Privacy Policy
Last updated: June 24, 2026
Table of Contents
- Overview
- Information we collect
- How we use information
- AI and model training
- SMS communications
- How we share information
- Data ownership
- Data retention
- Security
- Your rights
- U.S. state privacy disclosures
- International users and data location
- Children
- Changes to this policy
- How to contact us
Overview
Hey Echo, Inc. ("Hey Echo", "we", "our", or "us") provides a conversational interview and survey platform that helps organizations collect structured feedback through AI-guided conversations. This Privacy Policy describes how we collect, use, disclose, and protect personal information when you use our platform, website, and related services (collectively, the "Services").
In most engagements, the client organization that creates an engagement is the controller of participant data, and Hey Echo acts as a service provider and processor that handles data on that organization's behalf and under its instructions.
Information we collect
Account Information. For administrators and authorized users: name, email address, organization name, and account credentials and authentication data.
Participant Information. Provided by the client organization for engagement administration: name, email address, mobile phone number, employee ID or other custom participant fields, and department, role, or organizational information.
Survey and Interview Data. Collected during participation in an engagement: survey responses, conversation transcripts, voice recordings and transcriptions, session activity and completion status, and AI-generated summaries and insights.
Technical Information. Collected automatically when using the Services: IP address, device and browser information, session identifiers, cookies and similar technologies, and usage and diagnostic data.
Cookies and Tracking. We use cookies and similar technologies to operate the Services, keep them secure, and understand usage. Where required by law, non-essential cookies are placed only after you provide consent through our cookie banner, and you can change your preferences at any time through the settings link in our website footer.
How we use information
We use information to:
- Deliver and administer surveys, interviews, and research engagements
- Authenticate users and maintain account security
- Generate reports, summaries, and insights for client organizations
- Send invitations, reminders, and engagement-related communications
- Create de-identified and aggregated insights to operate, improve, and develop our Services
- Improve platform performance and reliability
- Comply with legal obligations and enforce our terms
We do not sell personal information or participant data, and we do not share it for cross-context behavioral advertising.
AI and model training
Hey Echo does not use identifiable client data, participant data, survey responses, conversation transcripts, or voice recordings to train artificial intelligence models.
We use third-party AI service providers to deliver parts of the Services, including for analysis, synthesis, and voice transcription. We configure these providers so that the data we send them is not used to train or improve their models.
As described in Data Ownership below, Hey Echo may use de-identified data and aggregated data to operate, improve, and develop its Services, which may include developing and improving our own models and systems. De-identified data may include individual survey responses and conversation transcripts from which information identifying any individual or client has been removed. Aggregated data is statistical or summary data combined across engagements. Neither identifies any individual or client, and neither is attributed to any client.
SMS communications
Hey Echo may send SMS messages to participants when requested by a client organization. These messages may include interview invitations, authentication or verification codes, engagement reminders, and participation status updates.
Consent. Participants receive SMS communications only when a client organization has provided a mobile number for engagement-related communications and has obtained any required permissions or consent. Client organizations are responsible for complying with applicable law, including the U.S. Telephone Consumer Protection Act (TCPA).
Frequency. Message frequency varies based on the engagement and participation status. Participants may receive multiple reminders during an active engagement.
Opt-out. Participants may opt out at any time by replying STOP. After opting out, no further SMS messages will be sent unless re-enrollment occurs through a subsequent engagement or consent process.
Help. Participants may reply HELP for assistance or contact privacy@heyecho.ai.
Fees.Message and data rates may apply according to the participant's mobile carrier plan.
Data sharing. Mobile phone numbers and SMS consent information are used solely for engagement-related communications and are not sold, rented, or shared with third parties for marketing purposes.
How we share information
Service providers. We use trusted third-party providers to operate the Services, including providers of hosting and cloud infrastructure, database and authentication services, AI analysis and transcription services, and email and SMS communication services. These providers process personal information only as necessary to provide their services to us and are subject to their own privacy and security obligations. A current list of our sub-processors is available to client organizations on request.
Legal requirements. We may disclose information where required by law, to comply with legal process, to enforce our terms, to detect or prevent fraud or security issues, or to protect the rights, safety, and property of Hey Echo, our clients, or others.
Business transfers. If Hey Echo is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be disclosed or transferred as part of that transaction, subject to the commitments in this policy.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
Data ownership
Survey content, participant responses, transcripts, and generated reports belong to the client organization that created the engagement. Hey Echo acts as a service provider and processes data on behalf of the client organization.
Notwithstanding the above, Hey Echo may create and retain de-identified data and aggregated data derived from engagements, and may use it to operate, improve, and develop its Services, including benchmarking and developing and improving our own models and systems. De-identified data may include individual survey responses and conversation transcripts from which information identifying any individual or client has been removed. Aggregated data is statistical or summary data combined across engagements. Neither identifies any individual or client, and neither is attributed to any client.
Data retention
We retain information for the duration of the client engagement, as required by contractual obligations, as necessary to comply with legal requirements, and as needed to maintain security, auditing, and backup processes. Data may be deleted upon request, subject to applicable contractual and legal obligations.
Security
We implement reasonable administrative, technical, and organizational safeguards designed to protect personal information, including:
- Encryption of data in transit and at rest
- Role-based access controls
- Multi-tenant data isolation
- Authentication and authorization controls
- Security monitoring and logging
Data is stored on infrastructure located in the United States.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Your rights
Depending on your jurisdiction, you may have rights to access, correct, delete, or receive a copy of your personal information, and to restrict or object to certain processing. Because Hey Echo typically processes participant data on behalf of a client organization, requests should be directed to your organization's administrator, or to us at privacy@heyecho.ai and we will route the request to the relevant client organization.
U.S. state privacy disclosures
Some U.S. states provide residents with rights regarding their personal information, including the right to know, access, correct, and delete, and the right not to be discriminated against for exercising those rights. Hey Echo acts as a service provider or processor for client organizations and processes participant personal information under their instructions. We do not sell personal information and we do not share it for cross-context behavioral advertising. To exercise applicable rights, contact your organization's administrator or privacy@heyecho.ai.
International users and data location
Hey Echo processes and stores information on infrastructure located in the United States. If you access the Services from outside the United States, you understand that your information will be processed in the United States.
Children
The Services are intended for use by organizations and their adult personnel. The Services are not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided personal information through the Services, contact us at privacy@heyecho.ai.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will post an updated version with a new "Last updated" date, unless another type of notice is required by applicable law.
How to contact us
Questions about this Privacy Policy or our privacy practices may be directed to privacy@heyecho.ai.