Privacy Policy

Groupe Echo Inc. ("Groupe Echo", "we", "us") operates Echo Support, customer support software with an AI assistant. This policy explains what personal information we collect, why, who we share it with, where it is processed, how long we keep it and how to exercise your rights. It is based on Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and on the federal law (PIPEDA).

It covers four groups of people: visitors to the echo-group.ca website; our customers and their users, who have an Echo Support account; people who write to one of our customers through the widget installed on that customer's website; and people whose contact details our customers import into Echo Support.

The person in charge of the protection of personal information at Groupe Echo Inc. is Isaac Poirier Bernard, president. You can reach him at vie-privee@echo-group.ca, or by mail at 2390, rue du Cardinal, Terrebonne (Quebec) J7M 0B6.

If you have an account

• Name, email address and organization name
• If you choose "Sign in with Google": the information Google sends us, namely your name, email address and profile picture
• Subscription and billing information (plan, payments); card numbers are processed by Stripe and we never receive them
• Login logs (date and time, IP address)
• The page of the echo-group.ca website your sign-up came from, if you followed one of its sign-up links: it travels in the link's address, with no cookie, then in the link of the email confirming your address. It is noted on your account until you create your first organization, for 30 days at most, then stays attached to that organization

If you write to one of our customers through its widget

• The content of your messages and of the answers you receive
• Your name and email address, requested before you write, and the information you give in the conversation
• Technical information sent by your browser: browser type and operating system, languages, time zone, screen and window size, whether cookies are enabled, the address of the page where you opened the widget and the referring page. It is shown to the business you are writing to.

Content added by our customers

• The documents in their knowledge base
• The contact details they import into Echo Support

If the business you are writing to has connected its Shopify store

• When you ask where an order is, or ask to cancel it, change its address or return it: the order number and email address you give in the conversation. If they point to the same order, Echo reads from Shopify, at that moment, its date, its payment status and fulfillment status, the carrier, the tracking number and link, the delivery dates, and the title and quantity of the items, to answer you or to forward your request to the business's team. This information is sent to the language model, like the rest of the conversation (section 4). Never your address, phone number, name, payment method or the amounts.
• A log of these lookups: the order looked up and a fingerprint of the email address, never the address itself.
• The store's published products, policies and pages, which are used to answer your questions and are not about you.

If you visit the echo-group.ca website

• Your IP address, the page requested and the referring page your browser indicates, the date and time, and the identification of your browser, recorded in the technical logs of our server, which are used to keep the service secure and to diagnose errors
• If you come to the website through an address that carries a Google ad click identifier, and only then: that is the case after a click on one of our ads, or when following a link copied from such an address. The Google Ads tag then sends Google the identifier of that click, your IP address, the address of the website pages you view, where applicable your click on a sign-up button, and the identifiers of its cookies: those it sets on the website and, if your browser sends them, those Google has already set on its own domains, which let it link the visit to what it already knows. It sets cookies on the website (sections 4 and 8). It never loads for other visitors, nor if your browser sends the Global Privacy Control signal, nor after a refusal: see our Ads and cookies page

About your organization

• Your organization's industry, if you provide it
• The domain name of the websites where your organization's widget is loaded (for example shop.example.ca), as reported by the visitor's browser, without the address of the pages or any information about their visitors

We use this information only to:

• Provide and operate Echo Support
• Generate the AI assistant's answers from the customer's knowledge base
• Manage accounts, subscriptions and billing, and communicate with our customers about them
• Keep the service secure, prevent abuse and fix errors
• Meet our legal obligations
• Know which pages of the echo-group.ca website lead to sign-ups
• Measure how well our Google ads work: know whether a click on one of them was followed by a click on a sign-up button of the website (Google Ads tag, sections 4 and 8)

We never sell personal information. We run no advertising targeted on your information: our ads show according to the words searched on Google and the region of the search, and our tag refuses ad personalization.

The industry and the widget domain names are also used to:

• Check where a customer's widget is installed, to help troubleshoot it
• Produce internal, aggregated statistics on the use of Echo Support, in particular by industry, that identify no one

We share information only with the providers named here. The list separates two scopes: the Echo Support service (the dashboard, the widget, conversations and the knowledge base) and the echo-group.ca website.

