Privacy Policy

1. Who we are

Echoverse Collective Limited (“we”, “us”) is the data controller for personal data collected through echoversecollective.com. Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Our Companies House number is 17203714. You can reach us at admin@echoversecollective.com.

This policy applies to the public website and to Dispatches signups. The EchoVerse Intelligence service has its own AI Use Notice (see AI Disclosure) and will have a supplementary privacy notice before that service goes live.

2. What we collect

• Identity data, name and email when you sign up to Dispatches or register interest in Intelligence. Phone number when you register interest in Intelligence.
• Consent data, the timestamp at which you confirmed you are 16 or over, the timestamp of marketing consent, and the version of these Terms and this Privacy Policy you accepted at signup.
• Audit data, your IP address and browser user-agent at the moment you sign up or submit an Intelligence interest form. Retained for security and abuse prevention.
• Comments, the content of any comment you post, alongside the display name attached to your account.
• Cookies, strictly-necessary first-party cookies: evc_pass and the Supabase sb-* session cookies that keep you signed in, a short-lived sign-in security nonce, and the guest free-read meter (evc_free_read). See our Cookie Policy.
• Usage analytics (only with your consent), anonymous, cookieless page-view and link-click events: the page viewed, the link clicked, the referring page (address only), a coarse browser type, a country code, and a pseudonymous visitor code derived from your IP address and browser user-agent with a salt that changes daily, so events cannot be linked to you across days. Collected only after you accept analytics via the consent banner; full detail in our Cookie Policy. If you are signed in when you accept analytics, events are linked to your account; signed-out visits use a pseudonymous daily-rotating code as before.

We do not collect special-category data or location data beyond country level. We do not run advertising cookies, and usage data is never sold, never used for advertising, and never shared with anyone for their own purposes. It is processed for us by PostHog Inc. (EU servers, listed in our processor register below) and deleted after 30 days. The optional first-party analytics above run only after you accept them, and you can switch them off at any time using the “Privacy settings” link in the site footer.

3. Lawful bases for processing

• Consent (UK GDPR Art 6(1)(a)), for sending you Dispatches email, for any optional marketing communications, and for the optional first-party usage analytics described in section 2. You can withdraw email consent using the unsubscribe link in any email or by emailing admin@echoversecollective.com, and analytics consent at any time via the “Privacy settings” link in the site footer.
• Legitimate interests (Art 6(1)(f)), for the access cookie that keeps you signed in, for limited audit logging to prevent abuse, and for publishing comments you submit alongside your display name. We have considered and balanced these interests against your reasonable expectations; you have the right to object under section 8 below.
• Performance of a contract (Art 6(1)(b)), for processing an Intelligence pilot interest registration as a precursor to entering into the service contract should you opt in.

4. How long we keep your data

We retain your name, email, phone (where given), and consent record until you ask us to delete it. We periodically review inactive subscribers (no opens or clicks for 24 months) for deletion.

Audit data (IP and user-agent captured at signup or EOI submission) is retained for 90 days, then deleted or irreversibly anonymised. We retain it longer only where required to investigate a specific abuse incident.

Comments stay published unless you ask for them to be removed or unless we remove them under our moderation rules.

Analytics events (section 2) from signed-out visits contain no direct identifiers: the pseudonymous visitor code is derived with a salt that rotates daily, so those events cannot be linked to you across days. If you are signed in when you accept analytics, events are linked to your account (section 2). Your raw IP address and user-agent are never stored for analytics.

5. Who else sees it (sub-processors)

We use the following data processors, each under written processor terms:

We do not sell your data, and we do not share it for marketing purposes with any party not listed above. We will update this list if a new processor is engaged.

6. International transfers

Some processors (Anthropic, Google, Slack, Vercel, Cloudflare) are headquartered outside the UK and EEA. Where personal data is transferred to those processors, transfers rely on (a) UK adequacy regulations where applicable, (b) the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or (c) other appropriate safeguards as defined under UK GDPR. Copies of those safeguards are available on request.

7. Cookies and local storage

We use a small set of strictly-necessary first-party cookies: sign-in session cookies (evc_pass and Supabase sb-*), a short-lived sign-in security nonce, and the guest free-read meter. Our optional analytics are cookieless; your analytics choice and small pieces of interface state (for example an onboarding draft) are kept in first-party browser-storage keys on your device. Any additional cookies (embedded media, future features) require your explicit consent. Every cookie and storage key is listed in our full Cookie Policy.

8. Your rights

Under UK GDPR you have the right to:

• request a copy of the personal data we hold about you (Art 15);
• have inaccurate or incomplete data corrected (Art 16);
• request deletion of your data (Art 17), subject to legal-hold exceptions;
• request restriction of processing (Art 18);
• data portability, to receive your data in a machine-readable format (Art 20);
• object to processing carried out under legitimate interest (Art 21);
• withdraw consent at any time, with no detriment, where processing is based on consent.

To exercise any of these rights, email admin@echoversecollective.com. We will respond within 30 days. If you are unhappy with our response you can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.

9. Children

You must be 16 or over to sign up to the newsletter, post a comment, or otherwise submit personal data to us. You confirm this at signup. We do not knowingly collect personal data from anyone under 16.

10. AI processing

Reader personal data is not used to train any third-party foundation model. For how AI is used in our editorial workflow, see our AI Disclosure.

11. Security

We protect your data with row-level security in our database, TLS in transit, access controls on our internal systems, and minimisation of audit-log retention. No system is perfectly secure; we will tell you and the ICO without undue delay if a breach affecting your personal data occurs.

12. Changes to this policy

We update this page when our practices change. The current version and last- updated date are shown above. Material changes are flagged in the footer for 30 days. If a change affects how we process your existing data we will email you before it takes effect.

13. Contact

Privacy questions, data-subject requests, complaints, and corrections: admin@echoversecollective.com.