Privacy Policy

1. Information you provide

• Account data: name, email address, and authentication identifiers handled by our authentication provider; organization name.
• Workspace settings: business profile details and callback phone number for your campaigns.
• Contact data: recipient names, nicknames, phone numbers, and related notes or consent notes that you upload or enter (including via CSV).
• Message content: voicemail scripts, message templates, and campaign details you create.
• Voice recordings: audio samples you record or upload for voice enrollment.
• Support communications: messages you send us by email, including your email address and message content.

2. Information generated through use

• Generated voicemail audio produced by our voice-technology provider(s) from your text.
• Campaign records: delivery status per recipient (sent, delivered, failed), timestamps, and usage accounting (drops used per monthly period).
• Suppression (do-not-contact) list entries you maintain.
• Technical and security logs needed to operate, debug, and protect the Service.

3. Voice data

To create your AI voice, you record or upload a voice sample. That recording is stored in our application database provider and sent to our voice-technology provider to create a synthetic voice model. The resulting voice model and provider-side voice identifier are used to generate voicemail audio from your written scripts. Generated audio is stored so it can be delivered to recipients and replayed; identical text renders may be cached briefly to reduce repeated generation.

You can request deletion of your enrolled voice from account settings. The workflow removes source and audition recordings under our control and requests deletion of associated provider voice resources. Provider cleanup is tracked and retried when it fails; completion depends on the provider response. Deleting an individual voicemail message does not delete an enrolled voice. Voice recordings, provider identifiers, generated voicemail audio, and ordinary campaign content are retained while the subscription entitlement is active, including a paid-through cancellation period. When access becomes inactive, we begin the Customer Content deletion workflow described below.

EchoDrop does not use Customer Content, recipient information, voice recordings, cloned voice models, generated voicemail audio, scripts, prompts, or campaign content to train generalized EchoDrop artificial-intelligence or machine-learning models. Voice features may use Cartesia and/or ElevenLabs, depending on deployment configuration. Those processors handle submitted information under applicable contractual settings and their privacy and data-use terms. Provider policies may permit model-improvement use in some circumstances; we do not represent that it is universally disabled without a verified provider arrangement.

4. Recipient and contact data

You (the customer) act as the source of recipient information. You are responsible for having the authority to collect, upload, and use recipient names and phone numbers, and for honoring recipient requests. We store recipient details so your campaigns can be created, delivered, and reported on. We do not use your recipient lists for our own marketing.

5. Analytics

We use PostHog for product analytics and exception telemetry when enabled. Events may include opaque user or organization identifiers, event names, counts, and limited sanitized technical error details needed to diagnose failures. We do not intentionally send recipient phone numbers, contact records, message scripts, voice audio, cloned voice material, authentication tokens, or secrets to analytics. Analytics can be disabled at the deployment level. See our Cookie Policy for browser storage details.

6. Service providers

We share data with the following categories of providers, only as needed to operate the Service:

• Authentication: Clerk — account login and identity.
• Application data and file storage: Convex — database, file storage, and server functions.
• Voice technology: ElevenLabs and/or Cartesia — voice cloning and text-to-speech generation (the active provider depends on deployment configuration).
• Voicemail delivery: Slybroadcast — delivery of voicemail audio and recipient phone numbers to carrier networks, and delivery-status reporting.
• Analytics: PostHog — product analytics as described above.
• Hosting: Vercel — application hosting.
• Payments: the payment processor identified at checkout — payment and subscription administration.

These are EchoDrop service providers. Services you independently connect, such as Google, calendars, and customer-authorized applications, are separate integrations governed by the permissions you grant and their own terms.

7. Data retention

We retain ordinary Customer Content while your subscription entitlement is active. If you cancel at the end of a paid period, it remains available until access actually becomes inactive. At that point we begin an organization-scoped deletion workflow for contacts, recipient details, campaign drafts and content, scripts, templates, recordings, generated and uploaded audio, voice enrollment material, and provider voice resources. Required storage and provider cleanup is tracked and retried if unsuccessful. We may retain minimized invoices, payment and acceptance records, security or fraud audit data, legally required certifications, suppression evidence needed to prevent prohibited re-contact, and records under a legal hold. We do not retain full contact profiles or voicemail content solely to keep suppression evidence.

Delivery providers may retain campaign or delivery records under their own terms and applicable legal obligations. Our in-app deletion workflow does not itself confirm deletion of those provider records.

8. Security

We use commercially reasonable technical and organizational measures designed to protect the Service, including authenticated access control, organization-level data isolation, TLS encryption in transit for hosted services, and limited internal access. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

9. Your choices

• Update profile and organization settings from within the app.
• Delete individual contacts, suppression entries, and voicemail messages.
• Delete your enrolled voice (see "Voice data").
• For account, export, or other privacy requests, contact support@simplecois.com.

10. U.S. state privacy rights

Depending on your state of residence, you may have rights under applicable state privacy law, such as rights to access, correct, delete, or know about personal information. To exercise any available right, contact support@simplecois.com. We will not discriminate against you for exercising a legal right. This section does not confer rights beyond those provided by applicable law.

11. Children

The Service is for business users aged 18 or older and is not directed to children. Do not submit Protected Health Information or other regulated medical information unless EchoDrop has expressly authorized that use and all legally required agreements and safeguards are in place. EchoDrop does not represent that the Service is HIPAA compliant or offer it for unauthorized PHI processing.

12. Legal process and protection

We may disclose information when reasonably necessary to comply with applicable law or respond to valid subpoenas, warrants, court orders, or governmental requests; enforce agreements; investigate fraud or abuse; protect security; or protect the rights and safety of EchoDrop, users, recipients, and others.

13. Business transfers

Relevant information may transfer in connection with a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar transaction, subject to applicable law and governing privacy obligations.

14. Changes and contact

We may update this Policy; the current version is always posted here with its effective date. Questions and requests: support@simplecois.com. We do not sell personal information.