Legal

Privacy Policy

Echo, a product of Think Basis Inc. · Effective 29 August 2026

1. Who we are

Echo is a product owned and operated by Think Basis Inc., a Canadian federal corporation (corporation number 7134398). Registered office: 15 Allstate Parkway, Suite 600, Markham, Ontario L3R 5B4, Canada. Invoices and legal notices appear under Think Basis Inc. because that is the company behind Echo. In this policy, “Echo,” “Think Basis,” “we,” “us,” and “our” mean Think Basis Inc. acting through the Echo product.

This Privacy Policy covers echoapp.expert, related early-access and contact forms, and the Echo coaching service (voice, SMS, email, web, and related apps). It should be read with our Terms of Use.

Nick Dumitru is our Privacy Officer for PIPEDA purposes. Privacy questions, access requests, and complaints: [email protected]. You may also write to the address above.

2. Who decides

For this website and for early-access or contact enquiries, Think Basis Inc. decides why and how personal information is used. In privacy-law terms we are the controller (or “organization”) for that information.

For information inside a customer’s Echo workspace (playbooks, session recordings, transcripts, memories, KPIs, CRM or spreadsheet connections you turn on), your employer or the subscribing company decides what is loaded and who on their team may use Echo. We process that information to provide the service they asked for. In privacy-law terms we are a processor or service provider for that Customer Content, and they are the controller. If you are a rep being coached, start with your employer. A Data Processing Addendum is available to customers on request.

We may also use limited account, billing, usage, and security information as a controller so we can run, secure, and improve Echo.

3. What we collect

This website and the contact form

If you write to us we collect:

• name, work email, company, team size, why you are writing, and your message
• technical data such as IP address, approximate location derived from IP, browser, and the time of the request, used for spam filtering, security, and delivery

We do not run advertising pixels or analytics scripts on echoapp.expert today. Our host may still see connection logs that are ordinary for any website.

The Echo service

Depending on how a customer uses Echo, we may process:

• Account and team data: names, work emails, phone numbers, roles, authentication data, and channel identities used to call, text, or email a person
• Customer Content: playbooks, products, pricing, objections, SOPs, scripts, knowledge you upload or ask us to ingest (including websites you designate), CRM or spreadsheet values you connect, and anything a user types or says to Echo
• Session data: voice calls, recordings, transcripts, SMS and email threads, coaching recaps, scores, memories Echo keeps about how a person learns, and manager reports
• Usage Data: how the product is used, device and log data, quality and safety signals, and technical diagnostics
• Consent records: where the product records that a user agreed to recording or related features

We do not want payment-card numbers, government ID numbers, or patient charts in Echo. See Acceptable Use in the Terms of Use.

4. How we use it

We use information to:

• reply to enquiries and decide whether Echo is a fit
• provide, customize, and operate coaching (including voice, SMS, email, roleplay, and reports) on the customer’s own material
• authenticate users, keep the service up, prevent spam and abuse, and handle security incidents
• meet legal obligations and enforce our terms
• improve Echo. We use Usage Data and De-identified Data (Customer Content from which identifiers of your organization and its people have been removed so it does not identify you or them) to maintain quality, safety, prompts, and coaching methods. Improvements and anything learned in de-identified or aggregated form belong to Think Basis Inc. We will not disclose your identifiable Customer Content to another customer, and we will not use it to market to, or build a coaching program for, an identified competitor of yours.

If you do not want a specific document used beyond serving your own workspace, do not upload it.

Legal bases (where a law asks for one): performance of a contract; our legitimate interests in operating and improving a B2B product, securing it, and answering enquiries; consent where we ask for it (including certain emails and, where required, recording); and legal obligation.

5. Silos and sessions

Echo is a multi-tenant service. It is designed so each customer’s workspace is logically separated from every other customer’s. Facts, playbooks, knowledge, and KPIs are stored and retrieved per organization. Coaching memories and chat history are stored per organization and per user.

Sessions are designed to be individual. Echo is not built to reveal one user’s session content to another user except through features the customer enables, for example manager reports and team summaries. Recordings are treated as belonging to the person who was coached, not as a library for other companies.

We use commercially reasonable technical and organizational measures to maintain that separation, including per-organization access controls, tenant-scoped queries, and automated isolation tests. We will not intentionally disclose identifiable Customer Content to another customer.

No software is defect-free, and no vendor controls what a person on your team repeats, screenshots, or takes with them to a new job. We do not warrant that Customer Content will never be accessed, disclosed, or commingled in error, or that using Echo will establish or preserve trade-secret status for anything you load. Our responsibility for a failure of these measures is described in the Terms of Use.

Think Basis Inc. personnel may access a workspace when needed to provide support, stop abuse, handle a safety event, or operate and improve the service. They are under confidentiality duties. A privileged operator role exists for that work. It is not a feature that shares your playbook with other customers.

6. AI providers

Echo generates coaching with third-party models. Relevant Customer Content, including portions of your playbook, facts, KPIs, and session context, is sent to those providers so they can return a response. We do not run a private foundation model of our own.

