1. Who we are
"Echo" is a civic-tech platform that helps university students raise issues, rally support, and bring institutional matters to the attention of their school's leadership. Echo is operated by its founding team ("Echo", "we", "us"). This policy explains how we handle personal information through our public website (echo-ng.com) and the Echo platform.
We handle personal information in line with applicable data-protection requirements, including the Nigeria Data Protection Act 2023 ("NDPA"), and we describe our practices honestly in this policy rather than making broader claims.
2. Information we collect
When you join the student waitlist
If you submit the waitlist form, we collect what you enter: your full name, email address, and institution. You may also optionally provide the name and email of a leader you'd like to recommend, and email addresses of friends you want to invite. We use these only for the purposes described below — for example, to notify a recommended leader that students have suggested them, or to send the invitation you asked us to send.
When your institution requests a demo
If you submit the institutional interest form, we collect your full name, role, institution, email address, and optionally your phone number, your institution's approximate student population, and any message you include. We use this to respond to your request and discuss a possible pilot.
When an institution accepts the Founding Partner Pilot
Institutions that join the Founding Partner Pilot accept an agreement electronically. For each acceptance we keep a record containing the representative's name, role, and institutional email, the institution's name, the acknowledgements confirmed, the typed signature, the date and time of acceptance, and a snapshot of the exact agreement text accepted. We also store a truncated browser user-agent string with the acceptance as audit metadata. Acceptance links are single-use, expire after a limited period, and are stored only in hashed form on our servers.
When you use the Echo platform
When the Echo platform is made available at your institution and you create an account, we process the information needed to operate your account and the service — typically including your name, institutional email address, authentication credentials managed by our sign-in system, and any profile details you add. When you participate, we process the content you submit (such as issues ("Pings"), proposals ("Waves"), comments, and media you upload), engagement activity (such as support actions ("Surges") and notifications), status and moderation records, and institutional responses.
Technical information
We keep our data collection deliberately light. Today this includes: aggregated website usage analytics (such as page visits and general device/browser categories) used to understand how the site performs, and the browser user-agent string recorded with Founding Partner acceptances as described above. Like most online services, our infrastructure providers may also process standard technical logs needed to operate and secure the service.
We do not sell your personal information, and we do not use it for behavioural advertising.
3. Anonymous participation
Echo is built so students can speak up. Where the feature allows it, you can publish content — such as a Ping — without your name being shown publicly to other users.
It's important to understand what this means and what it doesn't:
- Anonymous means hidden from other users, not unrecorded. Echo keeps the account record behind the content so the service can function, prevent abuse, and keep institutions accountable. Posting anonymously or pseudonymously does not mean Echo has no knowledge of which account submitted it.
- Institutional administrators can review content raised within their institution's space, including flagged content, as part of their role. What administrators see about authorship depends on how Echo is configured for that institution; where author details are hidden, they are hidden in the same way they are for other users.
- No online platform can promise perfect anonymity. If identifying details are included in the text or media of a post itself, other readers may see them.
4. How we use information, and on what basis
We use personal information to:
- operate the waitlist and send the confirmations and updates you asked for;
- pass along leader recommendations and friend invitations you initiate;
- respond to institutional demo requests and administer Founding Partner pilots, including keeping acceptance records;
- create and manage accounts, verify institutional membership, and provide access to your institution's space;
- provide the core service: Pings, Waves, comments, Surges, notifications, official responses, and status tracking;
- moderate content, prevent abuse, and keep the platform secure;
- understand overall usage so we can improve Echo; and
- comply with legal obligations.
Under the NDPA, processing must have a lawful basis. In practice, Echo relies on: your consent (for example, when you choose to submit a waitlist form or invite friends — you can withdraw it); the need to perform our agreement with you or take steps you requested (operating accounts and the core service); legitimate interests operated fairly and balanced against your rights (security, abuse prevention, and product improvement); and compliance with legal obligations. We have deliberately avoided overstating any single basis, and the final mapping should be confirmed by qualified Nigerian counsel.
