Echo
ECHO / PRIVACY

Privacy policy.

Version 1.2 · effective September 25, 2026

Data Controller: NOVASENSE Ltd., BIN 240940900944

Version 1.2. Approved on 25 September 2026.

The Russian, English and Kazakh versions correspond to revision 1.2; no language version has precedence.

Effective date: 25 September 2026.

1. Who is responsible for the data

NOVASENSE Ltd., a Private Company incorporated in the Astana International Financial Centre (AIFC) (the “Company”, “we”, “us”), acts as the Data Controller and processes personal data when operating under the Echo brand.

Requests concerning access, rectification or deletion of data and withdrawal of consent may be sent to the email above or in writing to the Company's registered address.

2. Scope of the Policy

This Policy covers visits to the website, completion of the questionnaires on the website (the diagnostic for businesses and the partnership model selector for software vendors), enquiries submitted through forms, email and connected messaging services, including WhatsApp Business, project discussions, demonstrations, entering into and administering contracts, technical support and communications to which the user has consented.

It applies to individuals, including representatives of customers and partners. Information about a company is also treated as personal data where it makes it possible to identify a particular individual.

When we process data in software products that we create for customers, the purposes are generally determined by the customer. The categories of data, our authority, security measures and deletion arrangements are governed by a separate data processing agreement. This Policy does not replace the customer's privacy policy and does not authorise us to use its databases for our own purposes.

Processing is based on the AIFC Data Protection Regulations 2017 and the AIFC Data Protection Rules 2018, as amended from time to time. Personal data is processed in accordance with AIFC data protection acts. Mandatory laws of the Republic of Kazakhstan apply to the extent that they govern a particular processing operation. This Policy does not limit the rights granted by those rules.

3. Data we use

Enquiries and applications: name, provided phone number or email, company, company size (headcount range), job title if stated, selected communication channel, content of the enquiry and materials submitted by the user.

Diagnostics: the selected problem, tools used, consequences, desired result and obstacles, and the proposed solution generated. For software vendors: product type, typical customer requests, current handling practice and frequency, preferred cooperation model and whether a customer with such a request exists. When combined with contact details, this information may relate to a particular individual.

Business communications: messages, submitted files, arrangements, scheduled meeting information, enquiry identifiers and support history. Calls and meetings may be recorded only after separate notice and where an appropriate legal basis exists; this Policy does not itself authorise recording.

WhatsApp, if the channel is connected: phone number, display name, messages and attachments, message identifiers, time and available service statuses for delivery and reading. We do not gain access to all of a user's private chats or address book merely because the user contacts us.

Contracts and payments: information about representatives and signatories, their authority, business contacts, details and payments to the extent necessary for the contract and mandatory recordkeeping. Payment card details and verification codes are not requested through ordinary forms or WhatsApp.

Technical information: IP address, request time, requested page, browser and device type, technical errors and security logs, to the extent actually processed by the website and its infrastructure. The website uses the Meta Pixel (Meta Platforms): it records page views, questionnaire steps and results, form submissions and transitions to WhatsApp, the referral source and UTM campaign parameters; when a form is submitted, hashed (irreversibly transformed) phone number and email may be sent to Meta for matching with ad impressions. Google Fonts is used to display fonts, and the IP address is transmitted to Google when fonts are requested. Categories of recipients and conditions governing data transfers are set out in section 9 of this Policy.

Consents and withdrawals: the version of the text shown, selected purposes and channels, date and method of confirmation or withdrawal, and information necessary to verify the choice.

Please do not submit identity documents, national identification numbers, medical information, passwords, access keys, full payment card details or personal data of third parties unless required for a separately agreed task. Use anonymised examples for an initial process review. By providing another person's personal data, the user confirms that there is a lawful basis for its disclosure to the Company.

4. Sources of data

We receive data directly from the user, from the user's organisation or authorised representative, through communication channels used by the user, and through operation of the website's technical infrastructure. If data is not obtained from the individual, we provide the required information about processing in accordance with applicable rules.

We do not use purchased contact lists or contact lists collected without an appropriate legal basis for messaging campaigns.

