Privacy Policy

1. Who we are

SolEcho is a trading name of BIZWAX WEBDEV SRL, a Romanian company registered with the Trade Register under no. J2023002795408, tax code (CUI) 47632445, VAT number RO47632445, with its registered office in Str. George Vâlsan 12, Sector 6, Bucharest, Romania.

We are the data controller for the personal data described in this policy, except where section 7 says we act as a processor for our clients. Contact us about anything in this policy at hello@solecho.agency.

2. The free AI check (Is AI recommending you?)

What we collect

• Your email address
• The brand name, website, industry and (optionally) company name you enter
• The result of the check: which AI assistants mention your brand, and what they say

Why, and on what legal basis

To send you a link that confirms your email address, run the check, show you the result and email you a copy (performing your request, GDPR art. 6(1)(b)); to stop the free check being abused, which is why each email and website can be checked once (legitimate interest, art. 6(1)(f)); and so that our team can see your request and may follow up once about your result (legitimate interest). You can ask us not to contact you at any time.

Who sees it

To run the check we send questions about your industry and brand to ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google) and Perplexity. They receive your brand name, website and industry, never your email address. Emails are sent through Resend.

How long we keep it

24 months from the check, then it is deleted automatically. You can ask us to delete it sooner.

3. Free tools, contact form and enquiries

Free tools (SEO checker, social post generator, Google Ads audit)

To use one of these tools you give us your email address, and your name if you choose to. We receive your email, your name, what you enter (for example your website, brand or industry) and the result. For the Google Ads audit the result includes your account name, spend and the issues we found, which can name your campaigns. We do not keep any access to your Google Ads account: the access is handed back to Google as soon as the audit is done.

Why: to show you the result and email you a copy (performing your request, GDPR art. 6(1)(b)), and so that our team can see your request and may follow up about your result (legitimate interest, art. 6(1)(f)). You can ask us not to contact you at any time. We do not add you to a mailing list.

Who sees it: the social post generator and the Ads audit summary use Claude (Anthropic), and the SEO checker sends the page address to Google PageSpeed Insights. They never receive your email address.

Contact form

When you send us a message, we receive your name, email address and what you write (for example your company). We use it to answer you (performing your request, or steps before a contract).

Where it is kept and for how long

Tool results and messages are delivered to our inbox by Resend. They are not stored in our website's database, apart from the short-lived counters described in section 6. If you do not become a client, we delete them within 24 months. You can ask us to delete them sooner.

If you book a call, the booking is handled by Cal.com, which processes your name, email and the time you choose under its own privacy policy.

4. Clients and platform users

When you work with us or sign in to the SolEcho platform, we process:

• Name, email address and, with Google sign-in, your profile photo URL
• Contract, invoicing and payment details for your business
• Business data you connect so we can deliver the services (for example Google Ads, Search Console or Analytics data, brand guidelines and content drafts)

Legal basis: the contract with you (art. 6(1)(b)) and our legal obligations, such as keeping accounting records (art. 6(1)(c)).
Retention: account data for as long as the account exists; contract and invoicing records for as long as Romanian accounting law requires (currently 5 years for most documents, up to 10 for some).

5. Cookies and similar technologies

• Your cookie choice is saved in your browser's local storage (cookie-consent) so we do not ask again. Strictly necessary.
• Google Analytics 4 cookies (_ga, _ga_*, up to 2 years) are set only if you click Accept. They tell us how visitors use the site. If you decline, Google Analytics does not load.
• Platform session cookie (solecho-session, 14 days, HttpOnly, Secure) keeps signed-in users signed in. Strictly necessary.

You can change your choice at any time with Cookie settings at the bottom of every page.

6. Keeping the site safe

To limit abuse of our forms and free tools, we count requests per IP address and, for the free tools and the free AI check, per email address, so nobody can flood one inbox (legitimate interest). These counters are deleted automatically after 2 days.

7. The attribution service (visitors to our clients' websites)

Our clients may use the SolEcho attribution snippet to see which marketing channels bring them customers. For this data the client is the controller and we are the processor, acting only on their instructions under a Data Processing Agreement.

• We collect: UTM parameters, landing page and referrer, the email address you give when you sign up on the client's site, and payment amounts and product names if the client connects Stripe.
• We do not collect: IP addresses, device fingerprints or browsing history beyond the landing page.
• The snippet sets a cookie (_se_attr, 30 days, Secure, SameSite=Lax) only after you give consent through the client's own consent tool.
• Retention: up to 25 months, then deleted automatically.

8. Service providers we use

• Vercel: website and application hosting
• Neon: database hosting, EU (Frankfurt)
• Resend: sending emails
• Google: sign-in (Firebase), Google Analytics (only with your consent), Gemini for the AI check, PageSpeed Insights for the SEO checker, and the Google Ads, Search Console and Analytics APIs for the free Ads audit and for clients who connect them
• OpenAI, Anthropic, Perplexity: AI models for the AI check, the free tools, content and analysis
• Mistral: AI model, only in some client monitoring setups
• Cal.com: booking calls

Some of these providers are based in the United States. Where personal data leaves the EU, the transfer relies on the EU-US Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses. We do not sell personal data, and we do not make decisions about you by automated means that have legal or similarly significant effects.

9. Your rights

Under the GDPR (Regulation (EU) 2016/679) and Romanian Law 190/2018 you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data
• Restrict processing
• Port your data to another service
• Object to processing based on legitimate interest, including any follow-up from us
• Withdraw consent at any time, for example for analytics cookies

Email hello@solecho.agency and we will reply within one month. You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority where you live.

10. Security

All data is transmitted over HTTPS/TLS and database connections use SSL. Authentication tokens are verified server-side on every request, payment webhooks are verified by signature, and access is role-based with least-privilege defaults.

11. Changes

We will update this page when what we do with personal data changes, and change the date at the top.