Privacy policy
Last updated 22 October 2026.
Echo's Workshop is run by Echo's Hollow, CVR 46668634, Haragervej 17, 3200 Helsinge, Denmark. This page says what we keep about you and your business, where it goes, how long we keep it and how to have it deleted. We don't show ads, don't use analytics or tracking cookies, and never sell data.
Who is responsible for what
For your login and account, we decide what is kept and why (we are the data controller). For the data about your own customers that you put into the app, your business is the controller and we only keep it for you (we are its processor); the beta terms say how.
Questions or requests: [contact email].
What we keep
| What | What it holds | Why |
|---|---|---|
| Your login | Name, email address, sign-up date, and your login sessions with the device's IP address and browser | To log you in and keep you logged in |
| Your business | Materials and stock, products, purchases, suppliers, orders, invoices, settings | It is what the app does |
| Your customers | Name, email, phone, address and notes you type in, or your webshop sends through the API | Orders, invoices and shipping emails |
| Files | Photos, receipts (images and PDFs), model files, screenshots sent with feedback | To show them back to you; receipts can be read for you |
| Feedback | Your message, the page you were on and an optional screenshot | To improve the app |
| Usage counts | How many receipts were read for a business each month, and what that cost | To keep the beta within its limits |
| Error reports | What went wrong, where in the code and on which page, with email addresses masked and no cookies or form contents | To find and fix bugs |
Your login, your business's data, files and customers are kept to provide the app you signed up for (GDPR article 6(1)(b), a contract). Feedback, usage counts and error reports are kept because we have a legitimate interest in keeping the app working and within budget (article 6(1)(f)); you can object by writing to us.
Where it is kept and who else handles it
| Service | What it gets | Where | Safeguard |
|---|---|---|---|
| Railway (hosting, database and file storage) | Everything above | EU | Kept in Railway's EU region |
| Resend (email) | Your email address and the login and invite emails; for shipping emails, your customer's email address and the message | USA | EU Standard Contractual Clauses and the EU-US Data Privacy Framework (Resend DPA) |
| Anthropic (receipt reading, only when you choose to read a receipt) | The receipt file and the names of your items, to match its lines | USA | Deleted within 30 days and not used to train models (retention, training) |
| Sentry (error reports) | Error reports and log lines, as described above | Germany (EU) | Kept up to 30 days |
| Cloudflare (backups) | A copy of the database every night, so data survives a mistake | EU | Stored in Cloudflare's EU jurisdiction; each copy deleted after 27 days |
How long we keep it
- Your business and its files: until you delete them. Deleting a business (Settings) removes all its data and files at once.
- Your login: until you delete it (Settings). Your name, email address, sessions and feedback go; old changes in businesses you worked in then show "Deleted user".
- Login codes and links: 10 minutes. Sessions: 30 days without use.
- Receipts read by Anthropic: deleted there within 30 days; the reading itself stays with your purchase until you delete it.
- Error reports: up to 30 days in Sentry. Server logs: 7 days at Railway. Backups: a copy of the database every night, each kept 27 days.
- Usage counts: kept after a business is deleted, as numbers only, so the month's totals stay right.
- Feedback: kept if your business is deleted (without its screenshot); deleted with your login.
Your rights
- See and take your data: Settings, Export, "Download everything" gives every table and file in one zip.
- Correct it: edit it in the app.
- Delete it: delete your business or your login in Settings, or write to us.
- Object or ask us to limit what we do with it: write to [contact email]. We answer within a month.
- Complain: to the Danish Data Protection Agency, Datatilsynet.
Cookies and storage in your browser
Only what the app needs to work, so there is no consent banner:
- A login cookie that keeps you logged in.
- A cookie that remembers which of your businesses you are working in.
- Your light or dark theme and your last label-printing choices, kept in your browser.
Changes
If we change what we keep or who handles it, we update this page and tell you in the app before it takes effect.