Privacy Policy — Echo

This Privacy Policy describes how Agylos collects, uses and protects your personal data when you use the Echo mobile application (hereinafter "Echo" or the "app").

Echo is distributed in the European Union and in Canada.

It serves as the information notice required by Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR"). For users resident in Canada, additional rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Québec residents, under Loi 25 (An Act to modernize legislative provisions as regards the protection of personal information), are described in §7.1.

1. Data controller

The controller of your personal data is:

Agylos, a French société par actions simplifiée (SAS) with a share capital of EUR 5,000, registered with the Nanterre Trade and Companies Register under number 815 320 528, whose registered office is at Bâtiment E, 15 Rue des Bigots, 92190 Meudon, France, represented by Pierre Navarre, in his capacity as President.

For any question concerning your personal data or this Privacy Policy, you may contact Agylos by email at privacy.echo@agylos.eu.

Agylos has not appointed a Data Protection Officer within the meaning of Article 37 GDPR. None of the three criteria of Article 37(1) is met at the time this Policy is published: (a) Agylos is not a public authority or body; (b) its core activities do not require regular and systematic monitoring of data subjects on a large scale; (c) its core-activity processing of special categories of data (Art. 9 — main well-being concern T-14) does not reach the "large scale" threshold within the meaning of EDPB Guidelines WP243, given the volume expected at PMV (a few hundred to a few thousand active users, EU + Canada scope). Agylos may appoint a DPO on a voluntary basis as the volume or scope of the service evolves.

2. Personal data we collect

Echo only collects data strictly necessary to operate the service. The categories below correspond to entries in the internal Record of Processing Activities kept by Agylos under Article 30 GDPR.

2.1. Identification and authentication data

• Opaque Apple identifier (apple_sub) received from the "Sign in with Apple" service.
• Apple email address, either your real address or an Apple relay address (Hide My Email), if you choose to share it.
• Internal opaque user identifier (userId) generated by Agylos and never publicly exposed. This identifier is used as a pivot to link all data belonging to your account.
• Recovery email address (optional) that you enter in the Profile section of the app to anticipate a loss of access to your Apple sign-in method. This address triggers a one-time verification link sent through our partner Sinch (Mailgun EU) — see §4.9 and §5. You can remove it at any time.

2.2. Profile data

• First name, provided when creating your account, used to personalise messages from the coach.
• Date of birth, used to verify the minimum age requirement (16 years, default threshold set by Article 8(1) GDPR) and to tailor content to your profile.
• Preferences for coach personalisation: form of address (informal or formal register), interface language, country of residence, grammatical addressing preference for how Echo speaks to you (the internal addressGender field, collected solely to pick the right grammatical agreement in French copy — no clinical, statistical or marketing use), preferred coach persona gender.
• Main well-being concern you share with Echo to personalise your support — collected only if you tick the dedicated consent checkbox during onboarding (see §3 and §4.8). When you share your main concern with us at sign-up, we keep both your message as you wrote it (up to 1,000 characters) and a general categorisation of that message across seven themes: stress, anxiety, sleep, depression, burnout, relationships, other. That categorisation is produced automatically by an Anthropic model (Claude Haiku 4.5) called server-side during your sign-up, in a pseudonymised context. You can withdraw your consent at any time from the Privacy section of your profile; withdrawal then erases both your message and its categorisation together (see §7).
• Consent timestamps, captured during your onboarding: your acceptance of the Terms of Use and of this Policy (consents.termsAcceptedAt), together with the version number of the contract you accepted (consents.termsVersion); the separate consent to processing of your main well-being concern (consents.primaryConcernAcceptedAt); and your usage-analytics decision — the date of the consent in force (consents.analyticsAcceptedAt) and the date of the last decision you expressed, whether acceptance or refusal (consents.analyticsDecidedAt).
• Technical device context (locale, time zone).

2.3. Content you enter in the app

• Tracking indicators: up to ten standard indicators and one experimental slot, together with the numerical values you enter each day (for example: mood, sleep, energy, serenity, hydration).
• Weekly appointment messages exchanged with the coach, along with your interactions with the widgets offered.
• Appointment summaries (reviewConsolidation) produced by the coach to maintain the longitudinal memory needed to accompany you over time.

2.4. Technical and measurement data

• Firebase technical identifiers (installation ID, Firebase user_id equal to your uid).
• Product measurement events: sign_in, sign_out, account_deleted, daily_entry_submitted, weekly_review_started, weekly_review_completed, onboarding_completed.
• iOS crash reports: stack trace, device model, operating system version, timestamp.
• Aggregated post-install marketing attribution (SKAdNetwork level 1).

2.5. Correspondence data

• Content and metadata of emails you send us at support.echo@agylos.eu or privacy.echo@agylos.eu.

