Privacy Policy
How ProductEcho Cloud Service LLC (Brand: ProductEcho) collects, protects, stores, and processes data for developers, businesses, and autonomous AI agent runtimes.
Privacy at a glance
Encrypted in Transit
Console, API, and MCP traffic use HTTPS, and database connections use TLS 1.2 or later.
Your Region, Your Data
Apps and databases run in US East by default, or in Asia-Pacific or the EU on request, and stay in the region we confirm.
Payments Handled by Dodo
Our payment partner and merchant of record handles card data. We never store raw card numbers, CVVs, or bank credentials.
No Model Training
We do not sell your code, logs, or agent prompts to third parties, nor use them to train artificial intelligence models.
1.Introduction, Controller Identity & Scope
ProductEcho Cloud Service LLC, a Delaware limited liability company with its registered office at 8 The Green, Suite B, Dover, Delaware 19901, United States (Brand: ProductEcho, "we", "us", or "our"), is committed to respecting your privacy and protecting the security of code, databases, financial transactions, and autonomous AI agent workflows deployed through our cloud infrastructure.
This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information and technical data when you visit our website at productecho.com, access the web console at app.productecho.com, use our Model Context Protocol (MCP) server, or subscribe to and deploy workloads on the ProductEcho Cloud Service.
Our roles. For personal data about you as an account holder, website visitor, or person who contacts us, we are the controller. For personal data that you or your end users put into your applications and databases ("Customer Content"), you are the controller (or the processor, if you handle it for your own clients) and we are the processor, acting only on your instructions under our Data Processing Addendum. If you are an end user of one of our customers' applications, please contact that customer about your data.
2. Information We Collect
We collect information across several categories to provide, bill, and maintain our cloud infrastructure and AI runtime service:
Account & Developer Profile Data
When you sign up via email OTP, Google Sign-In, or link a GitHub/Claude account, we store basic profile details including your name, email address, Google account subject ID (when applicable), OAuth tokens, and subscription preferences. Google Sign-In only requests openid, email, and profile scopes; we use that data solely to authenticate you and create or access your ProductEcho Cloud Service workspace.
Billing & Payment Information
When you purchase a subscription plan (such as the Pro tier) or add compute credits, your payment is collected and processed by Dodo Payments, our payment partner and merchant of record. ProductEcho does NOT store or process raw credit/debit card numbers, CVV codes, or banking passwords. We receive and store only what we need for invoicing, account status, tax compliance, and refunds: your plan and amounts, subscription and transaction identifiers, payment status, billing contact details and country, tax identifiers you provide, and non-sensitive payment references such as card brand and last four digits where the gateway provides them.
Agent Telemetry & Tool Calls
When an AI agent (such as Claude, Cursor, or ChatGPT) invokes ProductEcho MCP tools (e.g., mcp__product_echo__deploy_app), we log execution requests, tool status codes, and container build logs necessary to present deployment output and runtime diagnostics to you.
Infrastructure Metrics, Logs & Usage
We automatically aggregate hardware usage metrics (CPU, RAM, DB storage volume, HTTP requests, bandwidth) to manage cloud resources, calculate metered usage, and prevent platform abuse. We also keep runtime logs from your applications and web access logs, which include visitor IP addresses and requested URLs.
Support & Contact Messages
If you write to us through the contact form or by email, we keep your name, email address, and the content of your message so we can respond and resolve your request.
Website & Device Data
When you visit productecho.com, we and our analytics providers collect your IP address, browser and device type, pages viewed, and the page that referred you (see Section 9).
Customer Content (where we are the processor)
The source code, environment variables, databases, and files you deploy to ProductEcho. We host and process this data for you. We do not access its contents except to provide the Service, to give support you ask for, to investigate abuse or a security incident, or when the law requires.
3.How We Use Your Information & Legal Bases
ProductEcho Cloud Service uses collected information strictly for operational, billing, and security purposes:
- Provisioning, maintaining, and scaling isolated PostgreSQL databases, container microservices, and AI agent runtimes.
- Executing programmatic MCP tool instructions issued from authorized AI assistant sessions.
- Processing subscription billing, recurring renewals, and refunds through our payment partner, and delivering electronic receipts and tax invoices.
- Issuing and renewing TLS/SSL certificates for public HTTPS URLs (
*.productecho.com). - Detecting and blocking malicious runtime execution, crypto-mining, denial-of-service attempts, or payment fraud.
- Providing customer support, billing resolution, and technical troubleshooting.
- Measuring how our website and console are used so we can improve them.
Legal bases (EU and UK visitors). We rely on contract to provide the Service, bill you, and support you; legitimate interests for security, fraud prevention, abuse detection, service analytics, and product improvement; legal obligation for tax and accounting records; and consent where the law requires it, for example for optional marketing messages. You can withdraw consent at any time.
4.Payment Processing & Financial Security
When you initiate a paid subscription or add-on purchase for the ProductEcho Cloud Service, financial transactions are handled as follows:
Merchant of Record: Payments are processed by Dodo Payments, which acts as merchant of record. It collects your card, UPI, net banking, or other payment details and is responsible for cardholder data security and payment-industry (PCI-DSS) compliance. Its own privacy policy governs the data it collects.
