Echo 8 Privacy Policy

1. Who We Are and Scope of This Policy

Echo 8 is a business-to-business safety training platform. Our direct customers are organizations (“Client Organizations” or “Clients”) that purchase Echo 8 to train their workforce, contractors, or members. Individuals who complete training sessions through the Mobile App (“Students” or “Trainees”) typically do so at the direction of a Client Organization, such as an employer, job site operator, or certifying body.

Because Echo 8 is offered on a business-to-business basis, Client Organizations are the primary controllers of training data collected about their Students, and Echo 8 acts as a service provider / data processor on their behalf for that data. Client Organizations are responsible for ensuring their own use of the Service complies with applicable laws, including any obligations they owe to their Students or employees (see Section 6, “Shared Responsibility”).

2. Information We Collect

2.1 Mobile App (Students)

The Mobile App is designed to be used without creating a personal account. We do not require Students to register, set a password, or maintain a persistent profile. Instead, for each individual training session, we collect:

• Student name, entered at the start of a training session so results can be attributed to the correct person for certification and record-keeping purposes.
• Quiz and assessment results, including scores, answers submitted, pass/fail status, and completion time.
• Session metadata, such as the date and time the session was started and completed, the training module or course accessed, and the Client Organization the session is associated with.
• Device and technical information generated automatically by the app, such as device type, operating system version, and app version, which we use for troubleshooting and to keep the Service functioning correctly.

We do not collect payment information through the Mobile App. We do not knowingly collect more information than is necessary to record and certify completion of a training session.

2.2 Web Portal (Administrators)

Administrators who manage training programs on behalf of a Client Organization create a Portal account. We collect:

• Account credentials, including name, email address, and password (stored using industry-standard hashing; we never store passwords in plain text).
• Client company information, entered by administrators when setting up or maintaining their organization’s profile, including company name, contact name, contact email, phone number, and billing address.
• Usage data, such as login timestamps, actions taken within the Portal (e.g., creating training modules, reviewing Student results, managing user access), and general analytics about how the Portal is used.

We do not process payments directly within the Mobile App or Portal. Any billing relationship between Echo 8 and a Client Organization is handled through separate invoicing and payment channels outside the app/portal software itself, and any related payment details are not stored within the Echo 8 application database.

3. How We Use Information

We use the information described above to:

• Operate and provide the Service, including recording training session results and generating completion certificates or records.
• Allow Client Organization administrators to view, manage, and export training records for their own Students.
• Maintain account security and authenticate Portal administrators.
• Communicate with administrators about their account, service updates, or support requests.
• Monitor, maintain, and improve the reliability, security, and performance of the Service.
• Comply with legal obligations and enforce our agreements.

We do not sell personal information. We do not use Student names or quiz results for advertising, and we do not build advertising profiles from data collected through the Service.

4. Where Data Is Stored

Echo 8 stores application data, including Student session data, quiz results, and administrator account information, using Supabase, a hosted database platform built on PostgreSQL. Our production data is hosted in United States-based Supabase infrastructure. Data is encrypted in transit (TLS) and at rest, consistent with Supabase’s standard infrastructure security practices.

Because Student sessions in the Mobile App are not tied to a persistent user account, Student data is retained as a record associated with the relevant Client Organization and training session, not as an ongoing personal profile that a Student can log into.

5. Data Retention

• Student session data (name, quiz results, completion time) is retained for as long as reasonably necessary to serve as a training/certification record, consistent with the Client Organization’s record-keeping needs and applicable regulatory or industry requirements (e.g., safety certification recordkeeping). Client Organizations may request deletion of specific Student records, subject to any legal retention obligations.
• Administrator account data is retained for as long as the Portal account is active, and for a reasonable period afterward to support account recovery, dispute resolution, and legal compliance.
• Client company contact and billing address information is retained for as long as the Client relationship is active, and thereafter as needed for legitimate business, accounting, or legal purposes.

6. Shared Responsibility Between Echo 8 and Client Organizations

Echo 8 provides the technical platform. Client Organizations control what training content they deploy, which Students they direct to use the Mobile App, and how they use Student results (e.g., for employment, certification, or compliance decisions). As is typical for a B2B SaaS provider:

• Echo 8 is responsible for securing the platform and infrastructure, storing data as described in this policy, and providing Client Organizations with reasonable tools to access and manage the data collected about their Students.
• Client Organizations are responsible for their own organizational-level legal compliance, including obtaining any consents or providing any notices required under laws applicable to their workforce or jurisdiction (such as employee privacy notices, works council requirements, or sector-specific regulations), and for determining an appropriate lawful basis for collecting Student names and results through the Service.

If you are a Student and have questions about how your training results are used, please contact the organization that directed you to complete the training, as they are best positioned to address organization-specific policies.

7. Information Sharing and Disclosure

We do not sell personal information to third parties. We may share information in the following limited circumstances:

• With the relevant Client Organization: Student training data collected through the Mobile App is made available to the Client Organization that administers the associated training program.
• With service providers: We use trusted infrastructure providers (such as Supabase for database hosting) to operate the Service. These providers process data only on our behalf and under contractual confidentiality and security obligations.
• For legal reasons: We may disclose information if required to do so by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, property, or safety of Echo 8, our users, or the public.
• In connection with a business transaction: If Echo 8 is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality protections.

8. Your Choices and Rights

• Administrators may access, update, or correct their Portal account information at any time by logging into the Portal, or by contacting us using the details below. Administrators may request deletion of their account, subject to reasonable retention needs described in Section 5.
• Students do not maintain an account with Echo 8. Requests relating to a specific Student’s training record (access, correction, or deletion) should generally be directed to the Client Organization that administered the training, who can in turn coordinate with Echo 8. Students may also contact us directly, and we will work with the relevant Client Organization to respond.
• Depending on your location, you may have additional rights under applicable privacy laws (such as access, deletion, correction, or portability rights). We will honor valid requests consistent with our obligations and the shared-responsibility framework described in Section 6.

9. Data Security

We use commercially reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction, including encryption in transit and at rest, access controls, and password hashing for administrator accounts. No system is completely secure, however, and we cannot guarantee absolute security.

10. Children's Privacy

The Service is intended for use by working adults completing workplace or industry safety training, and is not directed to children. We do not knowingly collect personal information from children under 13 (or the applicable minimum age in your jurisdiction). If we become aware that we have inadvertently collected such information, we will take steps to delete it.

11. International Users

Our infrastructure is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your home jurisdiction. By using the Service, you consent to this transfer and processing, to the extent permitted by applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated policy with a revised “Last Updated” date. Material changes will be communicated to Portal administrators via email or an in-Portal notice where appropriate.

13. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or our data practices, please contact us at:

Echo 8
Email: privacy@junzitechsolutions.com

Client Organization administrators with questions about their organization’s specific compliance obligations should also consult their own legal counsel, as Echo 8 cannot provide legal advice regarding a Client’s obligations to its own workforce or members.