Privacy Policy

What we collect, why we collect it, who else sees it, and how to ask us to delete it. Written in plain English, not in lawyer.

Effective May 7, 2026

The short version

Echolo runs a small B2B IoT business. The information we collect is the information we need to talk to you, ship hardware to you, run the Fleet platform on your behalf, and keep our books. We do not sell your data, we do not run advertising on this site, and we do not feed your telemetry into a benchmark we resell to someone else.

If you have questions, email support@echolo.io.

Who we are

"Echolo," "we," "us," and "our" mean Echolo, LLC, a Texas limited liability company located at PO Box 337, Fate, TX 75132, United States. For privacy questions, write to support@echolo.io or to the address above.

This policy covers our marketing site at echolo.io, the Fleet platform we operate for customers, and hardware we sell. It does not cover third-party sites we link to.

What we collect

The categories of information we collect:

From the contact form on this site

• Your name, email address, optional company name, the intent you selected (demo, custom build, just curious), and the message you typed. The submission is verified with a Cloudflare Turnstile challenge — we receive a pass/fail token, not your interaction with the challenge.

From your browser

• Standard server logs from our edge: IP address, user agent, request timestamp, and the URL you requested. We use these for security, debugging, and basic operational troubleshooting. We do not run third-party analytics on this site.

When you become a Fleet customer

• Account information you provide (names, email addresses, role, company), authentication credentials (hashed), and the telemetry data your hardware sends to the platform — beacon IDs, RSSI, location data, asset metadata, and whatever else is in scope for your deployment. The telemetry data is yours; we are processing it on your behalf.

When you order hardware

• Billing and shipping details, payment information (handled by Stripe — we don't see card numbers), and order history. Records of orders are retained for accounting and tax purposes through QuickBooks.

We do not collect

• Advertising identifiers, cross-site tracking data, social graph information, location data from your phone, or anything you haven't explicitly given us. We do not knowingly collect information from anyone under 16.

How we use it

• Respond to inquiries you send through the contact form.
• Provide, operate, and improve the Fleet platform and the hardware we ship.
• Process orders, ship hardware, issue invoices, and meet our tax and accounting obligations.
• Detect, investigate, and prevent abuse, fraud, and security incidents.
• Comply with applicable laws, court orders, and other valid legal requirements.

For people in the EEA or UK, our lawful bases under the GDPR are one or more of: contract (to provide the platform or fulfill an order), legitimate interests (running and securing our business, responding to inbound inquiries), legal obligation (tax, accounting, compliance), and consent (where we ask for it explicitly).

Sub-processors

We share information only with vendors who help us run the business. Each one is bound by a written agreement and is named below.

We update this list when it changes. Material additions are announced in the changelog at the bottom of this page.

Data residency

Customer telemetry and account data on the Fleet platform are stored in the United States. We do not replicate customer data to non-US regions without a written agreement to do so.

International transfers

If you contact us from the EEA, UK, or Switzerland, the information you send reaches servers in the United States. We rely on the European Commission's Standard Contractual Clauses (or the equivalent UK Addendum) with our sub-processors where applicable, plus reasonable supplementary measures (encryption in transit and at rest, access controls).

Retention

• Marketing leads (contact-form submissions, CRM records): up to 24 months from the date of last contact, then deleted or anonymized.
• Customer account and telemetry data: for the duration of the customer's contract plus a reasonable post-termination period (typically 30 days for export, then deletion). Specific terms are in the customer's signed agreement.
• Order and accounting records: retained for the period required by US tax and commercial law (generally seven years).
• Server logs: rolled off within 90 days of generation in the normal course.

You can request earlier deletion using the contact details below. Some records (e.g., tax-relevant invoices) we are required by law to retain for the full period.

Your rights

Depending on where you live, you may have specific rights over the personal information we hold about you. To exercise any of the rights below, email support@echolo.io. We respond within 30 days, or sooner if your local law requires it. We may need to verify your identity before acting.

If you are in the EEA, UK, or Switzerland (GDPR)

• Access — get a copy of the data we hold about you.
• Rectification — fix inaccurate data.
• Erasure — ask us to delete data we no longer have a lawful basis to hold.
• Restriction or objection — limit our processing in certain cases, including objection to processing based on legitimate interests.
• Portability — receive your data in a portable format.
• Withdraw consent at any time, where consent applies.
• Lodge a complaint with your local supervisory authority.

If you are a California resident (CCPA / CPRA)

• Right to know what personal information we collect, use, disclose, and the categories of sources and recipients.
• Right to delete personal information we collect.
• Right to correct inaccurate personal information.
• Right to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under California law.
• Right to limit the use and disclosure of sensitive personal information. We do not use sensitive personal information for purposes that would trigger this right.
• Right not to be discriminated against for exercising these rights.

You may use an authorized agent. We will require reasonable proof of authorization.

Cookies and tracking

This marketing site does not run third-party analytics, no advertising trackers, and no social-media pixels. The only browser storage we set on this site is the Cloudflare Turnstile challenge token, which is a security mechanism for the contact form, not a tracker.

The Fleet platform — when you sign in — uses standard session cookies and security tokens necessary to keep you authenticated. Those are functional, not advertising.

Children

Our products are sold to businesses. They are not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us data, contact us and we will delete it.

Security

We use TLS in transit, encryption at rest on managed services that support it, role-based access controls for our internal systems, and standard hardening on our infrastructure. No system is perfectly secure; if we ever discover a security incident that affects you, we will notify you in line with applicable law.

Changes to this policy

We update this policy when our practices change. Material changes will be announced by updating the "Effective" date at the top of this page and, for active customers, by direct notice. Your continued use of the site or the Fleet platform after the effective date of a change constitutes acceptance.

How to contact us

Echolo, LLC
PO Box 337
Fate, TX 75132
United States
Email: support@echolo.io