Privacy Policy
Last updated: 24 October 2026
In short. Content Echo turns a YouTube creator's public videos into an assistant that answers their audience. We collect the minimum we need to run it, we don't sell personal data, we don't use advertising or analytics cookies, and you can ask us to delete your data at any time by writing to hello@usecontentecho.com.
1. Who we are
Content Echo ("Content Echo", "we", "us") provides the service available at usecontentecho.com and the assistants we run for creators on websites and on Telegram (the "Service").
For the personal data described in this policy where we decide how and why it is used, Content Echo is the data controller. Contact: Content Echo, Unit 119689, PO Box 6945, London, W1A 6US, United Kingdom · hello@usecontentecho.com.
This policy is written to meet the UK GDPR, the Data Protection Act 2018 and the EU GDPR.
2. Creators, viewers and our role
- Creators and website visitors. When you visit our website, join the waitlist, apply to the beta or subscribe, we are the controller of your data.
- Viewers who talk to a creator's assistant ("end users"), on the creator's website widget or on Telegram. The creator is the controller of their audience's data (for example the emails on their allowed-users list, Telegram usernames and the questions asked). Content Echo acts as the creator's processor and handles that data only to run the creator's assistant, following the creator's instructions. If you are an end user, please contact the creator first; we will help them respond. Creators can request our data processing terms at hello@usecontentecho.com.
3. What we collect
From creators and website visitors
- Contact and account data: email address and, when you apply or subscribe, your name and your YouTube channel URL.
- Public channel data: by providing your public channel URL, you ask us to fetch your channel's public metadata (title, statistics, video titles and descriptions) and the transcripts of your public videos. We do not ask for access to your Google or YouTube account.
- Assistant settings: your bot settings, allowed domains and allowed-users list, kept in your Admin Console (a Google Sheet shared with you) and in our database.
- Billing data: payments are handled by Lemon Squeezy (see section 6). We receive your name, email, plan, order and subscription status. We never see or store your full card details.
- Communications: emails you send us, and delivery events for the emails we send you (for example delivered, bounced or unsubscribed).
- Telegram data if you use the creator bot: your Telegram user ID and username.
- Security data: when you submit a form, Cloudflare Turnstile checks that you are human using technical signals from your browser and IP address.
From end users of a creator's assistant (processed for the creator)
- The questions you ask and the answers given, and the time of each message.
- Your email address, if the creator asks for it to give you access (website widget).
- Your Telegram user ID and username, if you use the creator's Telegram bot.
- A random browser identifier created by the widget, used to keep your conversation together and to limit abuse (rate limiting).
- Technical data your browser sends with each request (such as the page origin and user agent).
4. How we use it and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Run the waitlist and tell you when the beta opens | Your request (steps before a contract) and our legitimate interest in launching the Service. You can unsubscribe at any time. | |
| Review beta applications | Name, email, channel URL, public channel statistics | Steps you ask us to take before entering into a contract |
| Provide the Service: index your videos, run your assistant, onboarding and service emails | Account, channel, settings, Telegram data | Performance of our contract with you |
| Answer end users on behalf of creators | End-user data listed in section 3 | Processed for the creator, who determines the legal basis |
| Billing and accounting | Billing data | Contract and legal obligations |
| Security, abuse prevention and service reliability | Security data, browser identifier, logs | Legitimate interests (keeping the Service safe and available) |
| Product updates and tips about the Service you use | Legitimate interests (soft opt-in for existing customers). Every email has an unsubscribe link. |
We do not sell personal data, we do not use it for advertising, and we do not make decisions with legal or similarly significant effects about you based solely on automated processing.
5. AI processing
To answer a question, the assistant searches the creator's indexed transcripts and sends the question, the most relevant transcript excerpts and recent conversation context to an AI model provider, which generates the answer. Answers are grounded strictly in the creator's video transcripts, but AI-generated text can still contain mistakes. To prepare weekly summaries for creators, recent questions may also be processed by an AI provider.
We use these providers through their business APIs and do not authorise them to use this data to train their models.
