Privacy Policy

echotokens ("we", "us") is a developer API service that aggregates third-party AI media-generation models behind a single uniform interface. This policy explains what we collect when you (or a marketplace gateway acting on your behalf) use our API, how long we keep it, and the controls you have over your data.

This policy applies to traffic served through api.echotokens.me and the marketing surfaces at echotokens.me. Last updated: 2026-05-25.

All persistent data is stored in Google Cloud regions in the United States. Specifically:

• Database (request audit log, job tracking): Google Cloud SQL for PostgreSQL, region us-east4 (Northern Virginia).
• Generated media: Google Cloud Storage bucket, region us-east4.
• Application servers: Google Cloud Run, region us-east4.

We do not replicate data to other regions. International customers (including EU residents) are processed in the US under standard contractual clauses for cross-border transfers.

The default retention periods are:

• Request metadata (request id, model name, response status, atoms charged, duration): 90 days, for operational diagnostics and billing reconciliation.
• Truncated input snippets (first 200 characters of a prompt, for async job rows only): 30 days.
• Generated media files: 24 hours via signed time-limited URLs; we do not maintain a long-term archive.
• Asset URL tokens (the encrypted access tokens we issue): expire in 24 hours and are non-renewable.

On written request to privacy@echotokens.me we will purge an identified request earlier than the schedule above.

Yes, partially. For async generation jobs (video, music), we store a truncated 200-character summary of the prompt in our database for up to 30 days to support job tracking and diagnostic queries. We do not store full prompts.

For synchronous generation (images, text-to-speech, transcriptions), the prompt / input text / uploaded file is forwarded to the upstream model provider and is not persisted on our side after the response is sent — except in the case of an error, where a sanitized (provider-name-stripped) snippet of the upstream error response may be stored for up to 90 days for triage.

Yes, time-limited.Generated media (images, video, audio) are served via 24-hour signed URLs minted with AES-256-GCM-encrypted token payloads. We do not store the underlying media files beyond the lifetime of the upstream provider's storage (typically 24 hours).

A record of the URL having been issued (not the file itself) is kept in our request audit log for up to 90 days for billing reconciliation.

All traffic to and from api.echotokens.me and echotokens.me is encrypted with TLS 1.2 or higher. HTTP requests are automatically upgraded to HTTPS. The TLS termination is managed by Google Cloud Load Balancing.

Backend communication between our application and Google Cloud SQL uses IAM-authenticated mTLS via the Google Cloud SQL connector. Communication with upstream model providers occurs over HTTPS with TLS 1.2+.

To deliver the service, the following categories of third parties may process your data:

• Google Cloud Platform — infrastructure (Cloud Run, Cloud SQL, Cloud Storage, Cloud Build, Secret Manager).
• AI inference partners — the upstream model providers fulfilling your generation requests. We do not disclose the specific providers in this document for competitive reasons, but they are bound by their own privacy policies and process inputs solely to produce the requested output.
• Cloudflare — bot-protection challenge (Turnstile), used only on the marketing site sign-up forms.
• NOWPayments — payment processing, only invoked when a customer tops up via cryptocurrency on echotokens.me; not invoked for marketplace-gateway traffic.
• API marketplaces (e.g. ApyHub) — when you reach us through a marketplace gateway, the marketplace is the controller of your account data; we receive only the per-request payload they forward to us along with our shared origin-auth header.

We currently align our practices with the following frameworks. We are not formally certified against SOC 2 or ISO 27001.

• GDPR alignment: data minimization, purpose limitation, encryption at rest and in transit, right to deletion on request. Cross-border transfers governed by standard contractual clauses.
• OWASP API Security Top 10 (2023): see owasp.org/API-Security. Our implementation includes constant-time authentication, separated authorization surfaces, parameterized SQL, output sanitization, request audit logging, and timeout boundaries on upstream calls.

Subject to applicable law (including GDPR and CCPA where they apply), you have the right to:

• Request a copy of the data we hold about you.
• Request correction or deletion of that data.
• Object to processing or restrict processing.
• Withdraw consent at any time.

To exercise these rights, email privacy@echotokens.me with the request id(s) involved (returned in the x-request-id response header on every API call).

We may update this policy from time to time. The "Last updated" date at the top of section 1 reflects the most recent change. Material changes will be announced via a notice on echotokens.me at least 30 days before they take effect.

Questions about this policy can be sent to privacy@echotokens.me.