Privacy Policy

Groupe Echo Inc. ("Groupe Echo", "we", "us") operates Echo Support, customer support software with an AI assistant. This policy explains what personal information we collect, why, who we share it with, where it is processed, how long we keep it and how to exercise your rights. It is based on Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and on the federal law (PIPEDA).

It covers four groups of people: visitors to the echo-group.ca website; our customers and their users, who have an Echo Support account; people who write to one of our customers through the widget installed on that customer's website; and people whose contact details our customers import into Echo Support.

The person in charge of the protection of personal information at Groupe Echo Inc. is Isaac Poirier Bernard, president. You can reach him at vie-privee@echo-group.ca, or by mail at 2390, rue du Cardinal, Terrebonne (Quebec) J7M 0B6.

If you have an account

• Name, email address and organization name
• If you choose "Sign in with Google": the information Google sends us, namely your name, email address and profile picture
• Subscription and billing information (plan, payments); card numbers are processed by Stripe and we never receive them
• Login logs (date and time, IP address)

If you write to one of our customers through its widget

• The content of your messages and of the answers you receive
• Your name and email address, requested before you write, and the information you give in the conversation
• Technical information sent by your browser: browser type and operating system, languages, time zone, screen and window size, whether cookies are enabled, the address of the page where you opened the widget and the referring page. It is shown to the business you are writing to.

Content added by our customers

• The documents in their knowledge base
• The contact details they import into Echo Support

If you visit the echo-group.ca website

• Your IP address, transmitted to Google when fonts are loaded (see section 4)

We use this information only to:

• Provide and operate Echo Support
• Generate the AI assistant's answers from the customer's knowledge base
• Manage accounts, subscriptions and billing, and communicate with our customers about them
• Keep the service secure, prevent abuse and fix errors
• Meet our legal obligations

We never sell personal information and run no targeted advertising.

We share information only with the providers the service requires:

• OVH Hosting Inc. (Beauharnois, Quebec, Canada): hosting of the application, database, files and email.
• OpenRouter, Inc. (United States): receives the content of every conversation handled by the AI assistant, along with knowledge base excerpts; PDF documents, images and web pages added to the knowledge base, in full, to extract their text; on paid plans, draft replies an agent asks to reword or asks suggestions for, with the visitor's name and email; and, each month, the tags of conversations handed over to a human, to identify recurring topics. It routes them to a provider that runs the DeepSeek V4 Flash language model. That provider is chosen by OpenRouter; depending on which one is used, processing may take place in the United States or in another country.
• Cohere Inc. (Canada): computation of the embeddings that power knowledge base search. Cohere receives the text of knowledge base documents, the assistant's search queries and a short excerpt of resolved conversations. This processing may take place outside Canada.
• Stripe (United States): payment processing and subscription billing.
• Google LLC (United States): "Sign in with Google", if you choose it; and font delivery (Google Fonts) on the echo-group.ca website, which transmits your IP address to Google.
• Functional Software, Inc. (Sentry): dashboard error reports and recording of a share of sessions, hosted in the European Union. In these recordings, text and input fields are masked; Sentry receives page structure, technical details about errors and your IP address.
• GitHub, Inc. (United States): storage of a daily backup copy of the database, files and email, encrypted before it is sent. The decryption key stays with Groupe Echo Inc.: GitHub cannot read its content.
• Authorities, where required by law.

Processing outside Canada. The application and database are hosted in Quebec. But every message handled by the AI assistant goes to the United States (OpenRouter), then to the model provider, whose country may vary. Cohere's computations, payments, Google sign-in and error reports may also be processed outside Canada. This information is then subject to the laws of the countries concerned, and each provider applies its own retention rules.

When a company uses Echo Support, its visitors' conversations, the contacts it imports and the documents it adds are under its responsibility: we process them on its behalf, only to provide the service to it, under the commitments set out in our Terms of Service.

If you wrote to a company through its widget, please address your requests to that company first. You may also write to us at vie-privee@echo-group.ca: we will help it respond.

Two automatic deletions are in place: files attached to a conversation are deleted as soon as the conversation is marked resolved; and each conversation (including messages and attachments) is deleted once its last message is older than the history period of the business's plan: 7 days, 1 month, 3 months or 1 year. Otherwise, your information, and the information our customers add to Echo Support, is kept as long as the account exists, and beyond that until deletion is requested at vie-privee@echo-group.ca. Deleting an organization from the dashboard does not delete its conversations, contacts or documents: you need to write to us.

Billing information is kept as long as tax laws require. Backups are overwritten on their normal cycle: deleted information may remain in them until then.

Measures in place:

• Encryption in transit (TLS); session signing keys encrypted at rest (AES-256)
• Per-organization data isolation (multi-tenant)
• Role-based access controls (RBAC)
• RS256-signed tokens, rotation and reuse detection
• Rate limiting on public endpoints: caps per organization, per conversation, per visitor session and per API key
• Internal logging of sensitive actions

We only use cookies and browser local storage that are essential to the service: the dashboard login session, and the language preference the echo-group.ca website keeps in your browser. The website also loads the Echo Support chat widget, which has its own local storage, likewise limited to making it work. No advertising or tracking cookies, and no web analytics on the website.

Groupe Echo Inc. records every confidentiality incident in a register. When an incident presents a risk of serious injury, we report it to the Commission d'accès à l'information du Québec and notify the affected persons promptly. If the incident affects information a customer entrusted to us, we notify that customer without delay.

At any time you may:

• Access the information we hold about you
• Have corrected inaccurate, incomplete or ambiguous information
• Have deleted your information, in particular when it is outdated or no longer justified
• Withdraw your consent to a use, or ask that the dissemination of information cease
• Obtain a copy of the information you provided to us, in a structured, commonly used technological format; the dashboard does not yet let you export it yourself, so we prepare it on request
• File a complaint with the Commission d'accès à l'information du Québec (CAI) or the Office of the Privacy Commissioner of Canada

All these requests are made in writing to vie-privee@echo-group.ca. We may ask you to confirm your identity, and we reply within 30 days.

This policy is governed by the laws of Quebec and Canada. If you reside in the European Union, you also have the rights provided by the GDPR, which you exercise the same way. Any change to this policy is published on this page, with its update date.