6. Service providers (subprocessors)
We share personal data only with providers that help us run the Service, under contracts that require them to protect it:
| Provider | What they do for us | Data involved |
|---|---|---|
| Supabase | Cloud database: accounts, assistant settings, transcript index, query logs | Account, channel and end-user data |
| Hostinger | Hosting of our automation server, website and DNS | All Service data processed on our server; website requests |
| OpenAI | AI models: text embeddings for search and answer generation | Questions, transcript excerpts, conversation context |
| OpenRouter (routing to Google Gemini models) | AI answer generation and application review | Questions, transcript excerpts; beta application details |
| Google (Gemini API, YouTube Data API, Google Sheets and Drive) | AI answer generation; reading public channel data; Admin Console and internal records | Questions and excerpts; channel URL and public metadata; settings, allowed users, waitlist and lead records |
| Supadata | Fetching transcripts of public YouTube videos | Channel and video identifiers |
| Resend (EU region, Ireland) | Sending service and account emails | Email address, email content |
| Mailgun | Sending some sales replies | Email address, email content |
| Telegram | Delivering the Telegram assistants and our internal notifications | Telegram IDs, usernames, messages |
| Cloudflare | Turnstile bot protection on our forms; storage of website media | Browser signals and IP address during the check |
| Lemon Squeezy | Merchant of Record: checkout, payments, taxes, invoices, refunds. Lemon Squeezy is an independent controller for payment data under its own privacy policy. | Billing data |
We may also disclose data if required by law, or to protect our rights, our users or the public.
7. International transfers
Some providers process data outside the UK and the European Economic Area, mainly in the United States. When that happens, we rely on an adequacy decision (including the EU–US Data Privacy Framework and the UK Extension, where the provider is certified) or on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, plus additional safeguards where needed. You can ask us for more information at hello@usecontentecho.com.
8. How long we keep data
- Waitlist: until you unsubscribe, or 12 months after the Private Beta opens, whichever comes first.
- Beta applications that are not accepted: up to 12 months, so we can invite you to later rounds.
- Creator accounts, transcript indexes and end-user data: for as long as the assistant is active. When a subscription or beta ends, access is paused and the data is kept for up to 90 days so you can come back without losing your setup; after that it is deleted. You can ask for earlier deletion at any time.
- Billing records: as long as tax and accounting law requires (generally 6 years in the UK).
- Email suppression list: if you unsubscribe, we keep your email address on a suppression list so that we don't email you again.
- Security and server logs: for a limited period, normally no longer than 60 days.
9. Cookies and local storage
Our website does not use advertising or analytics cookies. Cloudflare Turnstile may store strictly necessary data in your browser to perform the security check. If you open a checkout, Lemon Squeezy loads its own payment window, which may set its own cookies under its policy.
The website widget that creators add to their sites stores the following in the visitor's browser (localStorage), only on that site:
ce_<bot>_uid: a random identifier for the conversation;ce_<bot>_history: up to the last 50 messages, so the conversation is still there when you come back;ce_<bot>_email: your email, only if the creator asked for it and you entered it.
This storage is needed for the chat you start to work, it is not used for tracking, and it stays in your browser: the email and messages are sent to us only when you chat. You can delete it at any time with the "new conversation" (↺) button in the widget or by clearing your browser's site data.
10. Your rights
You have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent where we rely on it. To exercise any of these rights, write to hello@usecontentecho.com. We will reply within one month. If you are an end user of a creator's assistant, we will pass your request to the creator and help them answer it.
You can also complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority of your country. We would appreciate the chance to resolve your concern first.
11. Security
Data is encrypted in transit (HTTPS/TLS) and stored with providers that encrypt data at rest. Each creator's data is logically separated from other creators' data, access to production systems is restricted, and our forms are protected against bots. No system is completely secure; if a breach affects your data, we will notify you and the authorities as the law requires.
12. Children
The Service is not directed to children under 16, and creator accounts are for adults acting for their channel or business. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes and contact
We may update this policy when the Service or the law changes. We will change the date at the top and, for important changes, notify customers by email before they take effect.
Questions or requests: Content Echo, Unit 119689, PO Box 6945, London, W1A 6US, United Kingdom · hello@usecontentecho.com.