Local evidence.
Plain privacy.

1. Who is responsible

EchoCert is operated by Paul McCombs trading as EchoCert in the United Kingdom. For privacy questions or requests, email contactechocert@gmail.com.

2. Information processed by EchoCert Mobile

The app may process the following information locally on your device so that it can perform the function you request:

• photos and videos you capture in the app;
• files and JSON receipts you select;
• file names, file sizes, MIME types and SHA-256 fingerprints;
• optional case references and notes you enter;
• device date, time and timezone offset used in receipts and verification logs; and
• the Android folder location you select for the EchoCert workspace.

This information is processed on-device. EchoCert does not receive it from the app.

3. Permissions

EchoCert Mobile does not request precise location, contacts, phone records or an advertising identifier.

4. Storage, retention and deletion

Captured evidence, receipts and verification logs remain in the Android folder you choose until you delete them. The app stores the selected workspace location in its private app storage so it can reopen the same folder. Temporary staging and verification copies are deleted after the final saved-file check; Android may retain operating-system backups or transient storage outside EchoCert's direct control.

You can delete evidence and receipts through Android's file manager. Uninstalling the app removes its private settings but may not remove files you saved in a public folder.

5. Sharing and transfers

The app does not automatically share evidence, receipts or hashes. If you deliberately use the Android share sheet, file picker, email app, cloud-storage app or another service, that provider processes the information under its own terms. Review the destination before sharing sensitive material.

6. Website enquiries, professional audits and payments

If you email EchoCert, we receive the address, message and any information you choose to include. We use it to answer the enquiry, assess suitability, agree a scope, deliver an agreed service and maintain necessary business records. Do not send evidence, credentials, personal data or production records in an initial enquiry.

The founding AI Evidence Audit accepts only the non-sensitive material expressly approved in the written scope. EchoCert agrees a case-specific transfer route before receiving files. Evidence is retained for delivery and the correction period, then scheduled for deletion 30 days after the later of delivery or resolution of an active correction, complaint, chargeback or legal hold. A deletion record is retained without retaining the deleted evidence.

When EchoCert sends a Stripe payment link after scope approval, Stripe collects and processes payment and transaction information. EchoCert does not receive your full card number. See Stripe's privacy policy. The website does not use advertising or analytics cookies; its hosting infrastructure may process ordinary request and security data such as IP address, browser details and timestamps to deliver and protect the site.

7. International enquiries and transfers

EchoCert is based in the United Kingdom. If you contact EchoCert from another country, your enquiry and agreed business records will be processed in the UK and may also be processed by the communication, hosting, payment or transfer providers you choose or that are identified in the written scope. EchoCert will not accept case evidence until the transfer route and any required safeguards are agreed. Relevant providers apply their own privacy terms.

8. Why website information is used

Where UK data-protection law applies, the usual lawful bases are steps requested before a contract and performance of an agreed contract; legitimate interests in responding to genuine business enquiries and securing the service; and legal obligations for records that must be retained. EchoCert does not sell personal information or use enquiry data for behavioural advertising.

9. Retention of enquiries and business records

Unsuccessful enquiries are kept only as long as reasonably needed to respond, manage follow-up and protect against misuse, then deleted or anonymised. Contract, invoice, transaction, complaint and deletion records may be retained for the period required by tax, accounting, dispute-resolution or legal obligations. You may ask what information is held about you or request correction or deletion, subject to lawful retention duties.

10. Children

EchoCert Mobile and the professional pilot are not directed to children. A parent, guardian or responsible organisation should supervise any use involving a child and make sure there is a lawful reason to capture or retain the material.

11. Your rights and complaints

Depending on the circumstances, you may have rights to access, correct, erase or restrict use of personal information, object to certain processing, or receive portable data. Email contactechocert@gmail.com to make a request. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or, where applicable, your local data-protection authority.

12. Security and changes

No system is risk-free. Keep your Android device locked, preserve trusted copies of important receipts and avoid using a single phone as the only evidence store. Material changes to this policy will be published on this page with a new effective date.