Data Processing Agreement

Last Updated: April 8, 2026

1. Overview

This Data Processing Agreement (DPA) outlines how Echo (hellofrom.today) acts as a Data Controller, and how our third-party infrastructure providers act as Data Processors. We have designed our architecture to minimize data retention and maximize user privacy.

2. Sub-Processors

We utilize the following enterprise sub-processors to deliver the Echo platform:

Sub-Processor	Function	Data Retention
Supabase	Database & Authentication	Until account deletion
Google Cloud (Gemini)	AI Story-Keeper Conversational Logic	Zero Retention (Ephemeral)
ElevenLabs	Voice Synthesis & Text-to-Speech	Zero Retention (Ephemeral)
Stripe	Payment Processing	As required by financial law

3. AI Training Prohibition

We explicitly prohibit our AI partners from using your data to train their models.Our enterprise agreements with Google Cloud and ElevenLabs dictate that your audio, transcripts, and generated voices are processed strictly for the purpose of fulfilling your API request and are immediately purged from their systems.

4. Decentralized Storage (Arweave)

When a user opts to "Seal" a memory, the data is encrypted and transferred to the Arweave network. Arweave is a decentralized protocol, not a traditional sub-processor.

Data on Arweave is hosted by a global network of independent nodes.
Because the data is AES-256 encrypted prior to upload, the nodes hosting the data cannot read its contents.
Echo cannot compel the Arweave network to delete data once it is sealed.

5. Security Audits

We undergo annual SOC2 Type II compliance audits to ensure our data processing and security controls meet the highest industry standards.