Privacy Policy

Echo Service Solution ("we," "our," or "us") respects your privacy and is committed to protecting personal information you provide when using our platform and services (the "Services"). This Privacy Policy explains what we collect, why we collect it, how we use and share it, and the choices you have. This policy applies to the website, the customer dashboard, and any hosted instances we operate on your behalf.

We comply with applicable privacy laws, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the Alberta Personal Information Protection Act (PIPA).

Account information

• Name, email address, and password (stored as a one-way hash by our auth provider)
• Company name, billing address, and phone number where you provide them
• Profile photo or avatar where you choose to upload one

Billing information

• Subscription plan, status, renewal date, and payment history
• Credit card details are processed and stored by Stripe; we do not store full card numbers on our servers

Operational data inside your instance

When you use the Services to manage your business operations, your hosted instance stores data you input, including:

• Customer records, contact details, and job sites
• Job requests, estimates, invoices, payments, and field-service records
• Timesheets and employee hours
• Product, service, equipment, subcontractor, and permit catalogue
• Attachments, photos, signatures, and documents you upload
• Messages, internal notes, and activity history

You retain ownership of this operational data. We process it on your behalf as your data processor.

Usage and technical data

• IP address, browser type, device type, and operating system
• Pages visited, features used, and timestamps
• Error logs and diagnostic data when something fails

Communications

• Support tickets, emails, and chat conversations you send us
• Survey responses and feedback you choose to provide

When you send an estimate or invoice, your customers can open a secure link to view, sign, and pay it. In doing so they may provide their name, signature, and payment details.

• You decide what information about your customers is stored in your instance, and you are responsible for having a lawful basis to collect it
• We process it only to provide the Services to you
• Card payments from your customers are entered on Stripe's secure page and processed by your own Stripe account. We never see or store their full card numbers
• If one of your customers asks us about their information, we will refer them to you

• To provide, operate, and maintain the Services
• To process payments and manage your subscription
• To send transactional emails (receipts, password resets, service notifications)
• To send service-related announcements (planned maintenance, security advisories, feature updates)
• To provide customer support and respond to your inquiries
• To monitor uptime, diagnose technical issues, and improve performance
• To prevent fraud, abuse, and security incidents
• To comply with legal obligations and respond to lawful requests

We do not sell your personal information. We do not use the operational data inside your instance for marketing purposes or to train machine-learning models.

We use the following third-party services to operate the platform. Each is bound by their own privacy policies and applicable data-protection agreements:

• Amazon Web Services (Canada / United States): hosts customer instances and backups
• Vercel (United States): hosts our website and dashboard
• Supabase (United States): authentication and dashboard database
• Stripe (United States, Canadian entity for CAD): subscription payments, and customer payments through your own Stripe account
• Resend (United States): transactional email delivery
• Twilio (United States): SMS messages when enabled
• Cloudflare Turnstile (United States): bot protection on sign-up, sign-in, and website forms
• Microsoft (United States): email sync, only if you choose to connect an Outlook account

Where data is processed outside of Canada, it remains subject to the privacy and security standards described in this policy. We update this sub-processor list when material changes occur.

• Customer instances and their daily backups are hosted in AWS data centres, primarily in Canadian or U.S. regions depending on your selected location
• Account, billing, and authentication data is stored in Supabase
• Payment data is stored by Stripe under their PCI-DSS Level 1 compliance
• Operational backups are retained for 7 days locally on the hosting server and longer in encrypted off-site storage

• Account information: for as long as your account is active, plus up to 12 months after closure for accounting and legal records
• Operational data inside your instance: for the lifetime of your subscription. After cancellation, you have 30 days to export your data, after which we permanently delete the instance and its backups
• Billing records: for the period required by Canadian tax law (currently 6 years)
• Support communications: up to 24 months after the ticket is closed
• Server logs and diagnostic data: typically 30 days, longer if required for security investigations

Subject to applicable law, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your account and request deletion of associated personal information
• Export a copy of your operational data before account closure
• Withdraw consent for non-essential processing (such as marketing communications)
• File a complaint with the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada

To exercise any of these rights, contact us at contact@echoservicesolution.com. We will respond within 30 days.

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the platform is used. Essential cookies (authentication, session, security) cannot be disabled without breaking the platform. Analytics cookies, where used, are limited to aggregate usage statistics and do not identify individual users.

You can clear cookies through your browser settings. Doing so will sign you out of the platform.

• All connections to the platform use TLS encryption (HTTPS)
• Passwords are hashed using industry-standard one-way algorithms
• Customer instances are isolated in separate Docker containers with separate databases
• Backups are encrypted at rest in our off-site storage
• Access to production systems is restricted to authorized personnel and logged

No system is perfectly secure. If we become aware of a security incident affecting your data, we will notify you and, where required, the relevant authorities in accordance with applicable law.

The Services are intended for use by businesses and are not directed at children under 18. We do not knowingly collect personal information from individuals under 18. If you believe we have collected information from a minor, contact us and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or sub-processors. The "Last updated" date at the top of this page indicates when the latest changes took effect. Material changes will be communicated by email or through the platform.

If you believe your privacy rights have been violated, you may contact the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada. We would appreciate the chance to address your concern first.