The Echo Support service

The providers the service requires:

• OVH Hosting Inc. (Beauharnois, Quebec, Canada): hosting of the application, database, files and email.
• OpenRouter, Inc. (United States): receives the content of every conversation handled by the AI assistant, along with knowledge base excerpts; PDF documents, images and web pages added to the knowledge base, in full, to extract their text; on paid plans, draft replies an agent asks to reword or asks suggestions for; if you run the frequent-questions analysis, the visitor messages of up to 100 conversations, 10 per conversation; the help articles you ask to translate; and, each month, the tags of conversations handed over to a human, to identify recurring topics. It routes them to the provider that runs the DeepSeek V4 Flash language model. Each request allows OpenRouter to send it to only two providers: DeepInfra (headquartered in the United States), first, which processes it in one of its data centres in the United States or Canada, OpenRouter not stating which; failing that, Microsoft Azure, in its United States region. Each request also requires a provider that does not retain requests and does not use them to train any model, according to the data policies OpenRouter publishes for them. If neither is available, the request fails rather than being sent to another provider.
• Cohere Inc. (Canada): computation of the embeddings that power knowledge base search. Cohere receives the text of knowledge base documents, the assistant's search queries and a short excerpt of resolved conversations. This processing may take place outside Canada.
• Stripe (United States): payment processing and subscription billing.
• Google LLC (United States): "Sign in with Google", if you choose it.
• Functional Software, Inc. (Sentry): dashboard error reports and recording of a share of sessions, hosted in the European Union. In these recordings, text and input fields are masked; Sentry receives page structure, technical details about errors and your IP address.
• GitHub, Inc. (United States): storage of a daily backup copy of the database, files and email, encrypted before it is sent. The decryption key stays with Groupe Echo Inc.: GitHub cannot read its content.
• Authorities, where required by law.

The echo-group.ca website

• OVH Hosting Inc. (Beauharnois, Quebec, Canada): hosting of the website, on the same server as the service.
• Google LLC (United States): the Google Ads tag, which measures how well our ads work. For a visitor who arrived through an address carrying an ad click identifier (after a click on one of our ads, or through a link copied from such an address) only, and never with the Global Privacy Control signal or after a refusal, Google receives the identifier of the ad click, the IP address, the address of the pages viewed on the website, the click on a sign-up button, and the identifiers of the tag's cookies on the website and, if the browser sends them, of those it has already set on its own domains, which let it link the visit to what it already knows. Google processes this information under its own rules, and may also use it for its own purposes, for example to measure ad effectiveness or to fight fraud. The tag never loads in the service. The details, and the button to refuse it: Ads and cookies.

Processing outside Canada. The service: the application and database are hosted in Quebec. But every message handled by the AI assistant goes to the United States (OpenRouter), then to the provider that runs the model: DeepInfra, in the United States or Canada, or, failing that, Microsoft Azure, in the United States. Cohere's computations, payments, Google sign-in and error reports may also be processed outside Canada. This information is then subject to the laws of the countries concerned, and each provider applies its own retention rules.

The echo-group.ca website: it is hosted in Quebec as well. But for a visitor who came through one of our ads, the Google Ads tag sends the information described above to Google LLC, in the United States. Google states that it maintains servers in different countries: this information may be processed outside Quebec and Canada, and is then subject to the laws of those countries.

This information follows Google's retention rules: Google states that it removes part of the IP address from its advertising logs after 9 months, and cookie information after 18 months (details and sources: Ads and cookies).

When a company uses Echo Support, its visitors' conversations, the contacts it imports and the documents it adds are under its responsibility: we process them on its behalf, only to provide the service to it, under the commitments set out in our Terms of Service.

If you wrote to a company through its widget, please address your requests to that company first. You may also write to us at vie-privee@echo-group.ca: we will help it respond.

When a business has connected its Shopify store, Shopify may forward to us, on its behalf, its customers' requests (access to their information, erasure) and the request to erase the store: we handle them within 30 days. Our commitments to the business for this information are set out in the Shopify data processing agreement.

Access by our support team. The Groupe Echo people designated for support may access a customer company's dashboard at any time, under section 11 of our Terms of Service: to provide the service and help it, to keep the service secure or to comply with the law. They then see the conversations and contacts as the company sees them. During the access, the company sees it live in its dashboard, with the pages opened and the changes made; every access is recorded in a log kept for 24 months, which does not copy the content of conversations. We never match one company's information with another's, and we build no profile of the people who write to our customers.

