Privacy Policy

1. Who We Are

Escalera Labs S.L. ("Echo", "we", "us", "our") is the data controller responsible for the processing of your personal data. We operate the voicechanger.live website, the Echo Live desktop application (Windows & macOS), and the AI Voice Changer Effects: Echo mobile application (iOS & Android) (collectively, "Echo Products").

This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your personal data. It applies to all Echo Products, including the desktop application, mobile application, browser-based tools, and our website.

The most important thing to know: Echo processes voice audio on your device. Echo Lite supplies processed audio to the calling website you connect, which sends it to the people in your call under its own privacy policy. Echo does not receive microphone audio or soundboard recordings through usage reporting.

2. Information We Collect

2.1 Information You Provide

• Account Information: When you register, we collect your email address and display name. If you sign in via Google OAuth, we receive your name, email address, and profile picture from Google. We do not receive or store your Google password.
• Waitlist Information: If you join our Alpha waitlist, we collect your email address and the source (which page you signed up from).
• Support Communications: If you contact us for support, we collect the content of your messages and any information you provide to help resolve your issue.

2.2 Information Collected Automatically

• Website Analytics: Google Analytics and PostHog help us understand visits, sign-ups and app downloads. We ask for permission before starting optional analytics where required. Where applicable rules permit, analytics may be on by default. You can turn them off through Privacy preferences. PostHog uses a random analytics identifier and can connect website and desktop activity after sign-in through a separate account identifier. Analytics events do not include your name, email address, typed text or audio.
• Optional Website Diagnostics: If you separately allow diagnostics, we may collect additional timing signals and masked recordings of the public download page during temporary investigations. Recordings exclude forms, account and payment pages, typed text, audio, console logs and network bodies. You can withdraw this choice through Analytics preferences.
• Desktop App Crash Reports: The Echo desktop app collects anonymized crash reports and performance diagnostics (error type, stack trace, OS version, GPU model) via Sentry to help us fix bugs. This data does not include any audio, voice recordings, or personally identifiable information.
• Desktop App Usage Telemetry: The Echo desktop app collects usage events, setup outcomes and bounded failure categories to help us improve the product. Current versions use a random installation identifier and a separate analytics account identifier after sign-in, allowing us to understand the journey from the website into the app. These identifiers are pseudonymous, not anonymous. Usage telemetry excludes audio, typed text, names and email addresses. You can disable all usage telemetry at any time in Settings → About → Privacy.
• Mobile App Analytics: The Echo mobile app uses Firebase Analytics and RevenueCat to collect anonymous usage metrics (such as subscription status, active conversion paths, and crash/error reports) to help us troubleshoot errors and improve runtime stability. Device data collected may include device type, operating system version, and GPU/CPU configuration to optimize on-device model execution.
• Billing Information: In-app purchases and subscriptions on mobile are processed securely by Apple App Store and Google Play Store. Subscription state validation is handled by RevenueCat. We do not directly collect or store your payment card details.

2.3 Information We Do NOT Collect

• Voice audio: Echo processes all audio locally on your device. Your voice is never transmitted to our servers. We do not listen to, record, store, or analyze your voice data.
• Microphone access (website): Our browser-based tools request microphone access solely for client-side audio processing (mic test, voice recorder). Audio is processed in your browser and is never uploaded to our servers.
• Voice models: Voice models you import into Echo are stored locally on your device. We do not have access to your imported models.
• Third-party app data: We do not access or collect data from third-party applications you use with Echo (Discord, games, streaming software, etc.).

3. How We Use Your Information

We use the information we collect for the following purposes:

• Account Management: To create and manage your account, authenticate your identity, and provide access to Echo Products.
• Service Delivery: To provide, maintain, and improve Echo Products, including delivering software updates and new features.
• Product Improvement: To analyze anonymized usage patterns and crash reports to fix bugs, optimize performance, and develop new features.
• Communications: To send product updates, release announcements, and important service notifications. You can opt out of non-essential communications at any time.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

• Contract Performance: Processing necessary to provide you with Echo Products and manage your account (Article 6(1)(b) GDPR).
• Legitimate Interests: Processing for product improvement, security, and analytics, where our interests do not override your rights (Article 6(1)(f) GDPR).
• Consent: Where you have given explicit consent, such as for marketing communications or optional diagnostics (Article 6(1)(a) GDPR). You may withdraw consent at any time.
• Legal Obligation: Where processing is required to comply with applicable laws (Article 6(1)(c) GDPR).

5. Who We Share Your Data With

We do not sell your personal data. We may share limited data with the following categories of service providers, solely to operate Echo Products:

• Supabase — database hosting and authentication infrastructure (account data, encrypted credentials, anonymized telemetry events)
• PostHog — website, desktop, Echo Lite and supported mobile app product analytics, plus optional masked website recordings, using its EU cloud
• Vercel — website hosting and serverless function execution
• Sentry — crash reporting and error tracking for the desktop application (anonymized diagnostics only)
• Firebase (Google) — mobile app analytics, performance monitoring, and crash reporting
• RevenueCat — in-app subscription state validation and purchase analytics (mobile)
• Apple App Store & Google Play Store — processing in-app purchase payments (mobile)
• Resend — transactional email delivery (welcome emails, product updates)
• Google — OAuth sign-in provider (only when you choose Google sign-in); website analytics

All service providers are contractually required to process your data only on our instructions and to maintain appropriate security measures. We do not share your data with advertisers or data brokers.