5. Purposes and legal bases

Purpose Data used Legal basis
Provide the questionnaire result Answers and technical session state Legitimate interest in providing the requested tool, following an assessment of necessity and the user's rights; consent for optional processing
Respond to an enquiry and prepare a proposal Contact details, answers and content of the enquiry Consent to process the enquiry; pre-contractual steps where requested by the data subject with a view to entering into a contract
Perform a contract and provide support Business contacts, communications and project information Contract, where the data subject is a party; for representatives of an organisation, legitimate interest in business communications following an assessment; applicable legal obligations
Ensure security and operation Minimal technical logs Legitimate interest in preventing abuse and protecting the service following an assessment; specific legal obligations where applicable
Assess website usability and enquiry sources Events and campaign parameters Legitimate interest in measuring the effectiveness of the website and advertising following an assessment; consent where required by applicable law
Send marketing and news Contact details, selected channels and consent record Separate voluntary consent
Maintain mandatory records and protect rights Necessary contractual, enquiry and log records Identified legal obligations; legitimate interest in establishing or defending claims following an assessment

A requested function is not, by itself, a separate legal basis. Withdrawal of consent must not be circumvented retrospectively by substituting a different legal basis.

We do not combine all purposes into unconditional permission for any use. If a new purpose requires new consent, it is obtained before that processing begins. Visiting the website and remaining silent do not constitute consent to marketing communications.

6. Voluntary provision and user choice

The questionnaire may be completed, and its result viewed, without providing contact details. Contact details are required if the user wants an individual response: submitting an enquiry requires a name, phone number or email, company size and confirmation of consent; the company name and a comment are optional.

Where applicable law requires consent, the Company obtains it in a manner that allows the user's choice to be verified. A single consent may cover related actions necessary to consider an enquiry, prepare a proposal, communicate and provide services

Declining marketing does not prevent the user from making an enquiry, receiving a diagnostic result or receiving services under a contract. Consents for different optional purposes are obtained separately; boxes are not pre-ticked.

Consent may be withdrawn using the contacts in section 1 or an available unsubscribe mechanism in a message. Withdrawal does not affect the lawfulness of processing carried out before withdrawal and applies to future processing based on consent. If certain information must be retained by law or on another permitted basis, we will explain what information is retained and why. If the requested service cannot continue without the data, we will notify the user separately.

7. WhatsApp Business and other messaging

This section applies to the official Echo channel on WhatsApp Business (number +7 705 175 17 77) and to channels connected through the WhatsApp Business Platform, including the Cloud API, when they are connected.

An incoming enquiry is used to respond to its subject. For subsequent outbound messages, we take into account the permission obtained, its purposes and the selected channel. A conversation relating to an enquiry does not automatically subscribe the user to marketing. Marketing communications are sent only with separate consent.

The user may opt out by replying “STOP”, “UNSUBSCRIBE”, “СТОП”, “ОТПИСАТЬСЯ”, or by making any other clear request to stop communications, including through the email in section 1. Requests to stop communications are honoured regardless of how they are received. If the user prohibits communication through WhatsApp, another channel will be agreed for necessary contractual communications.

If an automated assistant responds, we identify it and provide an opportunity to contact a member of staff. Access to communications is limited to authorised participants in the processing. The Company does not disclose the content of one customer's chat to other customers.

Use of WhatsApp involves WhatsApp/Meta and, where applicable, a connected platform provider. Data transfers when using WhatsApp are governed by section 9 of this Policy. Use of WhatsApp is also governed by its own terms and Privacy Policy. Deletion of data by the Company does not automatically delete all information processed independently by WhatsApp.

8. Diagnostics, automation and AI

The questionnaires on the website generate a result using predefined rules without calling a language model. The result is preliminary: it is a proposal for discussion and not a decision about an individual that produces legal effects.

Connecting AI to communications or a particular project does not authorise unrestricted disclosure of data to the AI service. Before connection, the purpose, provider, categories of data, retention and transfer conditions, and use for training are determined. Where necessary, a separate notice is provided and consent is obtained.

We do not use customer communications or project materials to train general-purpose models without a separate legal basis and explicit agreement. Disclosure of materials to a model for performance of a particular task and training a model on those materials are treated separately.

9. Recipients, storage and cross-border data transfers

Access to personal data is granted to Company staff and contractors to the extent necessary to process enquiries, provide services, develop and support products, and operate infrastructure, communications, accounting and security. Where necessary, arrangements with such persons include requirements governing confidentiality, protection and use of data only for agreed purposes.