Encryption in Transit: Checkout sessions and payment authorization transmissions are secured with Transport Layer Security (TLS).
Zero Raw Card Storage: ProductEcho never sees, stores, or logs raw credit card numbers, CVVs, or cardholder banking passwords on our servers. We use references issued by the payment gateway to manage recurring renewals and cancellations.
Tax Invoicing & Records: We maintain payment reference numbers, amounts, timestamps, and customer tax identifiers as required by applicable tax authorities and accounting standards.
5.Hosting Regions, Data Location & International Transfers
ProductEcho runs on Amazon Web Services (AWS) data centers. Where your data is stored depends on what it is:
- Account, billing, and control-plane data (the systems behind the console, API, and MCP server) are hosted in the United States (AWS US East, N. Virginia).
- Customer Content (your applications and managed PostgreSQL databases) runs in the United States (AWS US East, N. Virginia) by default. Asia-Pacific (AWS Mumbai) and the European Union (AWS Frankfurt) are available on request. We confirm the region with you in writing, and your applications and databases then stay in that region.
- Backups of managed databases are kept in the same region as the database.
Our personnel work remotely from India and other locations and may access systems and, when needed for support, operations, or security, Customer Content from there, and our sub-processors operate in other countries. These are international transfers. Where the law requires a transfer mechanism, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum for the UK), which are included in our Data Processing Addendum, together with the technical and organizational measures described in Section 6.
6.Security Measures & Secret Handling
We use technical and organizational measures designed to protect your data, including:
- HTTPS for the website, console, API, MCP server, and public application URLs, and TLS 1.2 or later for database connections.
- Authentication by email OTP or Google, and workspace-scoped access: console, API, and MCP requests are checked against your workspace and role, and MCP API keys carry scopes you control.
- Database passwords are generated by the platform and stored in Kubernetes Secrets. The console masks secret-looking environment variable values until you choose to reveal them.
- Automated daily snapshots of managed databases, described in our Terms of Service.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach affecting your data, we will notify you without undue delay, and within the period set out in our Data Processing Addendum for Customer Content.
7. Data Retention
- Account and profile data: while your account is active. After termination, you have 30 days to export your data and we delete your applications, databases, and account data within 60 days of termination.
- Customer Content: until you delete it or your account is terminated, then as stated above.
- Database snapshots: 7 days, including after a database is deleted.
- Application runtime logs: 7 days. Web access logs (visitor IP addresses and URLs) are kept for 14 days.
- Billing and tax records: as long as tax and accounting law requires, held by us and our payment partner.
- Support messages: for as long as needed to resolve your request and for a reasonable period afterwards.
- Website analytics: according to the retention settings configured in Google Analytics.
We may keep information longer where needed to comply with legal obligations, resolve disputes, or enforce our agreements.
8.Sub-processors & Third-Party Integrations
We use the following service providers to deliver our platform. They process data only to provide their services to us, under contracts that require appropriate protection:
- Amazon Web Services: hosting, storage, backups, and content delivery.
- Cloudflare: DNS and TLS certificates for custom domains.
- Dodo Payments: payment processing, merchant of record, tax, and invoicing.
- Brevo: transactional and support email.
- Google: Google Sign-In, and Google Tag Manager and Google Analytics on our website.
- GitHub: repository access, only when you connect your GitHub account.
AI ecosystem providers. Anthropic (Claude), OpenAI (ChatGPT), Cursor, and GitHub are tools you choose to connect. When you configure MCP servers, data exchanged with these providers is governed by your agreements with them, not by us.
We will give customers advance notice of new sub-processors that handle Customer Content, as described in our Data Processing Addendum. You can request the current list at admin@productecho.com.
10. Your Data Privacy Rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the use of your personal data, to receive a portable copy, and to withdraw consent. This includes rights under the EU and UK GDPR, US state privacy laws such as the CCPA, and India's Digital Personal Data Protection Act, 2023. You may also lodge a complaint with your local data protection authority. We do not sell your personal data for money, and we do not discriminate against you for exercising your rights.
You can delete your databases, apps, or entire workspace at any time in the ProductEcho dashboard. To exercise any other right, email us at admin@productecho.com from your registered address. We may need to verify your identity, and we respond within the period the applicable law requires, generally 30 to 45 days. If we refuse a request, you may appeal by replying with "Appeal" in the subject. For Customer Content, contact the customer who operates the application, because they decide how that data is used.
11. Children
The Service is not directed to children, and you must be at least 16 years old to use it. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to This Policy
We may update this Privacy Policy. For material changes we will notify you by email or in the console at least 30 days before they take effect, and we will update the version and date above.
13.Privacy & Legal Contact
If you have questions regarding this Privacy Policy, wish to exercise your data privacy rights, or need clarification regarding payment data processing, please contact our team:
Turnaround SLA: Inquiries acknowledged and addressed within 24–48 business hours.