Echo never collects: your location, your contacts, your photos, your HealthKit data, your address book, or your device's advertising identifier (IDFA).

3. Purposes and lawful bases

Each processing activity is grounded in a specific lawful basis under Article 6 GDPR.

Data 2.1 (identifiers, session), 2.2 (onboarding profile) and 2.3 (indicators and appointment) are necessary to perform the service contract — without them Echo cannot function. Data 2.4 (analytics, crash, attribution, BigQuery) rely either on consent (Firebase Analytics, opt-in) or on legitimate interest, which you may object to directly in-app (see §7). The main well-being concern (primaryConcern + primaryConcernRawText, T-14) is optional — its absence does not prevent you from using Echo but degrades the coaching personalisation the coach can offer you.

Echo does not use your data for any advertising purpose, does not carry out individual profiling, and does not take any automated decision that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. The AI coach assists you but takes no medical, financial or administrative decision on your behalf.

4. Retention periods

Agylos only retains your data for as long as is strictly necessary for the purposes described above.

4.1. Account and profile data

Your account, profile and tracking indicator data are retained for the entire lifetime of your account. They are erased immediately when you delete your account from the app ("Delete my account" button in the Privacy section of your profile).

To honour the storage-limitation principle (Art. 5(1)(e) GDPR), Agylos also enforces an inactive-account purge policy. After 24 months without any sign-in, we send a reminder email to the address associated with your account, inviting you to sign back in. If you do not sign back in within the following 12 months (a total of 36 months of inactivity), your account is automatically deleted, as if you had triggered the deletion yourself. The erasure cascade described in §4.2 to §4.7 then applies identically.

4.2. Weekly appointment content

Chat messages and appointment summaries are retained for the entire lifetime of your account and erased upon its deletion. Anthropic's processing cache is limited to a short technical caching window (minutes at most) and Anthropic does not use your messages to train its models ("zero-training" option).

4.3. Product measurement (Firebase Analytics)

Firebase Analytics data is retained for 14 months and then automatically purged by Google. When you delete your account, the Agylos support team additionally submits a full deletion request to Google Firebase Analytics. Deletion on the Firebase Analytics side is executed manually by the support team within 30 days at most after your account deletion (internal SLA documented in Annex D of the Record of Processing Activities).

4.4. Account deletion audit report

The internal audit report Agylos produces when you delete your account contains only your technical Firebase identifier (uid) and the technical status of the deletion steps (the identity itself has already been erased). It is retained for a rolling 3-year period for the purpose of demonstrating compliance (Art. 30 GDPR).

4.5. Pseudonymised weekly appointment instrumentation

The statistical calibration data for the weekly appointment (numerical indicator values, pre-processing outputs) is stored in the European Union (Belgium, europe-west1) for a maximum of 90 days in detailed form, and then retained in aggregated form without any individual identifier. Your user identifier is replaced by an irreversible hash (SHA-256) before any write operation. No free-text content of your messages is stored in this instrumentation.

4.6. Crashlytics

Crash reports are retained for 90 days by default in Firebase Crashlytics.

4.7. Support correspondence and data subject requests

Emails exchanged with support and evidence of the handling of data subject requests are retained for 3 years after case closure, for traceability and to demonstrate compliance.

4.8. Main well-being concern (primaryConcern)

Your main well-being concern — your message as you wrote it (up to 1,000 characters) together with the categorisation of that message across the seven themes stress, anxiety, sleep, depression, burnout, relationships, other — is retained for the entire lifetime of your account, subject to the same inactive-account purge policy as described in §4.1. It can also be erased independently, without deleting your account, if you withdraw your Article 7(3) GDPR consent at any time from the Privacy section of your profile (see §7 and §8). Withdrawal then erases, in the same atomic operation, three items at once: your message as written, its categorisation, and the record of your consent to processing this health-related data. If you later wish to share a new concern with Echo, you will be asked to give your consent again (re-tick the "Health data" checkbox) and to rewrite your message: we keep nothing that would exempt you from this fresh consent. Erasure is immediate on the Echo side; the coach stops using this signal at your next session. Your other consents (Terms of Service and Privacy Policy) are not affected by this action.

4.9. Recovery email address and verification email sending

When you enter a recovery email address in your profile, Agylos sends you a one-time verification link through its partner Sinch (Mailgun EU), based in Frankfurt, Germany. Data is transferred to and stored within the European Union — no transfer outside the EU. The link expires after 24 hours; past this window it is no longer usable and a new link must be requested from the Profile section.