5. Who can see what
Echo is organized around institutional spaces: users belong to their institution's community, and content generally stays within that community. Submitting content does not make it private in the general sense — what is visible depends on the nature of the content and your institution's configuration:
- You can see your own content, including anything you posted anonymously.
- Other students in your institution's space can see Pings, Waves, comments, Surges, and responses — with author details hidden where you posted anonymously.
- Institutional representatives can review activity in their institution's space and post official responses.
- Echo can access stored data as needed to operate, secure, and support the service, and to handle reports and moderation.
6. Service providers
We rely on a small number of third-party providers to run Echo. They process personal information on our behalf to deliver the service:
- Supabase — hosts Echo's databases and server-side functions, including the waitlist, demo-request, and pilot-acceptance records described above;
- Resend — delivers transactional email on our behalf (confirmations, leader recommendations, invitations, and pilot-acceptance links);
- Vercel — hosts this website and provides the site's usage analytics and performance measurements.
We share personal information only as needed to operate the service, with institutions in connection with their own communities' activity, when required by law, or with your direction. We do not sell personal information.
7. International transfers
Some service providers used to operate Echo may process information in jurisdictions outside Nigeria. Where applicable, Echo will take appropriate steps required by applicable data-protection law in connection with such processing.
8. How long we keep information
We keep personal information only for as long as reasonably necessary for the purposes described in this policy, subject to legal, contractual, and operational needs. In practice:
- Waitlist and invitation information is kept while the waitlist remains relevant to you, or until you ask us to remove it;
- Demo-request information is kept while we are in contact with your institution about a possible engagement;
- Founding Partner acceptance records are retained as durable legal and audit records of the agreement accepted, including its text and version;
- Platform content and account information is kept while your account and your institution's community are active.
Echo has not yet adopted a formal, category-by-category retention schedule; establishing one is a planned improvement. You can ask us to delete your information as described below, subject to any legal or audit obligations that require us to keep certain records.
9. Your rights
The NDPA gives you rights over your personal information, including the right:
- to be informed about how your data is processed (this policy);
- to access the personal information we hold about you;
- to correct inaccurate or incomplete information;
- to object to, or ask us to restrict, certain processing;
- to receive your data in a portable format where applicable;
- to erasure — to ask us to delete your personal information;
- to withdraw consent where consent is the basis for processing;
- and to be informed about, and not be subject to, significant decisions made solely by automated means.
These rights are subject to applicable legal limitations and to the rights and freedoms of other people — for example, we may not delete records we are required to keep for legal or audit purposes, and removing your account does not necessarily erase every trace of interactions that other parts of a community have engaged with.
Making a request
To exercise any of these rights, email hello@mail.echo-ng.com. To protect your information, we may need enough details to verify that the request really comes from you before we act on it. We aim to respond within a reasonable timeframe and will explain if (and why) we cannot fulfil part of a request.
Complaints
You can complain to us first at hello@mail.echo-ng.com — we take complaints seriously. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), the regulator established under the NDPA.
10. Younger users
Echo is designed for university students, and our institutional onboarding is intended to keep communities limited to verified members of each institution. Echo does not currently perform age verification. If you believe a younger person's personal information has been provided to us, please contact us so we can review and address it appropriately, taking into account the additional protections applicable to children's data under Nigerian law.
11. Security
We apply technical and organizational measures intended to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure — including restricting who and what can read stored records, limiting sensitive flows to controlled server-side processes, hashing single-use acceptance links, and working with established infrastructure providers. No security measures are perfect, and no method of transmission over the internet is completely secure; we cannot guarantee absolute security, but we take safeguarding your information seriously and will act promptly if issues arise.
12. Automated decision-making
Echo does not use automated systems to make consequential institutional decisions on behalf of leaders. Decisions about issues, proposals, and institutional responses rest with people — students, institutional representatives, and accountable officers.
14. Changes to this policy
We may update this policy as Echo evolves. The "last updated" date at the top shows the current version. If a change is material, we will take reasonable steps to bring it to your attention — for example through the website or by email where appropriate.
15. Contact and complaints
Questions or requests?
Email us at hello@mail.echo-ng.com.
You may also escalate complaints to the Nigeria Data Protection Commission (NDPC).