1. Who we are
Echoverse Collective Limited (“we”, “us”) is the data controller for personal data collected through echoversecollective.com. Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Our Companies House number is 17203714. You can reach us at admin@echoversecollective.com.
This policy applies to the public website and to Dispatches signups. The Echoverse Intelligence service has its own AI Use Notice (see AI Disclosure) and will have a supplementary privacy notice before that service goes live.
2. What we collect
- Identity data, name and email when you sign up to Dispatches or register interest in Intelligence. Phone number when you register interest in Intelligence.
- Consent data, the timestamp at which you confirmed you are 16 or over, the timestamp of marketing consent, and the version of these Terms and this Privacy Policy you accepted at signup.
- Audit data, your IP address and browser user-agent at the moment you sign up or submit an Intelligence interest form. Retained for security and abuse prevention.
- Comments, the content of any comment you post, alongside the display name attached to your account.
- Cookie, a single first-party cookie (
evc_pass) used to keep you signed in. See our Cookie Policy.
We do not collect special-category data, location data beyond country-level from your IP, or behavioural tracking. We do not run advertising cookies.
3. Lawful bases for processing
- Consent (UK GDPR Art 6(1)(a)), for sending you Dispatches email and for any optional marketing communications. You can withdraw at any time using the unsubscribe link in any email or by emailing admin@echoversecollective.com.
- Legitimate interests (Art 6(1)(f)), for the access cookie that keeps you signed in, for limited audit logging to prevent abuse, and for publishing comments you submit alongside your display name. We have considered and balanced these interests against your reasonable expectations; you have the right to object under section 8 below.
- Performance of a contract (Art 6(1)(b)), for processing an Intelligence pilot interest registration as a precursor to entering into the service contract should you opt in.
4. How long we keep your data
We retain your name, email, phone (where given), and consent record until you ask us to delete it. We periodically review inactive subscribers (no opens or clicks for 24 months) for deletion.
Audit data (IP and user-agent captured at signup or EOI submission) is retained for 90 days, then deleted or irreversibly anonymised. We retain it longer only where required to investigate a specific abuse incident.
Comments stay published unless you ask for them to be removed or unless we remove them under our moderation rules.
5. Who else sees it (sub-processors)
We use the following data processors, each under written processor terms:
- Supabase Inc., database, file storage, and row-level security. Hosted in the EEA.
- Vercel Inc., hosting and edge delivery for this website.
- Cloudflare Inc., DNS and edge network protection.
- Anthropic PBC, large language model inference for our editorial agents. Reader personal data is not used to train Anthropic’s models.
- Google LLC, image generation and the Google Workspace mailbox used for transactional and editorial mail.
- Hetzner Online GmbH, compute for our editorial pipeline worker. Hosted in the EEA.
- Slack Technologies LLC, internal editorial review workflow. Subscriber data is not sent into Slack.
We do not sell your data, and we do not share it for marketing purposes with any party not listed above. We will update this list if a new processor is engaged.
6. International transfers
Some processors (Anthropic, Google, Slack, Vercel, Cloudflare) are headquartered outside the UK and EEA. Where personal data is transferred to those processors, transfers rely on (a) UK adequacy regulations where applicable, (b) the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or (c) other appropriate safeguards as defined under UK GDPR. Copies of those safeguards are available on request.
7. Cookies
We use one strictly-necessary cookie (evc_pass) to keep you signed in. Any additional cookies (analytics, embedded media, future features) require your explicit consent. See our full Cookie Policy.
8. Your rights
Under UK GDPR you have the right to:
- request a copy of the personal data we hold about you (Art 15);
- have inaccurate or incomplete data corrected (Art 16);
- request deletion of your data (Art 17), subject to legal-hold exceptions;
- request restriction of processing (Art 18);
- data portability, to receive your data in a machine-readable format (Art 20);
- object to processing carried out under legitimate interest (Art 21);
- withdraw consent at any time, with no detriment, where processing is based on consent.
To exercise any of these rights, email admin@echoversecollective.com. We will respond within 30 days. If you are unhappy with our response you can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
9. Children
You must be 16 or over to sign up to the newsletter, post a comment, or otherwise submit personal data to us. You confirm this at signup. We do not knowingly collect personal data from anyone under 16.
10. AI processing
Reader personal data is not used to train any third-party foundation model. For how AI is used in our editorial workflow, see our AI Disclosure.
11. Security
We protect your data with row-level security in our database, TLS in transit, access controls on our internal systems, and minimisation of audit-log retention. No system is perfectly secure; we will tell you and the ICO without undue delay if a breach affecting your personal data occurs.
12. Changes to this policy
We update this page when our practices change. The current version and last- updated date are shown above. Material changes are flagged in the footer for 30 days. If a change affects how we process your existing data we will email you before it takes effect.
13. Contact
Privacy questions, data-subject requests, complaints, and corrections: admin@echoversecollective.com.