On the Agylos side, the verification link is stored as an irreversible hash (SHA-256); the clear value only transits in the outgoing email. The link is erased as soon as it is consumed (first click), when you remove your recovery email address from the Profile section, or when you delete your account. On the Mailgun side, technical sending logs are retained for a maximum of 3 days (Mailgun EU default policy) and do not contain any application-level content beyond your address and delivery metadata.

Lawful basis: explicit consent (Art. 6(1)(a) GDPR), see §3. Removing your recovery email address from the Profile section counts as withdrawing your consent (Art. 7(3) GDPR) — the associated record is immediately erased on the Agylos side.

5. Recipients and processors

Agylos does not sell, rent or transfer your data to any third party.

Your data is accessible to:

• Internally: the Agylos product, support and data teams, each within the strict scope of what is necessary for their tasks.
• Processors acting on Agylos's instructions, under Data Processing Agreements within the meaning of Article 28 GDPR:

Independent controllers your data is shared with for their own purposes. Certain technical operations involve Apple Inc., which acts as an independent data controller — Apple sets its own purposes (Apple ID identification, SKAdNetwork audience measurement), applies its own end-user terms, does not process these data on Agylos's instructions and does not sign an Art. 26 joint-controller arrangement. The processing activities concerned are:

• Sign in with Apple — providing the apple_sub identifier, the "Hide My Email" relay, and Apple-side authentication;
• SKAdNetwork — aggregated marketing attribution via Apple's level-1 mechanism.

Agylos has no ability to instruct Apple on these processing activities. For the exercise of your rights vis-à-vis Apple, refer to Apple's Privacy Policy: apple.com/legal/privacy.

6. International transfers

Data stored in Firestore and BigQuery is held at rest within the European Union, in the europe-west1 (Belgium) region.

However, certain processing activities involve technical infrastructure located in the United States:

• Firebase Authentication, Firebase Analytics, Firebase Crashlytics, Firebase App Attribution and Firebase Hosting may process data from the United States.
• Anthropic (Claude) processes your weekly appointment messages from the United States.

These transfers are governed by the Standard Contractual Clauses adopted by the European Commission (Implementing Decision 2021/914), which are incorporated into the Google Cloud and Anthropic DPAs referenced in §5. For Canadian users, the same Google Cloud Standard Contractual Clauses also frame the transfer of personal data to Google infrastructure located in the United States (see §7.1).

Agylos does not carry out any transfer other than those described above.

7. Your rights

Under Chapter III GDPR, you have the following rights over your personal data:

• Right of access (Art. 15): obtain confirmation that data concerning you is being processed and receive a copy of it.
• Right to rectification (Art. 16): have inaccurate or incomplete data corrected. Your first name and date of birth can be edited directly from the Privacy section of your profile in the app.
• Right to erasure (Art. 17), i.e. "right to be forgotten": obtain the deletion of your data. You may trigger this deletion yourself, at any time, using the "Delete my account" button in the Privacy section of your profile. Deletion is immediate on the Echo side and triggers a cascading purge of all your data.
• Right to withdraw consent (Art. 7(3) GDPR) to the processing of your main well-being concern (primaryConcern and primaryConcernRawText, basis Art. 9(2)(a) — see §3). You exercise this right directly in the app via the Privacy section of your profile: withdrawal is immediate on the Echo side. It erases, in the same atomic operation, three items at once: your message as you wrote it, its general categorisation, and the record of your consent — never one without the others. The coach stops using this information at your next session, without your account being deleted. If you later wish to share a new concern, you will be asked to give your consent again (re-tick the "Health data" checkbox) and to rewrite your message. Withdrawing is as easy as giving your consent in the first place, and does not affect your other consents (Terms of Service in particular).
• Right to withdraw consent to Firebase Analytics (Art. 7(3) GDPR; basis Art. 6(1)(a) — see §3). This consent is requested during sign-up, as an explicit choice between accepting and declining; no collection takes place until you have given it, and declining has no consequence on your use of Echo. You may change your choice at any time, either way, from the "Usage analytics" toggle in the Privacy and data section of your Advanced settings. Withdrawing is as easy to exercise as giving.
• Right to object (Art. 21) to processing of your data based on Agylos's legitimate interest (Art. 6(1)(f) GDPR). Objection is exercised directly in-app through dedicated toggles in the Privacy section of your profile:
  • Crash reports (Firebase Crashlytics, T-07);
  • Marketing attribution (Firebase App Attribution / SKAdNetwork level 1, T-08);
  • Weekly review algorithm improvement (pseudonymised BigQuery instrumentation, T-09).
  Each toggle immediately cuts the corresponding SDK or flow on your device. For retrospective requests (purging data already collected), you may also write to privacy.echo@agylos.eu quoting the email address associated with your Echo account; Agylos will act on your request within the Art. 12(3) statutory deadline (one month at most) using its internal GDPR scripts (erase_user_data.py, rgpd-audit.log journalling).
• Right to restriction (Art. 18): request the suspension of processing in the cases provided for by the GDPR.
• Right to data portability (Art. 20): obtain your data in a structured, commonly used and machine-readable format. You can exercise this right directly in the app using the "Download my data" button in the Privacy section of your profile. The file is provided in JSON format and delivered through the iOS share sheet (Files, Mail, iCloud Drive, AirDrop, etc., at your choice).
• Right to lodge a complaint with a supervisory authority — see §7.1 (Canadian users) or §7.2 (EU users) for the authority competent for your jurisdiction.