The Company uses the following providers: Bitrix24 (CRM: enquiries, contacts, companies and deals); Meta Platforms (WhatsApp Business and the Meta Pixel); Google (Google Fonts — font delivery); the website hosting provider; email and cloud infrastructure providers. Connection of new providers, including AI services for a particular project, is reflected in a new revision of this section. Some providers or their information systems may be located outside the AIFC and the Republic of Kazakhstan, and personal data may therefore be transferred and processed abroad.

A cross-border transfer is made only to the extent necessary for the relevant purpose and where a legal basis under applicable law exists, including the user's consent, the necessity to enter into or perform a contract, an adequate level of protection, permission from the competent authority, or another legally permitted basis. The Company complies with applicable data localisation requirements, including storage in a database located in the Republic of Kazakhstan where such storage is mandatory.

Personal data may be disclosed to public authorities, courts and other persons where required by law, necessary to comply with a binding requirement, or necessary to protect the rights and legitimate interests of the Company or third parties.

The Company does not sell personal data or disclose contact details to third parties for their independent marketing. Information about applicable categories of recipients and conditions governing data transfers may be requested using the contacts in section 1 of this Policy.

10. Cookies, browser storage and analytics

The website may use cookies, browser storage and other technical means necessary to maintain the user's session and settings, ensure security and support the proper operation of particular functions.

The website uses the Meta Pixel, a Meta Platforms tool for measuring advertising effectiveness: it processes technical information about the device and browser, activity on the website (page views, questionnaire steps, form submission, transition to WhatsApp), the referral source and campaign parameters, and, when a form is submitted, hashed phone number and email. The data is used to measure advertising results and to show relevant advertising on Meta platforms. You may opt out by restricting cookies and third-party scripts in your browser, through the advertising settings of your Meta account, or by contacting the email in section 1.

The user may restrict or delete cookies and other locally stored data through browser controls. This may affect the operation of certain website functions.

11. Retention and deletion

Data is retained no longer than necessary for the relevant purpose, subject to mandatory retention periods. Once the purpose has been achieved, the data is deleted or irreversibly anonymised.

Retention periods:

Extended retention for a particular dispute or obligation is limited to the relevant data. Access to such material is separated from routine operations and marketing.

12. Security and confidentiality

The Company arranges protection proportionate to risk, including access controls, protected transmission, account management, contractor oversight, updates, backups and incident response procedures. Specific measures are verified before the relevant systems are launched. This Policy is not a statement of certification or absolute security.

If an incident occurs, we limit its consequences, determine the data affected and fulfil applicable duties to notify regulators and users. Commercial materials are used for the agreed task; separate requirements governing those materials, access and intellectual property are set out in the contract and, where necessary, an NDA.

13. Your rights and how to make a request

Subject to applicable law, you may obtain information about processing and access to your data, have it rectified, request blocking, restriction or deletion where grounds exist, withdraw consent, object to permitted processing and opt out of direct marketing. Any other rights provided by the applicable regime also remain available.

Email dev@darynlab.ai with the subject “Personal Data — Echo”. State the contact details used in your communications and the action requested. Do not send a copy of an identity document unless requested. To protect against unauthorised access, we may request minimal, proportionate evidence of identity or authority.

We consider requests without undue delay and within the periods established by applicable rules. If fulfilment is restricted by mandatory retention requirements or the rights of other persons, we explain the basis and the available options.

Deleting a conversation only on your device does not delete it from the Company's systems. Use the procedure above to request deletion of our copies. Fully anonymised information from which an individual cannot be reidentified may be retained as statistics.

You may apply to the competent data protection authority and to a court. For matters relating to processing under the AIFC regime, you may contact the Commissioner of Data Protection through the official AIFC website.

14. Children and external resources

The services are intended for business use and are not directed at children. We do not request children's data for marketing. If such data is received without an appropriate legal basis, contact us so that we may assess and delete it or follow the procedure required by law.

Links to case studies, demonstrations and third-party services lead to resources governed by their own rules. Read their notices before entering data. The presence of a link does not authorise the third-party service to receive all of your diagnostic answers.

15. Changes to the Policy

The current version is published at the permanent address https://goecho.ai/privacy together with its effective date. Material changes are communicated to users in an appropriate manner. Amending the text does not replace fresh consent where required and does not apply new purposes retrospectively.

16. How the current version of the website works

As of the approval date of this revision:

Changes to this arrangement are reflected in a new revision of the Policy before they take effect.

CONTACT ECHO

Let's discuss your project.

Briefly tell us what you want to build or improve.

Learn how we process data in our privacy policy.