, or sale of assets, your personal data may be transferred as part of that transaction. We will provide notice before your personal data is transferred and becomes subject to a different privacy policy.

5. Cross-Border Transfers

Some of our service providers (listed in section 4.1 above) are located outside Singapore. When we transfer your personal data outside Singapore, we ensure that the recipient is bound by contractual obligations that provide a standard of protection comparable to that required under the PDPA, in accordance with section 26 of the PDPA and the PDPC’s Cross-Border Data Transfer Guidelines.

6. Data Retention

We retain your personal data only for as long as is reasonably necessary to fulfil the purposes for which it was collected, or as required by law. Specifically:

• Demo booking and enquiry records: retained for up to 24 months after our last interaction, or until you request deletion (whichever is earlier)
• Email correspondence: retained for up to 36 months for business records and follow-up
• Vercel Analytics data: retained per Vercel’s standard retention period (currently 12 months) and is aggregated, not personally identifiable
• Records required by law: retained for the minimum period required (for example, financial records under the Singapore Income Tax Act must be kept for 5 years)

7. Your Rights Under the PDPA

Under the Singapore PDPA, you have the following rights in respect of your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to correction — to request that we correct any inaccurate or incomplete personal data
• Right to withdraw consent — to withdraw consent for our use of your personal data (subject to legal or contractual restrictions)
• Right to data portability — to request that we transfer your personal data to another organisation in a structured, commonly used format (where technically feasible)
• Right to make a complaint — to lodge a complaint with the Personal Data Protection Commission of Singapore if you believe your personal data has been mishandled

To exercise any of these rights, please email us at tech@echoflo.io. We will respond within 30 days as required by the PDPA. We may need to verify your identity before processing your request.

8. Data Security

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including:

• Encrypted connections (HTTPS/TLS) for all Site traffic
• Access controls and authentication for any system that stores personal data
• Regular security reviews of our service providers
• Segregation of personal data from non-personal data where appropriate

No method of transmission or storage on the internet is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

9. Data Breach Notification

In the event of a data breach affecting your personal data that is likely to result in significant harm, we will notify you and the Personal Data Protection Commission within the timeframes required by the PDPA (currently within three calendar days from the date we assess that a notifiable breach has occurred).

10. Children’s Personal Data

The Site is not intended for, or directed at, individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected personal data from a child, please contact us at tech@echoflo.io and we will take steps to delete it.

11. Cookies and Similar Technologies

The Site does not use third-party advertising cookies, tracking cookies, or behavioural advertising tools. We use only:

• Strictly necessary cookies — required for the Site to function properly (for example, to remember your language preference). These cannot be disabled without affecting Site functionality.
• Vercel Analytics — which, as noted above, does not use cookies and does not track individual users.

You can control cookies through your browser settings. Most browsers allow you to view, manage, and delete cookies. Please note that disabling strictly necessary cookies may affect your ability to use parts of the Site.

12. Data Protection Officer

In accordance with section 11 of the PDPA, Echo Collective has appointed a Data Protection Officer (“DPO”) who is responsible for ensuring our compliance with the PDPA.

You can contact the DPO at:

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable laws. The “Last updated” date at the top of this Privacy Policy reflects the most recent revision.

If we make material changes, we will provide reasonable notice — for example, by posting a notice on the Site or, where you have provided your email address, by emailing you. Your continued use of the Site after such changes constitutes your acceptance of the updated Privacy Policy.

14. Governing Law

This Privacy Policy is governed by the laws of Singapore. Any disputes arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Singapore.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, please contact us:

© 2026 Echo Collective Pte. Ltd. All rights reserved.