Privacy Policy

Last updated: 8 July 2026

1. Data Controller

The data controller is Fco. Javier Ferraz Rives, trading as Kokoaweb.
C/ Fernando el Católico 61, 50006 Zaragoza, Spain · NIF: 25484775Q
Contact: privacy@echocontrol.app

2. Data We Collect and Why

2.1 Website Analytics

We use two analytics tools on this website:

• Vercel Analytics — provides aggregated traffic statistics (page views, referrers, country of origin). This tool does not use cookies, does not track individuals across sessions, and does not collect personal data. No consent is required.
• PostHog — provides session analytics and A/B testing. PostHog may collect your IP address (anonymised after processing), browser type, operating system, pages visited, and session duration. It sets a first-party cookie to identify sessions and split traffic between landing page variants. Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in improving the website; you may opt out — see our Cookie Policy.

2.2 Purchase Data

EchoControl is sold through two channels:

• Paddle (direct channel) — Paddle (Paddle.com Market Ltd) acts as the Merchant of Record and processes your payment under their buyer terms. They share with us your email address and order ID solely for the purpose of delivering your license key. We do not receive or store your payment card data. Legal basis: performance of contract (Art. 6(1)(b) GDPR).
• Steam — Steam handles the entire purchase transaction. We receive no personal data from Steam purchases; license validation on Steam is handled by Steam's own authentication.

2.3 License Activation Data

When you activate EchoControl, the application sends the following to our activation server (echocontrol.app/api/activate):

• Your license key
• A non-reversible hardware fingerprint — a one-way hash derived from hardware identifiers on your machine. It cannot be used to reconstruct the original identifiers and cannot identify you personally.

We store: the fingerprint, activation timestamp, and activation count (to enforce the 2-device limit). We do not store your IP address beyond transient server logs (retained 30 days for security). Legal basis: performance of contract (Art. 6(1)(b) GDPR).

2.4 Support Communications

If you contact us by email, we retain your email address and the content of your messages to handle your enquiry. Legal basis: legitimate interests (Art. 6(1)(f) GDPR). Correspondence is deleted within 3 years of the last exchange, unless a legal obligation requires longer retention.

2.5 Launch Notification List

Before purchases open, the website offers a form to be notified by email when EchoControl launches. If you submit it, we collect your email address for the sole purpose of sending you a one-time launch announcement. The form is relayed to our support inbox by FormSubmit (see Section 4). Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by emailing privacy@echocontrol.app; addresses are deleted after the launch announcement is sent.

2.6 What the Application Does NOT Collect

After activation, EchoControl runs 100% offline. It does not record, transmit, or store your voice or audio. Speech recognition is performed locally on your device using Vosk, an offline open-source engine. No microphone audio ever leaves your computer.

3. Data Retention

4. Third-Party Processors

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

5. Your Rights (GDPR)

Under GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure ("right to be forgotten") — request deletion, subject to legal obligations.
• Restriction — request we restrict processing while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any right, email privacy@echocontrol.app. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Authority: Agencia Española de Protección de Datos (aepd.es).

6. Security

Our activation server uses HTTPS/TLS for all communications. Hardware fingerprints are one-way hashed before storage. We apply reasonable technical and organisational measures to protect the data we hold. No method of electronic transmission or storage is 100% secure; we cannot guarantee absolute security.

7. International Data Transfers

Our activation server and primary infrastructure are hosted within the EEA (European Economic Area) via Vercel. PostHog may process data in the United States; transfers are covered by their Standard Contractual Clauses (SCCs). Paddle (Paddle.com Market Ltd) is based in the United Kingdom; transfers to the UK are covered by the European Commission's adequacy decision, and any onward processing in the United States is covered by SCCs. Steam is US-based and transfers data under its own legal framework.

8. Cookies

This website uses cookies only for session analytics (PostHog). Vercel Analytics is cookieless. For full details, see our Cookie Policy.

9. Children's Privacy

EchoControl is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, please contact privacy@echocontrol.app and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. Material changes will be announced on this page with an updated "Last updated" date. Continued use of the Service after changes are posted constitutes acceptance.

11. Contact

For any privacy-related questions or to exercise your rights:
privacy@echocontrol.app
Fco. Javier Ferraz Rives (Kokoaweb) · C/ Fernando el Católico 61, 50006 Zaragoza, Spain