This Privacy Policy explains how Tech Tree Sdn Bhd, operating NextRound Echo (“Echo”, “we”, “us”, or “our”), collects, uses, stores, and shares information when you use our website, dashboard, WhatsApp assistant, and related services. If you use Echo through an organization, that organization controls the workspace and the information submitted to it.
Information we collect
- Account and workspace information: your name, email address, business name, role, sign-in information, preferences, and legal acknowledgements.
- Business and conversation content: information your team uploads or enters, customer conversations, attachments, booking details, and other content needed to operate the assistant.
- Integration information: account identifiers, connection status, permissions, and credentials from services you choose to connect, including Google Calendar.
- Usage and technical information: device and browser information, IP address, essential cookie or session data, feature usage, error records, security events, and service performance data.
Google Calendar data lifecycle
Connecting Google Calendar is optional and requires an affirmative action by a workspace owner or administrator. Echo requests only the permissions needed to let the workspace offer and manage bookings.
Permissions and data we access
When you connect Google Calendar, Echo requests these permissions:
openidandemaillet Echo read your stable Google account identifier and email address so the connection can be linked to the correct Echo workspace and shown to authorized workspace members.https://www.googleapis.com/auth/calendar.calendarlist.readonlylets Echo read calendar-list metadata, including calendar names, identifiers, ownership status, and time zones. Echo filters this list so that only calendars owned by the connected account can be selected.https://www.googleapis.com/auth/calendar.events.freebusylets Echo read busy start and end times for the selected calendar so it can calculate available appointment slots. This access does not return existing event titles, descriptions, or attendee details.https://www.googleapis.com/auth/calendar.events.ownedlets Echo create, find, read, update, reschedule, and cancel events on calendars you own. Echo uses this access only for booking actions managed through Echo, including checking the status and start or end time of an Echo-managed event.
How we use Google Calendar data
Echo uses Google account and calendar data only to connect the selected account, display eligible owned calendars, calculate availability, prevent scheduling conflicts, and create or manage bookings that the workspace offers through Echo. Busy times are converted into available time slots; Echo does not use them to profile the account holder or infer the subject of existing events.
Data Echo writes to Google Calendar
When a booking is confirmed, Echo may write the service name, the customer's first name or booking reference, the booking reference, start and end times, time zone, and a private Echo idempotency marker to the selected calendar. Echo does not add the customer as a calendar attendee and does not ask Google to send attendee email.
What we store and how long we retain it
Echo stores your Google account identifier and email address, the granted scopes, encrypted OAuth access and refresh credentials, token expiry information, the selected calendar's identifier and name, the booking time zone, derived offered slots, local booking records, and references to provider events created or managed through Echo.
Busy-event details are requested on demand and are not retained as a synchronized copy of your calendar history. Derived offered times and confirmed booking records may be retained for the booking workflow, service reliability, security, legal obligations, and dispute resolution under the retention practices below. Google credentials are retained only while the calendar connection remains active and are cleared when the connection is disconnected or deactivated.
When Google Calendar data is shared
- Authorized workspace members may see the connected account email, safe connection status, and eligible calendar names and time zones.
- Customers messaging the workspace may receive derived available time slots. Echo does not disclose the titles, descriptions, or attendees of existing Google Calendar events to those customers.
- Infrastructure service providers may process Google user data only as needed to host, secure, maintain, and deliver Echo on our behalf and under confidentiality and data-protection obligations.
- Google receives the event content and instructions necessary when an authorized booking action creates, updates, reschedules, or cancels an event in the selected calendar.
How we protect Google Calendar data
Google OAuth credentials are transmitted over HTTPS, encrypted at rest, restricted to the applicable workspace, and never returned to or displayed in the browser after connection. Access is limited by workspace role, and operational access is logged or restricted where appropriate.
Your Google Calendar controls
You can disconnect Google Calendar in Settings → Calendars. Disconnecting clears Echo's stored Google access and refresh credentials and stops new Calendar API access. You may also revoke Echo's access from your Google Account permissions. Disconnecting does not automatically delete calendar events that Echo already created in your Google Calendar; an authorized user can remove those events through Google Calendar. A workspace owner may also request account or workspace deactivation through our data deactivation process, which revokes active integration credentials under the recoverable-retention process described below.
How we use information
We use information to:
- provide, maintain, and secure Echo;
- answer customer messages, retrieve approved business knowledge, and support workspace collaboration;
- show booking availability and create, reschedule, or cancel calendar events after the relevant booking action is confirmed;
- authenticate users, enforce permissions and usage limits, prevent abuse, troubleshoot failures, and provide support; and
- comply with law, enforce our terms, and protect the rights and safety of users, customers, and the service.
Google API Limited Use
Echo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We use Google user data only to provide or improve the user-facing calendar-booking features described above. We do not sell Google Workspace API data or use or transfer it for advertising, creditworthiness, lending, information resale, or creating unrelated databases. We do not use Google Workspace API data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models.
Human access to Google user data is limited to support involving specific data that you explicitly ask us to access and consent to us viewing, security investigation, or legal compliance. We require our employees, contractors, service providers, and successors to follow these restrictions.
How we share information
We may share information only:
- with authorized members of your workspace, according to their role;
- with service providers that process data on our behalf to host, secure, maintain, or deliver Echo, under appropriate confidentiality and data-protection obligations;
- with connected services, such as Google Calendar, when you direct Echo to perform an integration action;
- when required by law or reasonably necessary to protect rights, safety, security, and the integrity of the service; or
- as part of a merger, acquisition, financing, or sale of assets, subject to applicable notice and consent requirements.
We do not sell personal information.
Storage, security, and international processing
We use administrative, technical, and organizational safeguards designed to protect information. These include encrypted transport, encryption of stored integration credentials, tenant-scoped access, role-based controls, revocable sessions, and restricted operational access. No security measure is completely risk-free.
Echo and its service providers may process information in countries other than the one where you live. Where required, we use appropriate safeguards for international transfers.
Retention and deletion
We retain information for as long as needed to provide the service, maintain security and reliable booking records, meet legal obligations, resolve disputes, and enforce agreements. Retention periods depend on the type of information and why it is held.
Workspace or account deactivation revokes active sessions and integration credentials and removes deactivated data from normal product access. Some records may be retained where required for security, legal obligations, dispute resolution, or backup integrity. Read our data deactivation instructions for the available request paths and status process.
Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal information. Workspace owners and administrators can update many settings in Echo, disconnect integrations, and submit the available deactivation request. You can also ask your workspace administrator or the support channel provided with your Echo account for help with a privacy request. We may need to verify your identity and authority before completing a request.
Children's privacy
Echo is a business service and is not directed to children. We do not knowingly collect personal information directly from children where parental consent would be required.
Changes to this policy
We may update this policy as the service or legal requirements change. We will post the updated policy here, change the “Last updated” date, and provide additional notice when required.
Contact
Privacy questions and requests may be sent to [email protected] or Tech Tree Sdn Bhd, A1-11-11, Arcoris Mon't Kiara, 10, Jalan Kiara, Mont Kiara, 50480 Kuala Lumpur. You may also review our Terms of Service and data deactivation instructions.