We may disclose your data if required by law, court order, or governmental regulation, or if necessary to protect our rights, property, or the safety of our users or the public.

6. Data Storage & Security

Your account data is stored on Supabase infrastructure with encryption at rest and in transit. Passwords are hashed using industry-standard algorithms. All data transmission between your browser and our servers uses HTTPS/TLS encryption.

While we implement commercially reasonable security measures, no system is 100% secure. In the event of a data breach that may affect your personal data, we will notify you and the relevant supervisory authority in accordance with applicable law.

7. Data Retention

We retain your personal data for as long as necessary to provide Echo Products and fulfill the purposes described in this policy. Specifically:

• Account data: Retained for the lifetime of your account. Deleted within 30 days of account deletion request.
• Waitlist data: Retained until the Alpha period ends or you request removal.
• Crash reports: Anonymized and retained for up to 90 days for debugging purposes, then deleted.
• Analytics data: Aggregated and anonymized — not linked to individual accounts.

We may retain certain data beyond these periods where required by law (e.g., tax records, legal obligations).

8. International Data Transfers

Escalera Labs S.L. is based in Spain (EU). Some of our service providers operate in the United States and other countries. When your data is transferred outside the EEA, we ensure adequate protection through:

• European Commission Standard Contractual Clauses (SCCs)
• Adequacy decisions by the European Commission
• Appropriate contractual safeguards with each provider

9. Cookies & Tracking

We use a minimal set of cookies:

• Essential cookies: Required for authentication (session tokens) and core website functionality. These cannot be disabled.
• Analytics cookies: Cookies and local storage support usage analytics. We request consent where required and respect your saved choice. You can turn off analytics and optional diagnostics through Privacy preferences.

We do not use advertising cookies, tracking pixels, or third-party marketing trackers.

10. Your Rights

Regardless of your location, we extend the following rights to all users, based on the protections of the EU General Data Protection Regulation (GDPR):

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request that we limit processing of your data in certain circumstances.
• Data Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw any previously given consent at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

For EU/EEA residents: You have the right to lodge a complaint with your local data protection supervisory authority. As Escalera Labs S.L. is based in Spain, you may also contact the Agencia Española de Protección de Datos (AEPD).

11. Children's Privacy

Echo Products are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children under 16. If we learn that we have collected personal data from a child under 16 without parental consent, we will delete that data promptly. If you believe a child under 16 has provided us with personal data, please contact us at [email protected].

12. Local Audio Processing

Echo Products' core voice conversion and DSP processing happens entirely on your local device — whether you are using the desktop app, mobile app, or browser-based tools. This section clarifies what this means for your privacy:

Desktop

• Your microphone audio is captured by Echo, processed by local AI models (RVC/ONNX) and DSP effects, and output to a virtual audio device — all on your computer
• Voice models (.onnx files) are stored locally on your device and are not uploaded to our servers

Mobile

• Voice recordings used for speech-to-speech voice conversion (ASR via on-device Whisper and generation via on-device text-to-speech engine) are processed locally on your device
• Text typed into the text-to-speech engine is processed locally on your device
• Raw audio input, intermediate transcriptions, and generated output speech files are stored locally in your device's isolated application storage sandbox
• Your voice recordings and text prompts do not leave your device and are never sent to our servers

Browser

• Browser-based audio tools (mic test, voice recorder, stem splitter, vocal remover, etc.) process audio client-side using WebAssembly — audio files are not uploaded unless you explicitly choose to share them

This architecture means that even if our servers were compromised, your voice data would not be at risk — because we never had it in the first place.

13. Additional GDPR Disclosures

For the purposes of the EU General Data Protection Regulation (GDPR), Escalera Labs S.L. is the Data Controller for the personal information collected through our website and applications.

We will ensure that any transfer of personal information from countries in the European Economic Area (EEA) to countries outside the EEA will be protected by appropriate safeguards, such as standard data protection clauses approved by the European Commission (SCCs) or other legally accepted transfer mechanisms.

14. Additional Disclosures for California Residents (CCPA)

In the past 12 months, we have collected the following categories of personal information enumerated in the California Consumer Privacy Act (CCPA):

• Identifiers: Name, email address, unique account ID, IP address, and device ID.
• Customer Records: In-app transaction histories and subscription statuses.
• Audio/Visual Data: Recorded voice input clips, only if explicitly uploaded by you (e.g., to a shared voice library feature). No audio is collected by default.
• Usage/Analytics Data: Device configurations, OS versions, crash logs, and anonymized interaction metrics.

We collect and use these categories of personal information for the business purposes described in this policy, including to provide, analyze, and optimize our services.

Right to Know and Delete: If you are a California resident, you have the right to request access to the specific pieces and categories of personal information we have collected about you in the preceding 12 months, and the right to request deletion of your personal information, subject to certain legal exceptions. To exercise these rights, please contact us at [email protected].

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Echo Products. Material changes will be communicated via email or a prominent notice on our website or application. The "Last updated" date at the top of this page indicates when the policy was last revised.

We encourage you to review this policy periodically. Your continued use of Echo Products after changes take effect constitutes acceptance of the updated policy.

16. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights:

Data Controller: Escalera Labs S.L.
Privacy inquiries: [email protected]
General legal: [email protected]