Privacy Policy
- Effective date:
- Last updated:
Introduction
This policy explains how PT. CRUBIKS GLOBAL INDONESIA ("Echosoo", "we", "us") handles personal data on echosoo.com and in the Echosoo service, an omnichannel messaging platform that brings customer conversations from messaging channels (WhatsApp today, with others to follow) into one inbox, the Echosoo web app and Microsoft Teams. It covers two groups of people:
Website visitors and customers' staff, whose data we handle for our own purposes (we are the controller).
Your customers' contacts, such as people who message a business on WhatsApp or another connected channel through Echosoo. For this data we usually act as a processor on behalf of our customer, who decides why and how it is used. If you're one of those contacts, please read the privacy notice of the business you contacted.
We use data to provide the service our customers ask for, and we don't sell personal data.
1. Changes to this policy
We may update this policy. We'll post the new version here with a new "last updated" date, and for material changes we'll notify account holders by email or in the app.
2. Information we collect
Information you give us
Account and contact details: name, work email, phone number, company, role, and details you give us when you book a demo, contact support or sign up.
Billing information: billing contact and company details. Card payments are handled by our payment provider, and we don't store full card numbers.
Information from Microsoft and Meta
Microsoft Teams / Microsoft 365 (optional): if you use the Teams app, when you install the Echosoo app, we receive identifiers such as your name, work email, tenant ID and user ID, needed to sign you in and send notifications.
Messaging channels: the business accounts and numbers you connect (today the WhatsApp Business Platform; later Instagram, Facebook Messenger, LINE and web chat), and the messages sent and received through them.
Service data (message data)
Message content (text and attachments such as images or documents), sender and recipient identifiers (such as phone numbers or social profile names), timestamps and delivery status.
Information collected automatically
Usage data: pages viewed, web app and installed-app (PWA) activity, features used, device and browser type, IP address, approximate location from IP, and log data.
Cookies and similar technologies (see Section 9).
3. How we use information
PurposeDataBasis (GDPR-style)
Provide the service: connect your channels, deliver messages to the Echosoo inbox and Teams, send activity feed and bot notifications
Account, Teams identifiers, message data
Contract
Customer support and account administration
Account, usage, message data you ask us to look at
Contract / legitimate interests
Billing and tax
Billing and account data
Contract / legal obligation
Security, fraud prevention, abuse and compliance with channel provider and Microsoft rules
Usage, message metadata
Legitimate interests / legal obligation
Provide AI features, such as suggested replies, summaries and translation, when you use them
Message data
Contract
Improve and develop the service and website
Usage and diagnostic data
Legitimate interests
Marketing about Echosoo, where you've opted in or the law allows
Contact details
Consent / legitimate interests
Message data is used only to deliver and support the service for the customer, to keep it secure, and as the law requires. We do not use message content to train AI models, advertise or profile.
We share personal data only as needed:
Channel providers (such as Meta for WhatsApp, and later Instagram and Messenger, or LINE) and Microsoft, to deliver messages and notifications, since the service works through their platforms. They handle that data under their own policies.
Service providers that help us run Echosoo, such as hosting and AI processing (Amazon Web Services), payments, email, analytics, customer support and security tools. They may use data only on our instructions.
Your organization, including its administrators and other Authorized Users, who can see conversations in the account.
Business transfers: if we're involved in a merger, acquisition or asset sale, data may transfer to the successor, with notice to you.
Authorities and legal reasons: where required by law or to protect rights, safety and security.
AI features. Echosoo uses AI models, accessed through Amazon Web Services (Amazon Bedrock), to power features such as suggested replies, summaries and translation. When you use these features, relevant message content is sent to the model to produce a result and returned to you. The model provider doesn't use this content to train models; Echosoo doesn't use message content to train models; content isn't kept by the model provider beyond processing; processing region. People review and send replies; AI doesn't send messages on its own unless a customer enables automated responses.
5. International transfers
Echosoo and its providers may process data in countries other than your own. Where we transfer personal data from the EEA, UK or similar regimes to countries without an adequacy decision, we use safeguards such as Standard Contractual Clauses.
6. Security
We use administrative, technical and physical safeguards to protect personal data. No system is completely secure, so we can't guarantee absolute security. Please tell us at [email protected] if you find a vulnerability or suspect a breach.
7. Retention
We keep personal data for as long as your account is active and as needed to provide the service. After you end your subscription, we delete or anonymize Customer Data within 30–90 days, apart from data we must keep for legal, tax or dispute reasons, and routine backups that expire on their normal cycle. Message content may also be deleted earlier according to retention settings the customer chooses.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the handling of your personal data, to receive a portable copy, to withdraw consent, and to complain to your data protection authority. Californians can also ask what we collect and disclose, and to opt out of "sale" or "sharing". We don't sell personal data.
To use your rights, email [email protected]. If your data is in a business's Echosoo account, we may forward your request to that business. Account holders can update their details in their account settings. We'll respond within the time the law requires and may need to verify your identity.
We use cookies and similar technologies that are:
Necessary for the site to work.
Analytics, to understand how the site is used.
Marketing, Where required, we ask for consent before setting non-essential cookies, and you can change your choice at any time through cookie banner / settings link or your browser settings.
10. Children
Echosoo is for businesses and isn't directed at children under 16. We don't knowingly collect their data. If you think a child has given us data, contact us and we'll delete it.
11. Third-party links
Our site and service link to services we don't control, including Microsoft and Meta. Their privacy practices are their own.
12. Contact
For privacy questions or requests: [email protected].