Current AI model providers: xAI (primary), Anthropic and OpenAI (fallbacks and, for some voice sessions, realtime audio). We choose providers whose standard API terms say they do not use API customer content to train their publicly available foundation models by default. We are reporting their published terms, not warranting their internal practices. They may retain limited logs (for example abuse monitoring) under their own policies. We have not enabled a zero-data-retention program with them, and we cannot control what they do inside their systems.

Those models were trained by their providers on large collections of text that may include books, courses, and sales methods Echo has not licensed. Output can be wrong and may resemble third-party material. Treat it as training material, not as professional advice and not as a licensed copy of someone else’s method. See the Terms of Use.

7. Who else sees it

We do not sell personal information. We do not sell your playbook.

We share information with:

• Service providers / subprocessors who help us run Echo, currently including: Cloudflare (this website, email delivery of enquiries and product mail, and related network services); OOPSpam via RapidAPI (spam scoring on the contact form); Render (application hosting); Amazon Web Services (object storage for files and recordings); Twilio (voice and SMS); xAI, Anthropic, and OpenAI (AI inference as described above). They may only use the information to provide their service to us, except where their published terms make them an independent controller for a narrow purpose such as security or abuse prevention.
• Integrations you turn on. If you connect a CRM, spreadsheet, or similar tool, that provider processes data under their terms as well.
• Your organization. Owners and managers see what the product is built to show them, including team-level reports. That is the customer’s choice as employer.
• Professional advisers under confidentiality, and authorities when the law requires it or we must protect rights, safety, or the service.

Much of this processing happens in the United States. Information may be accessible to US authorities under US law. We use providers who offer contractual protections appropriate to a cross-border transfer for a Canadian organization of our size.

If we are involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, still under this policy or a successor that is no less protective of the commitments here.

8. Safeguards

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of this information and reasonable for a company of our size and stage, including encryption in transit, access controls, and tenant isolation testing.

No method of transmission or storage is completely secure. We will use commercially reasonable efforts to protect Customer Content and personal information, and we will notify affected customers without undue delay of a breach of security safeguards as required by applicable law. We do not warrant that information will be free from loss, unauthorized access, or disclosure. Remedies are subject to the limitation of liability in the Terms of Use.

9. How long we keep it

• Website enquiries: as long as needed to reply, prevent spam, and keep ordinary business records.
• Workspace data: for the life of the customer account, then deleted or de-identified within a reasonable period after termination, unless we must keep a copy for legal, security, or dispute reasons.
• Backups and security logs: for a limited rotating period.
• De-identified or aggregated insights used to improve Echo may be kept because they no longer identify you.

You can ask for an export of your own profile data where the product provides it. Account-level deletion is handled with the customer (the controller of workspace data).

10. Your rights

Depending on where you live, you may have the right to know whether we hold personal information about you, to access it, to correct it, to withdraw consent (where we rely on consent), to complain, and under some laws to deletion, portability, or restriction. Quebec residents have additional rights under Law 25. California residents have rights under the CCPA/CPRA; we do not sell or share personal information as those statutes use those words, and we do not use or disclose sensitive personal information to infer characteristics except as needed to provide Echo.

For information in a customer workspace, we will direct you to the customer where that is the correct path, and we will assist them as the processor.

Write to [email protected]. We may need to verify who you are. You may complain to the Office of the Privacy Commissioner of Canada, and to your provincial or state regulator where they have jurisdiction.

We do not currently have a requirement to appoint an EU representative. Echo is offered as a business service. If that changes, we will update this policy.

11. If your employer uses Echo

Your employer chose Echo and is responsible for telling you that an AI coach may call, text, email, record, and transcribe you, and for any consents the law requires of an employer. They control who is enrolled and which manager features are on.

Onboarding sessions are designed to be delivered to you on your verified channel. Echo is not designed to publish your private onboarding conversation as a named report to your manager. Managers may still receive team-level summaries the customer has enabled. We do not promise that no operator or no software defect could ever surface session content inside your company.

If you want to stop calls or texts, tell your employer and use the stop path we provide on SMS where applicable. You can also write to us; we will still need the employer’s instruction for workspace deletion.

12. Email and CASL

If you submit the contact form, we will reply about Echo. That reply is a response to your request. We will not add you to a promotional list unless you separately ask us to. You can tell us to stop at any time by replying or writing to [email protected]. Product mail to enrolled users (recaps, manager digests, account messages) is part of the service the customer bought; those users can opt out of non-essential coaching mail in the product or through their employer.

Sender: Think Basis Inc., 15 Allstate Parkway, Suite 600, Markham, Ontario L3R 5B4, operating Echo.

13. Cookies

The marketing site does not set its own advertising cookies. The Echo application uses cookies or similar storage that are needed to keep you signed in and to secure the session. Cloudflare or other hosts may set technically necessary cookies. You can block cookies in your browser; the service may not work without the ones required to authenticate.

14. Changes

We may update this policy. The effective date above will change. Material changes will be posted on this page. Continued use of the website after a change means you accept the updated policy for website data. For the Echo service, we will give customers notice of material changes as described in the Terms of Use.

Questions: [email protected].