1. Who we are
"Echo" is a civic-tech platform that helps university students raise issues, rally support, and bring institutional matters to the attention of their school's leadership. Echo is operated by ECHORA SYSTEMS, a company registered in the Federal Republic of Nigeria (CAC BN 9855532), which is the legal entity that operates the Echo platform and is the operator and contracting party for Echo's website and services ("Echo", "we", "us"). This policy explains how we handle personal information through our public website (echo-ng.com) and the Echo platform.
Two roles are involved, and they depend on where the information comes from. For our own website and our own business records, Echora Systems is responsible for the information and acts as the Data Controller. For student and community information inside a participating institution's Echo space, your institution acts as the Data Controller for that information and Echo acts as the Data Processor, processing it on the institution's behalf and under the institution's documented authority. Wherever this policy says "we", it covers both roles.
We handle personal information in line with applicable data-protection requirements, including the Nigeria Data Protection Act 2023 ("NDPA"), and we describe our practices honestly in this policy rather than making broader claims.
2. Information we collect
When an institution accepts the Founding Institution Agreement
Institutions that join the Founding Institution Program accept an agreement electronically. For each acceptance we keep a record containing the representative's name, role, and institutional email, the institution's name, the acknowledgements confirmed, the typed signature, the date and time of acceptance, and a snapshot of the exact agreement text accepted. We also store a truncated browser user-agent string with the acceptance as audit metadata. Acceptance links are single-use, expire after a limited period, and are stored only in hashed form on our servers.
When you use the Echo platform
When the Echo platform is made available at your institution and you create an account, we process the information needed to operate the service on your institution's behalf. It falls into three groups:
- Identity and academic profile: your email address, first name, last name, display name, department, academic level, and hall of residence;
- Community content: the content you submit, including issues ("Pings"), proposals ("Waves"), comments, support actions ("Surges"), and attached media;
- Security and technical information: your client IP address, user-agent string, authentication and session timestamps, and your encrypted two-factor authentication (TOTP) credentials.
We also process engagement activity and notifications, status and moderation records, and institutional responses so the service can function.
Technical information
For this website, we keep our data collection deliberately light: aggregated website usage analytics (such as page visits and general device/browser categories) used to understand how the site performs, and the browser user-agent string recorded with Founding Institution acceptances as described above. Like most online services, our infrastructure providers may also process standard technical logs needed to operate and secure the service.
On the Echo platform, we record the security and technical information listed above, including IP address, user-agent string, and authentication and session timestamps, to operate and protect the service. Security-relevant events are also written to an audit log. See the Security section below.
We do not sell your personal information, and we do not use it for behavioural advertising.
3. Anonymous participation
Echo is built so students can speak up. Where the feature allows it, you can publish content, such as a Ping, without your name being shown publicly to other users.
It's important to understand what this means and what it doesn't:
- Anonymous means hidden from other users, not unrecorded. Echo keeps the account record behind the content so the service can function, prevent abuse, and keep institutions accountable. Posting anonymously or pseudonymously does not mean Echo has no knowledge of which account submitted it.
- Anonymity is irreversible once published. When you publish anonymously, your public profile is masked and the author of that post is not shown to other users. Neither you nor other users can reverse this afterwards.
- Authorized moderators can trace authorship in severe cases. Platform moderators retain internal tracing capability, used solely for severe community violations such as hate speech, threats of violence, or criminal activity, in accordance with campus safety rules.
- Institutional administrators can review content raised within their institution's space, including flagged content, as part of their role. What administrators see about authorship depends on how Echo is configured for that institution; where author details are hidden from other users, the only route to establishing authorship is the limited internal tracing described above.
- No online platform can promise perfect anonymity. If identifying details are included in the text or media of a post itself, other readers may see them.
4. How we use information, and on what basis
We use personal information to:
- send and process institutional leader recommendations;
- administer Founding Institution pilots, including keeping acceptance records;
- create and manage accounts and authenticate university community members, so that access stays limited to verified members of each institution's community;
- deliver the campus feedback and community engagement platform itself: Pings, Waves, comments, Surges, notifications, official responses, and status tracking;
- provide accountability by keeping a reliable record of the issues raised in a community and the responses they receive;
- prevent harassment and abusive use of Echo, including reviewing reports of severe violations;
- moderate content, secure accounts, and maintain system integrity;
- understand overall usage so we can improve Echo; and
- comply with legal obligations.
Under the NDPA, processing must have a lawful basis. For personal information processed through the Echo platform on an institution's behalf, we rely on two bases:
- Performance of a contract (NDPA Section 25(1)(b)): fulfilling our contractual engagement with your institution and providing you with a safe, authenticated student engagement platform; and
- Legitimate interests (NDPA Section 25(1)(f)): preventing harassment, moderating abusive content, securing accounts, and maintaining system integrity.
For Founding Institution agreement acceptance records, we process the information needed to document and administer the agreement and to meet applicable record-keeping obligations.
5. Who can see what
Echo is organized around institutional spaces: users belong to their institution's community, and content generally stays within that community. Submitting content does not make it private in the general sense. What is visible depends on the nature of the content and your institution's configuration:
- You can see your own content, including anything you posted anonymously.
- Other students in your institution's space can see Pings, Waves, comments, Surges, and responses. Author details remain hidden on posts you made anonymously.
- Institutional representatives can review activity in their institution's space and post official responses.
- Echo can access stored data as needed to operate, secure, and support the service, and to handle reports and moderation.
