Privacy Policy

1. Who We Are

EKKO Ltd, a company registered in England and Wales (Company No. 16982307), provides EKKO Review Flow by EKKO Ltd ("the Service"). EKKO Ltd is the data controller for personal data processed about visitors to this site and about account holders of the Service. For customer data that account holders upload in order to send review requests, EKKO Ltd acts as a data processor on the account holder's behalf.

Registered office: 124 City Road, London EC1V 2NX, United Kingdom. Contact: info@ekkoltd.co.uk · 0161 549 4514.

2. Data We Collect

• Account data: name, email, business name, and password hash.
• Customer data: contact details (name, email, phone) that account holders upload in order to send review requests on their behalf.
• Usage and device data: log data, IP address, device identifiers, and basic analytics needed to operate the Service securely.
• Support and communications: messages you send us and our replies.
• Billing data: handled by our Merchant of Record, Paddle. We receive limited transaction metadata (e.g. subscription status, last 4 digits of card) but not full payment card details.

3. How and Why We Use Data

We use personal data to create and operate accounts, provide and improve the Service, send review-request messages on behalf of account holders, handle billing and support, protect against fraud and abuse, and comply with legal obligations.

4. Legal Bases

We rely on the following legal bases under UK GDPR:

• Contract — to provide the Service to account holders.
• Legitimate interests — to secure, maintain, and improve the Service, and to prevent abuse.
• Consent — where required by law (e.g. certain cookies and marketing).
• Legal obligation — to comply with applicable laws and lawful requests.

5. Sharing

We share personal data with the following categories of recipients:

• Merchant of Record (Paddle): for sale of the Service, subscription management, payments, invoicing, and tax compliance.
• Infrastructure and email providers acting as our processors under contract, including hosting, database, and transactional email delivery.
• Professional advisers (legal, accounting) where reasonably required.
• Authorities where required by law or to protect rights, property, or safety.

We do not sell personal data.

6. Google Business Profile Integration

If an account holder chooses to connect their Google Business Profile, EKKO accesses Google data only with the explicit authorisation of the profile owner, given through Google's standard OAuth consent screen. The owner can revoke this access at any time from their EKKO Settings page or from their Google Account security settings.

When connected, EKKO:

• Reads the list of business locations on the connected account, and reviews (reviewer display name, star rating, comment, timestamp) left on those locations.
• Writes only review replies, on the authenticated owner's behalf, and only when auto-reply is enabled or a reply is explicitly approved in EKKO.
• Does not modify business profile details (name, address, phone, hours, photos, categories, posts, or any other profile content). EKKO has no ability to publish posts, change profile information, or delete reviews.
• Does not share Google review data with third parties, sell it, or use it to train generic AI models. Review text is sent to our AI provider purely to generate a one-off reply for that review.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Retention

We retain personal data for as long as your account is active and for a reasonable period afterwards to meet legal, accounting, or reporting requirements. Customer data uploaded by account holders is retained while the account is active and deleted on request or within a reasonable period after account closure.

8. Your Rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or port your personal data, to object to certain processing, and to withdraw consent. To exercise these rights, contact us at info@ekkoltd.co.uk. We aim to respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

9. International Transfers

Some of our processors may transfer personal data outside the UK or EEA. Where they do, we use appropriate safeguards such as the UK International Data Transfer Agreement, Standard Contractual Clauses, or adequacy decisions.

10. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, and audit logging. No service can be guaranteed completely secure; please use a strong password and keep it private.

11. Cookies

We use essential cookies required for authentication and security, and limited analytics to understand how the Service is used. You can manage cookie preferences in your browser.

12. Changes

We may update this policy from time to time. Material changes will be communicated by email or in-app notice.

13. Contact

EKKO Ltd, 124 City Road, London EC1V 2NX, United Kingdom.
Email: info@ekkoltd.co.uk
Phone: 0161 549 4514
WhatsApp: +44 7822 010172