Legal
Privacy Policy
What personal data we collect, why, and the rights you have over it.
DRAFT — PENDING ATTORNEY REVIEW. This document is a structural draft. It is not legal advice, has not been reviewed by counsel, and is not enforceable as written. All bracketed placeholders must be completed and the whole document reviewed by a licensed attorney before launch.
Last updated: [DATE]
Effective date: [DATE]
1. Who we are
Echo Peps ("Echo Peps," "we," "us," "our") is operated by [LEGAL ENTITY NAME], a [STATE] [ENTITY TYPE] with a registered address at [REGISTERED ADDRESS].
This Privacy Policy explains what personal information we collect when you use [DOMAIN] (the "Site"), why we collect it, who we share it with, and what rights you have over it.
Questions about this policy or your data: [PRIVACY CONTACT EMAIL].
2. We collect user data
We collect personal information from you. This section describes what we collect and where it comes from.
### Information you give us directly
| Category | Examples | When |
|---|---|---|
| Account information | Name, email address, password (stored hashed) | Account creation |
| Attestation records | Your confirmation of research-use-only intent, your age confirmation, the date and time you gave each confirmation, and the IP address it was submitted from | Account creation and at checkout |
| Order information | Products ordered, order value, order history | When you place an order |
| Shipping information | Recipient name, shipping address, phone number, institution or organization name (where provided) | Checkout |
| Contact information | Any information you include when you contact us | When you contact us |
### Information collected automatically
| Category | Examples |
|---|---|
| Device and browser data | IP address, browser type and version, operating system, device type, screen size |
| Usage data | Pages viewed, referring page, time on page, links clicked, session duration |
| Cookie and identifier data | Cookie IDs, session identifiers, and similar technologies — see our Cookie Policy |
### Information we do not collect
We do not collect payment card numbers. Card details are entered directly with our payment processor and are never transmitted to or stored on our systems. See Section 4.
We do not knowingly collect information from anyone under [21/18]. See Section 9.
3. Why we collect it
We process your personal information for the following purposes:
- To provide the Site and fulfil orders — creating and maintaining your account, processing orders, arranging shipping, and providing customer support.
- To maintain research-use compliance records — we retain a record of each research-use attestation, including timestamp and IP address, as evidence that the required confirmation was given before purchase. This is a core reason we collect attestation data and we retain it for the period described in Section 7.
- To communicate with you — order confirmations, shipping updates, and responses to your enquiries. Marketing communications are sent only where you have opted in, and every marketing message includes an unsubscribe link.
- To operate, secure, and improve the Site — diagnosing technical problems, preventing fraud and abuse, and understanding how the Site is used.
- To comply with legal obligations — tax and accounting records, and responding to lawful requests from regulators or law enforcement.
4. Third parties who receive or process your data
We share personal information with third-party service providers who process data on our behalf. We do not sell your personal information.
The categories of third parties we use are:
| Category | What they receive | Purpose |
|---|---|---|
| Payment processor — [PROCESSOR NAME] | Name, billing address, email, order value, card details entered directly with them | Processing payments. Card data is handled by the processor, not by us. |
| Hosting and infrastructure — [HOSTING PROVIDER] | All data stored on the Site | Hosting the Site and database |
| Shipping and fulfilment carriers — [CARRIER NAMES] | Recipient name, shipping address, phone number | Delivering your order |
| Email and communications — [EMAIL PROVIDER] | Name, email address | Transactional and (where opted in) marketing email |
| Analytics — [ANALYTICS PROVIDER] | Device data, usage data, cookie identifiers | Understanding Site usage |
| Professional advisers | As required | Legal, accounting, and insurance purposes |
Each of these providers processes data under contract and is permitted to use it only for the purposes described above.
We may also disclose personal information where required by law, in response to a valid legal request, to enforce our Terms of Service, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you before your information becomes subject to a different privacy policy).
### Automated tools and AI
[COMPLETE OR DELETE THIS SUBSECTION.] If any part of the Site uses artificial intelligence or automated decision-making — including AI-assisted customer support, chat, recommendation, or content generation — this section must disclose: which features use it, which provider processes the data, what data is sent to that provider, whether that data is used to train the provider's models, and whether any decision affecting you is made without human involvement.
As currently built, the Site does not include an AI chatbot or automated decision-making feature. If one is added, this section must be completed before that feature goes live.
5. Cookies and tracking technologies
We use cookies and similar technologies to operate the Site, remember your session, and understand usage. Full details of each cookie, its purpose, and its duration are set out in our Cookie Policy.
Where required by applicable law, we obtain your consent before setting non-essential cookies, and you can withdraw that consent at any time through [COOKIE PREFERENCES MECHANISM]. You can also control cookies through your browser settings, though disabling essential cookies may prevent parts of the Site from working.
6. How we protect your data
We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS), hashed password storage, access controls limiting staff access to what their role requires, and [ADDITIONAL MEASURES].
All stored files and data are held in non-public storage. Storage locations are configured to deny public access by default, and no customer data, order record, or uploaded file is stored in a publicly accessible location.
No system is perfectly secure. If a breach affects your personal information, we will notify you and any relevant regulator as required by applicable law.
7. How long we keep it, and deletion
| Data | Retention period |
|---|---|
| Account information | For as long as your account is active, then [PERIOD] after closure |
| Order and transaction records | [PERIOD] — as required for tax and accounting purposes |
| Research-use attestation records | [PERIOD] — retained as compliance evidence |
| Any files or documents you upload to us | Deleted within [PERIOD] of the purpose being fulfilled, or on your request, whichever is sooner |
| Marketing contact data | Until you unsubscribe, then [PERIOD] on a suppression list |
| Analytics and usage data | [PERIOD] |
When a retention period ends, we delete the data or irreversibly anonymise it. Deletion applies across our systems and backups, subject only to data we are legally required to retain (for example, tax records).
You can request deletion of your data at any time — see Section 8.
8. Your rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you
- Correct inaccurate or incomplete information
- Delete your personal information
- Opt out of marketing communications at any time
- Opt out of sale or sharing of personal information (we do not sell personal information)
- Portability — receive your data in a portable format
- Withdraw consent where processing is based on consent
- Non-discrimination — we will not deny service or charge different prices for exercising these rights
To exercise any of these, contact [PRIVACY CONTACT EMAIL]. We will respond within [PERIOD] and may need to verify your identity first.
[ATTORNEY: confirm which state and international privacy regimes apply based on where the business is registered and where customers are located — including CCPA/CPRA, other US state laws, and GDPR/UK GDPR if selling internationally — and adjust this section and the disclosures above accordingly.]
9. Age restriction
The Site is intended only for users aged [21/18] and over. We do not knowingly collect personal information from anyone under that age. If we learn that we have, we will delete it. If you believe a minor has provided us information, contact [PRIVACY CONTACT EMAIL].
10. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above. If the changes are material, we will notify you by email or through a notice on the Site before they take effect.
11. Contact
[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]
[PRIVACY CONTACT EMAIL]
Questions about this policy? Contact our compliance team.