Privacy Policy

Echo Convert, LLC

1. Information We Collect

We collect information you provide directly and information collected automatically when you use the Service.

1.1 Information You Provide Directly

• Account Registration: When you create a YourCortX account, we collect your name, email address, password, and account information.
• Family Data: You may input information about family members, including names, dates of birth, relationships, and contact information.
• Calendar & Schedule Data: Event titles, descriptions, times, locations, attendees, and reminders you create or import.
• Task & To-Do Lists: Tasks, checklists, priorities, and completion status you create.
• Messages & Notes: Family messages, shared notes, and communications you send through the Service.
• Medical Appointment Information: Appointment dates, provider names, and health conditions (organizational purposes only). IMPORTANT: Do NOT upload protected health information (PHI) as defined by HIPAA. This Privacy Policy is incorporated into our Terms of Service. In the event of conflict between this Privacy Policy and the Terms of Service, the Terms of Service control. By using YourCortX, you agree to both documents.
• Documents & Files: Photos, documents, and files you upload to organize family information.
• Payment Information: If you purchase a paid subscription, we collect billing information through third-party payment processors. We do not store complete credit card numbers.

1.2 Information Collected Automatically

• Device Information: Device type, operating system, browser type, device identifiers, and IP address.
• Usage Information: Pages viewed, features used, actions taken, and time spent on the Service (for improving functionality only, not for marketing profiling).
• Log Data: Access times, error logs, referral URLs, and account activity.
• Cookies & Similar Technologies: We use cookies to maintain sessions, remember preferences, and understand Service usage. See Section 12 for details.

2. How We Use Your Information

We use your information for these purposes:

• Service Delivery: To provide, operate, maintain, and improve the Service, including calendar, tasks, messaging, and family coordination features.
• Account Management: To manage your account, process payments, and send both transactional and communications.
• Customer Support: To respond to your inquiries and provide support.
• Legal Compliance: To comply with legal obligations and respond to legal requests (court orders, subpoenas, warrants).
• Safety & Security: To detect and prevent fraud, abuse, and unauthorized access.
• Service Analytics: To understand usage, identify trends, improve performance, and troubleshoot issues (NOT for behavioral profiling or targeted marketing).
• Email Types: We send two types of emails: (1) Transactional emails (account confirmations, billing notices, support responses), you cannot opt-out; (2) Marketing/product update emails, you can opt-out via the "unsubscribe" link. Administrative emails related to your account will continue even if you opt-out of marketing.

We DO NOT Use Your Information For:

• Marketing profiling or behavioral tracking
• Selling or renting your personal data
• Training public or shared AI models
• Targeted advertising
• Creating detailed behavioral profiles about you or your family

Profiling & Automated Decision-Making: YourCortX does NOT: (a) create detailed behavioral profiles of users for predictive purposes; (b) use automated decision-making to determine user eligibility for features or services; (c) make decisions that have legal or similarly significant effects based on automated processing. Your interactions with the Service are not subject to automated profiling.

3. AI Processing and Automation

YourCortX uses AI and machine learning to provide features such as event extraction, reminders, summaries, and organization assistance.

Your Data & AI

• Your data is used ONLY to provide AI-assisted features in the Service for your account and household members.
• Your data is NOT sold to third parties.
• Your data is NOT used to train public AI models (ChatGPT, Claude, Gemini, etc.).
• AI processing is limited to service functionality.
• Automated outputs may contain inaccuracies. You remain responsible for verifying important information.

4. Third-Party AI Subprocessors

YourCortX may use third-party AI providers to perform processing necessary to operate features of the Service. All AI Subprocessors are subject to strict requirements:

4.1 Subprocessor Requirements

• Execute a Data Processing Addendum (DPA) prohibiting use of your data to train AI models.
• Maintain SOC 2 Type II certification demonstrating security controls.
• Undergo annual independent security audits.
• Notify Echo Convert, LLC within 72 hours of any data breach or unauthorized access.
• Comply with all applicable data protection laws (GDPR, CCPA, HIPAA, state laws).

5. Who We Share Your Information With

We do NOT sell your personal data. We share information only in these limited circumstances:

• Service Providers: Third-party vendors who perform functions on our behalf (hosting, payments, support) under Data Processing Agreements. Echo Convert, LLC remains responsible for service providers under applicable law. However, Echo Convert, LLC does not verify compliance on an ongoing basis and is not liable for service providers' security breaches, data loss, or misuse except as required by law. Users acknowledge that data shared with service providers is at their risk.
• AI Subprocessors: As described in Section 4.
• Legal Requirements: Echo Convert, LLC may disclose your information to law enforcement, government agencies, or other third parties if required by law, court order, warrant, or subpoena, without your consent or prior notice unless legally prohibited from doing so. We do not challenge law enforcement requests. You acknowledge that Echo Convert, LLC may not be able to notify you of disclosures required by law. We share information only to protect safety and rights.
• Business Transfers: If Echo Convert, LLC is acquired or merged, your information may transfer. We will notify you of any changes.
• Family Members: Within your family account as the Account Owner determines.
• Aggregate & De-Identified Data: We may use aggregate and de-identified data (data that cannot identify you or your family) for any purpose without restriction, including sharing with third parties for research, analytics, or business purposes.

