This policy covers the madebyecho.xyz website.
Who we are
madebyecho.xyz is operated by ECHO Technologies, based in Istanbul, Türkiye ("ECHO", "we"). For any privacy question or request write to hello@madebyecho.xyz. Your rights under the GDPR and how to apply are explained in a separate text: GDPR notice.
In short
Our site sets no cookies of its own, has no accounts, sends no newsletter and sells nothing on the site. Data reaches us in only two ways: when you fill in the contact form and when you ask the site assistant a question. Cloudflare, which serves and protects the site, technically processes every visitor's connection data.
Serving and protecting the site
All requests pass through the Cloudflare, Inc. network and the pages are hosted on Cloudflare. To serve the site and protect it from attacks, Cloudflare processes your IP address, the time of the request, the page requested and browser information. On the free plan we use, Cloudflare does not give us raw request logs and we keep none; Cloudflare's own security processing is subject to Cloudflare's privacy policy. Your browser remembers our HTTPS-only rule for one year. After a security check Cloudflare may set short-lived, strictly necessary security cookies; we do not read them.
Analytics
The Cloudflare Web Analytics script on our pages uses no cookies and creates no identifier for you. It reports the page address, the referring page, load times and browser and operating-system information to Cloudflare; Cloudflare derives your country from your IP address. We see this data only as aggregate reports, to understand how the site is used and how fast it is. The retention period is set by Cloudflare.
Contact form
Name, e-mail and message are required; the topic is optional. You do not have to use the form; you can also write directly to hello@madebyecho.xyz. Cloudflare Turnstile checks that a person sent the form; Turnstile processes your IP address and technical browser signals. Your message is forwarded by a program running on Cloudflare, over an encrypted connection, to our hello@ mailbox (Google Workspace), with your address as reply-to. The message is not stored on Cloudflare and the e-mail does not contain your IP address. To prevent abuse there is a limit of three submissions per IP address per minute; that counter is cleared after about a minute. We use your details only to reply to you and to follow up your request.
Site assistant
The chat window is optional. Your question, the previous messages of the same chat (at most eight) and the page language are sent to an AI model running on Cloudflare Workers AI to generate the answer. We do not store the chat and keep no log; it is gone when you close the page. Cloudflare states that for standard inference requests it does not retain inputs or outputs after the request is processed and does not use them to train AI models. A rate limit per IP address guards against abuse. Please do not write personal or confidential information in the chat; use the contact form for personal requests. Answers are generated automatically from the site's content, may be wrong and are not binding.
E-mail correspondence
When you write to hello@, your name, e-mail address and message are kept in our Google Workspace mailbox. We use them to reply, to fulfil your request and, where needed, to show how we handled it. We keep correspondence for as long as it is needed to follow up the request and delete what is no longer needed; records of rights requests may be kept for the statutory limitation periods.
International transfers
Cloudflare and Google operate worldwide; your data may be processed outside your country, for example in the United States. Both providers process data on our behalf under data processing agreements. Transfers are covered by the commitments of Cloudflare, Inc. and Google LLC under the EU Standard Contractual Clauses and the EU-US Data Privacy Framework. ECHO is based in Türkiye; for transfers from Türkiye we also use the standard contract required by Turkish data protection law, signed and notified to the Turkish authority.
Children
The site is not aimed at children and we do not knowingly collect children's data.
Your rights
You can exercise your rights of access, rectification, erasure, restriction, portability and objection by writing to hello@madebyecho.xyz; we answer free of charge within one month. You may also complain to a data protection authority, in particular in the country where you live. Details are in the GDPR notice.
Changes
When we change this policy we update the version number and the date. Before using data for a new purpose we update this page; where explicit consent is required we ask for it separately, in a separate text.