Deleting an organization. When we delete a company's organization, at its request or for a serious breach of our Terms, it stays in a trash for 30 days, closed, then all of its data is destroyed, conversations, contacts and files included. Only the billing information required by tax law and the log of support accesses remain.

One automatic deletion is in place: files attached to a conversation are deleted as soon as the conversation is marked resolved. Automatic deletion of conversations is in place too, since September 28, 2026: every night, it deletes each conversation (including messages and attachments) whose last message is older than the history period of the business's plan (7 days, 1 month, 3 months or 1 year); after moving to a smaller plan, the previous period still applies for 30 days. Everything else is kept differently: your information, and the information our customers add to Echo Support, is kept as long as the account exists, and beyond that until deletion is requested at vie-privee@echo-group.ca. Deleting an organization from the dashboard does not delete its conversations, contacts or documents: you need to write to us.

Shopify stores. Information read from Shopify stays in the conversation where it was used and follows its retention; the lookup log goes with it, and at the latest 400 days after the lookup. A store's policies and pages are kept as long as it is connected. When the business disconnects its store or uninstalls the Echo app, we erase our access immediately, then, within 30 days, the policies and pages, the raw lookup results in conversations, the assistant's internal notes in conversations where an order was looked up, and the lookup log. The answers the assistant wrote stay in the conversations, like the rest of the history.

Billing information is kept as long as tax laws require. Backups are overwritten on their normal cycle: deleted information may remain in them until then.

The industry and the widget domain names are kept as long as the organization exists; a domain where the widget has not been seen for 180 days is forgotten.

Measures in place:

• Encryption in transit (TLS)
• Per-organization data isolation (multi-tenant)
• Role-based access controls (RBAC)
• RS256-signed tokens, rotation and reuse detection
• Rate limiting on public endpoints: caps per organization, per conversation, per visitor session and per API key
• Internal logging of sensitive actions
• Echo staff access to customer accounts restricted to designated people, protected by mandatory two-factor authentication and a list of authorized addresses, recorded in a log and shown live to the customer in their dashboard

The service and the website do not use the same cookies.

The Echo Support service only uses cookies and browser local storage that are essential to it: the dashboard login session, and the chat widget's local storage, limited to making it work. No advertising cookie and no advertising tag in the service.

The echo-group.ca website keeps your language preference in your browser, and loads the Echo Support chat widget, with its local storage. For a visitor who came through a Google ad (section 2), and for that visitor only, it also uses advertising cookies:

• _gcl_au, _gcl_aw and the other cookies whose name starts with _gcl_, set by the Google Ads tag to link an ad click to a sign-up click: 30 days under our setting, not extended at each page view, at most 90 days according to Google;
• echo_pub_annonce, set by us each time you arrive through an ad, which only says that this browser came that way: 30 days.

If you refuse the tag, however you arrived: echo_pub_refus, which our server sets for one year and extends by one year at each page of the website you open, and its copy echo-pub-refus in local storage, with no expiry (some browsers erase it on their own, such as Safari after 7 days without interaction with the website).

The tag never loads for other visitors, never if your browser sends the Global Privacy Control signal, and never after a refusal. It loads without asking for your agreement first: the website shows no consent banner. To refuse it, and for the details of what Google receives, with sources and durations: our Ads and cookies page, linked at the bottom of every page.

Groupe Echo Inc. records every confidentiality incident in a register. When an incident presents a risk of serious injury, we report it to the Commission d'accès à l'information du Québec and notify the affected persons promptly. If the incident affects information a customer entrusted to us, we notify that customer without delay.

At any time you may:

• Access the information we hold about you
• Have corrected inaccurate, incomplete or ambiguous information
• Have deleted your information, in particular when it is outdated or no longer justified
• Withdraw your consent to a use, or ask that the dissemination of information cease
• Obtain a copy of the information you provided to us, in a structured, commonly used technological format; the dashboard does not yet let you export it yourself, so we prepare it on request
• File a complaint with the Commission d'accès à l'information du Québec (CAI) or the Office of the Privacy Commissioner of Canada

All these requests are made in writing to vie-privee@echo-group.ca. We may ask you to confirm your identity, and we reply within 30 days.

This policy is governed by the laws of Quebec and Canada. If you reside in the European Union, you also have the rights provided by the GDPR, which you exercise the same way. Any change to this policy is published on this page, with its update date.