6. Service providers
We rely on a small number of third-party providers to run Echo. They process personal information on our behalf to deliver the service:
- Neon: hosts the Echo platform's core PostgreSQL database, in Frankfurt, Germany (EU);
- Cloudinary: hosts and delivers the media users attach to platform content, through its content delivery network;
- Resend: delivers transactional email on our behalf, including leader recommendations, invitations, and Founding Institution agreement links;
- Vercel: hosts this website and provides the site's usage analytics and performance measurements.
We share personal information only as needed to operate the service, with institutions in connection with their own communities' activity, when required by law, or with your direction. We do not sell personal information.
7. International transfers
The Echo platform keeps its core data in a well-regulated hosting environment: our core PostgreSQL database is hosted through Neon in Frankfurt, Germany (EU), and media attached to platform content is hosted and delivered through the Cloudinary content delivery network. Some of our other service providers may also process information in jurisdictions outside Nigeria.
Where personal information is transferred outside Nigeria, we put safeguards in place. Transfers of platform data to our EU hosting are covered by European Union Standard Contractual Clauses (SCCs), in line with the cross-border transfer requirements of the NDPA, so that the information continues to receive appropriate protection.
8. How long we keep information
We keep personal information only as long as it is needed for the purposes described in this policy. Our retention behavior is specific rather than open-ended:
- Active profiles are retained for the duration of the student's enrollment or the institution's subscription;
- Soft-deleted content, meaning Pings and Waves rejected or withdrawn from display, is purged automatically after 30 days;
- Read notifications are purged after 90 days, and unread notifications after 180 days;
- Expired demo organizations enter a 7-day grace period and are then purged automatically, including their associated media;
- Founding Institution acceptance records are retained as durable legal and audit records of the agreement accepted, including its text and version.
Deleting your account
When an account is deleted, the account's personal records are hard-deleted from our PostgreSQL database in a cascading delete, media attached to that account is purged from Cloudinary immediately, and an account-deletion audit record is written to our audit log so that the deletion is provable.
Some records are not removed by account deletion. Where the law or our audit obligations require it, we keep durable records such as Founding Institution acceptance records. Content that other people have engaged with may also leave traces, such as replies on a post that is no longer attributed to you. As section 3 explains, anonymity on a post you published anonymously stays irreversible even after your account is deleted.
Deleting content
When content is deleted, the associated CDN asset is deleted and the comments and Surges attached to it are removed with it in a cascading delete. If that content was published anonymously, it stays anonymous. Deletion does not change that.
9. Your rights
The NDPA gives you rights over your personal information, including the right:
- to be informed about how your data is processed (this policy);
- to access the personal information we hold about you;
- to correct inaccurate or incomplete information;
- to object to, or ask us to restrict, certain processing;
- to receive your data in a portable format where applicable;
- to erasure, meaning you can ask us to delete your personal information;
- to withdraw consent where consent is the basis for processing;
- and to be informed about, and not be subject to, significant decisions made solely by automated means.
These rights are subject to applicable legal limitations and to the rights and freedoms of other people. For example, we may not delete records we are required to keep for legal or audit purposes, and removing your account does not necessarily erase every trace of interactions that other parts of a community have engaged with.
Tools you can use yourself
Some of these rights you can action immediately, without asking us:
- Access and portability: from Settings > Export My Data you can download a machine-readable JSON export of your profile and content. The export is generated on our servers and does not include your password or sign-in secrets;
- Erasure: from Settings > Delete Account you can permanently delete your account and the media attached to it (section 8 explains exactly what happens on deletion, and what we must keep);
- Rectification: you can correct your own details at any time, including your display name and your preferences, directly in the app.
Making a request
To exercise any of these rights, email hello@mail.echo-ng.com. To protect your information, we may need enough details to verify that the request really comes from you before we act on it. We aim to respond within a reasonable timeframe and will explain if (and why) we cannot fulfil part of a request.
Complaints
You can complain to us first at hello@mail.echo-ng.com. We take complaints seriously. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), the regulator established under the NDPA.
10. Younger users
Echo is designed for university students, and our institutional onboarding is intended to keep communities limited to verified members of each institution. Echo does not currently perform age verification. If you believe a younger person's personal information has been provided to us, please contact us so we can review and address it appropriately, taking into account the additional protections applicable to children's data under Nigerian law.
11. Security
We apply technical and organizational measures intended to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. These include restricting who and what can read stored records, limiting sensitive flows to controlled server-side processes, hashing single-use acceptance links, and working with established infrastructure providers. No security measures are perfect, and no method of transmission over the internet is completely secure. We cannot guarantee absolute security, but we take safeguarding your information seriously and will act promptly if issues arise.
Two-factor authentication credentials are stored encrypted, and the platform keeps a persistent audit log, separate from user profile data, that records security-relevant events such as sign-in attempts, account and content deletions, suspensions, moderation actions, and data exports. Where a breach affects personal information that an institution controls, we notify that institution and meet the notification obligations that apply to us under the NDPA.
12. Automated decision-making
Echo does not use automated systems to make consequential institutional decisions on behalf of leaders. Decisions about issues, proposals, and institutional responses rest with people: students, institutional representatives, and accountable officers.
14. Changes to this policy
We may update this policy as Echo evolves. The "last updated" date at the top shows the current version. If a change is material, we will take reasonable steps to bring it to your attention, for example through the website or by email where appropriate.
15. Contact and complaints
Questions or requests?
Email us at hello@mail.echo-ng.com.
You may also escalate complaints to the Nigeria Data Protection Commission (NDPC).