7.1. Additional rights for Canadian users

If you are resident in Canada, the processing of your personal data by Agylos in connection with Echo is additionally covered by Canadian privacy legislation.

PIPEDA (federal). Under the Personal Information Protection and Electronic Documents Act, you have, in particular:

• the right to be informed of the existence, use and disclosure of your personal information;
• a right of access to your personal information and a right to request its correction;
• the right to withdraw your consent, subject to legal and contractual restrictions and reasonable notice.

You may lodge a complaint with the Office of the Privacy Commissioner of Canada — priv.gc.ca.

Loi 25 (Québec). If you are resident in Québec, you also benefit from the additional protections of the Act to modernize legislative provisions as regards the protection of personal information (Loi 25), which strengthens transparency, information and consent obligations, and provides for a right to de-indexation and a right to data portability.

You may lodge a complaint with the Commission d'accès à l'information du Québec (CAI) — cai.gouv.qc.ca.

A French-language version of this Privacy Policy is available at echo.agylos.eu/privacy-policy for Québec French-speaking users, and now includes a §7.1 mirroring the present section (PIPEDA + Loi 25) so Québec francophone users can access the same regulatory information in French.

7.2. Rights of European Union users

You may lodge a complaint with the supervisory authority of your Member State of residence, place of work or place of the alleged infringement (Art. 77 GDPR), or with the French Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr.

8. How to exercise your rights

Most of the rights above can be exercised directly in the app:

• View and edit your profile data: Profile → Advanced settings → Privacy and data.
• Download your data (right to data portability): Profile → Advanced settings → Privacy and data → "Download my data". The JSON file is generated on demand and delivered through the iOS share sheet.
• Delete your account: Profile → Advanced settings → Privacy and data → "Delete my account".
• Object to product measurement: Profile → Advanced settings → Privacy and data → "Usage analytics" toggle.

For any request not covered by these in-app controls (for example, a full access request or exercising the right to restriction), write to privacy.echo@agylos.eu and mention the email address associated with your Echo account.

Agylos will respond to your request within one month of receipt (Art. 12(3) GDPR). This period may be extended by two further months for particularly complex requests; where this applies, Agylos will inform you within the first month.

Agylos may ask you for reasonable proof of identity (for example, confirmation of the email address associated with your account) before acting on your request, to protect you against fraudulent requests.

9. Cookies, trackers and equivalent technologies

Echo is an iOS mobile application; it does not use HTTP cookies.

It embeds the following technologies:

• Firebase Analytics records seven product measurement events as well as two user properties (country, language) and your internal Firebase identifier (uid). This measurement does not constitute tracking within the meaning of Apple's App Tracking Transparency (ATT) policy: Echo does not request any advertising identifier (IDFA), does not display an ATT prompt, does not share your data with third-party apps or websites, and does not use any third-party advertising network. The NSPrivacyTracking manifest attribute is set to false.
• Firebase Crashlytics collects technical crash reports without any advertising identifier.
• Firebase App Attribution uses Apple's SKAdNetwork level 1 mechanism to attribute, in an aggregated and delayed manner, an install to its originating campaign. This mechanism is aggregated on Apple's side and does not allow any individual matching.

You may object at any time to the Firebase Analytics processing in the Privacy section of your profile (see §7).

10. Future evolutions

Echo may in the future integrate data from external connectors — weather information, geolocation, health data from HealthKit (iOS) or Health Connect (Android) — to enrich its coaching capabilities.

None of these categories of data are collected today. No activation will take place without your prior explicit consent, collected directly in the app at the moment the relevant feature is offered. This Privacy Policy will be updated ahead of any such activation, and you will be notified through the channels described in §11.

11. Changes to this Privacy Policy

Agylos may amend this Privacy Policy, for example to reflect service changes, a change of processor, or a regulatory update.

The "Last updated" date at the top of this document is always accurate. In the event of a material change, Agylos will notify you via an in-app notification and, where appropriate, by email to the address associated with your account.

The current version is published at echo.agylos.eu/privacy-policy-en.