6. Data Retention

You own all data in your account. You can export or request deletion anytime via your settings or hello@echoconvert.com.

• Upon account deletion, we will use best efforts to delete your data within 90 days unless legally required to retain it.
• Backup copies for disaster recovery may be retained up to 180 days after deletion.
• Shared Data is retained as long as any account holder with access remains active, subject to multi-party deletion consent rules in the Terms of Service. For children's data under COPPA, upon request from a parent or guardian, we will delete the child's information within 30 days.

7. Your Privacy Rights

Depending on your location, you have the following rights:

7.1 GDPR (European Union, EEA, United Kingdom)

Right to access, rectify, erase, restrict processing, data portability, object, and lodge complaints. We acknowledge within 7 days and respond within 30 days. Complex requests may take up to 90 days with notice. Contact us at hello@echoconvert.com with requests.

7.2 CCPA/CPRA (California)

Right to know, access, delete, and correct data; opt-out of sale (we do NOT sell); opt-out of targeted ads; and appeal decisions. Contact us at hello@echoconvert.com with requests.

7.3 Other US State Laws

Residents of Georgia, Colorado, Virginia, Connecticut, and other states with privacy laws have similar rights. Contact us at hello@echoconvert.com with requests.

7.4 COPPA (Children Under 13)

We require verifiable parental consent before collecting data from children under 13. Parents/guardians may request and review data, request deletion, or opt-out. Contact hello@echoconvert.com with proof of parental authority.

8. Security Measures

We implement industry-standard security practices:

• TLS 1.2+ encryption for data in transit
• Encrypted data at rest on our servers
• Activity audit logs so Account Owners can review access history
• Access controls based on family member roles
• Documented incident response and data breach notification procedures

While we use industry-standard security, no method is 100% secure. You are responsible for keeping your credentials confidential.

9. Data Breach Notification

In the event of a confirmed data breach affecting personal information, we will notify affected individuals without unreasonable delay and in compliance with applicable law (typically within 30-60 days). Notifications will be sent via email to the address associated with your Account and will include: (a) description of the breach and types of data affected; (b) steps you should take to protect yourself; (c) our contact information for questions; (d) information about credit monitoring or identity theft protection services where applicable. We will also notify regulatory authorities as required by law (such as state attorneys general, the FTC, or GDPR authorities).

10. Children's Privacy

We comply with COPPA (US), UK ICO Age-Appropriate Design Code, and other children's privacy laws. Account Owners are responsible for understanding this Privacy Policy, configuring access controls appropriately, ensuring children's privacy through settings restrictions, and monitoring family members' use of the Service. Echo Convert, LLC is not responsible for privacy breaches caused by Account Owner misconfiguration or family members' actions.

10.1 Children Under 13 (COPPA)

• Verifiable parental consent required before collecting data
• Information limited to operational necessity
• Not shared with third parties for marketing
• Parents may request deletion anytime
• No behavioral tracking or marketing profiles

10.2 Children Under 18 (UK ICO Age-Appropriate Design Code)

• Data protection is our default setting
• No behavioral profiling or tracking for marketing
• No location data collection or inference
• Parental controls available for messaging, integrations, and content uploads
• Age-appropriate privacy information provided separately

11. International Data Transfers

Echo Convert, LLC is based in the United States. Your data will be transferred to, stored in, and processed in the US. By using the Service, you consent. For EU/UK users: We rely on Standard Contractual Clauses (SCCs) and adequacy decisions to ensure GDPR-equivalent protections for data transferred outside the EU/EEA.

12. Cookies and Tracking

We use cookies to maintain sessions, remember preferences, and understand how you use the Service. We do NOT use cookies for behavioral tracking or targeted advertising.

• Essential Cookies: Required for the Service to function (sessions, security, authentication).
• Analytics Cookies: We use Google Analytics and other analytics tools to understand how users interact with the Service and improve functionality. Visit the relevant tool's privacy policy to opt-out of tracking. Analytics Cookies help us understand usage and improve functionality (do NOT track individuals for marketing).

You can control cookies through your browser settings, but disabling them may affect Service functionality.

13. Third-Party Integrations

YourCortX allows you to integrate with third-party services (Apple Calendar, Google Calendar, Outlook, etc.). When you authorize an integration:

• We use OAuth authentication to securely connect without storing your credentials.
• Data flows directly between your account and the third party.
• Each third party has its own privacy policy. Review before integrating.
• We are NOT responsible for their security or privacy practices.
• Echo Convert, LLC maintains security for the integration layer itself.
• You can disconnect integrations anytime through your settings.

14. Limitation of Liability

To the maximum extent permitted by law, Echo Convert, LLC's total liability for any privacy-related claim shall not exceed the greater of: (a) the total amount you paid us in the 12 months preceding the claim, or (b) $100. This limitation applies regardless of the legal theory (contract, tort, breach of warranty, negligence, etc.). See the Terms of Service, Section 12, for the full liability limitation.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes, we notify you via email or prominent notice at least 30 days before taking effect. Your continued use after changes means you accept the updated policy.

16. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

Echo Convert, LLC
hello@echoconvert.com