Privacy Policy.

This Privacy Policy explains how EchoNova AI L.L.C-FZ (trade licence no. 2650442.01, Meydan Free Zone, Dubai; "EchoNova", "we", "us") handles personal data when you visit echonova.ai, contact us, or hold an account on the EchoNova platform, including Sada (together, the "Services").

1. Two different roles: when this Policy applies

We are the controller (we decide why and how the data is used) for:

• people who visit our website or read our content;
• people who contact us, ask for a demo, or apply for a job;
• the business users who hold accounts on our platform (our customers' staff: their names, logins, and use of the dashboard);
• self-serve account holders (people and companies on the Free Trial, Starter, Growth and Scale plans), for their account, billing and usage data. For the text and audio they submit or generate, section 9A applies.

We are a processor (we act only on our customer's instructions) for the people who talk to an EchoNova AI assistant run by one of our business customers, for example, someone who phones a bank, or messages a clinic on WhatsApp, and is answered by Sada. In that case the business you contacted is responsible for your data and its own privacy notice applies. We process that data only to provide the service to that business, under a written data processing agreement. If you contact us about such data, we will pass your request to the business concerned.

Section 9 explains what we do with conversation data in more detail.

2. Personal data we collect (as controller)

We do not intentionally collect sensitive personal data (such as health, religion, or biometric data) about website visitors or account users. Please do not send it to us.

3. Why we use it and our legal basis

UAE: under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the "UAE PDPL"), processing is based on your consent unless one of the cases listed in the law applies, such as performing a contract with you or complying with a legal obligation. Where we rely on consent, you may withdraw it at any time; this does not affect processing that already took place.

4. Who we share it with

• Hosting and infrastructure providers that run our Services: Amazon Web Services and Microsoft Azure.
• Other service providers that act on our instructions, for example email, analytics, customer support and payment providers. A current list is published at echonova.ai/trust/subprocessors.
• Professional advisers (lawyers, auditors, accountants) under confidentiality duties.
• Authorities, where UAE, Saudi or other applicable law requires it.
• A buyer or successor, if all or part of our business is sold or reorganised, under confidentiality protections.

We do not sell personal data, and we do not share it for third-party advertising.

5. International transfers

We are based in the UAE and serve customers in the UAE and Saudi Arabia. Our Services run on Amazon Web Services and Microsoft Azure. The regions in use are listed on our subprocessor page at echonova.ai/trust/subprocessors, and some service providers process data in other countries.

When personal data leaves the UAE, we transfer it only as the UAE PDPL permits: to countries whose laws provide adequate protection, or otherwise under one of the conditions in the law, for example a contract that requires the recipient to protect the data to the UAE standard, or your express consent. Transfers out of Saudi Arabia follow the Saudi transfer regulations. Transfers out of the EEA use appropriate safeguards such as the European Commission's standard contractual clauses.

6. How long we keep it

When you delete something, it disappears from your account at once, leaves our live systems within 30 days and leaves our backups within a further 35 days. Deletion is final. Cancelling a plan stops billing only; nothing is deleted. Closing your account ends access at once; you have 30 days to export your data, then it is deleted. A Free Trial account with no sign-in for 24 months gets an email notice and is closed 30 days later. We keep data longer only during a misuse investigation, a dispute or legal claim, or when an authority or the law requires it. When a period ends, we delete the data or remove everything that identifies the person.

7. Security

We use technical and organisational measures appropriate to the risk, and we are building our information security management system towards the ISO/IEC 27001 and ISO/IEC 42001 standards. No system is completely secure. If a breach affects your personal data, we will notify the competent authority and, where the law requires, you.

8. Your rights

Depending on where you are, you have the right to:

• be told what data we hold about you and how we use it, and get a copy;
• have inaccurate data corrected;
• have your data deleted, or its use restricted, in the cases the law allows;
• stop processing, including direct marketing;
• receive your data in a structured, machine-readable form and have it transferred to another provider;
• object to decisions about you made solely by automated processing, where these have legal or similarly significant effects;
• withdraw consent at any time.

To exercise a right, email privacy@echonova.ai. We may need to verify your identity. We will respond within the period set by applicable law.

Complaints. You can complain to us first. You can also complain to the UAE Data Office; in Saudi Arabia, to the Saudi Data & AI Authority (SDAIA); and in the EEA, to your local data protection authority.

9. Conversation data (calls, voice and messages)

When a business uses EchoNova to answer its customers by phone, WhatsApp, SMS, chat or email, the platform processes the conversation for that business, including:

• audio recordings of calls and voice notes;
• transcripts and messages;
• phone numbers, names and anything else the caller chooses to say;
• AI-generated summaries, classifications and actions (for example a booking).

That business is the controller. It decides whether conversations are recorded and when to delete them; we keep them until it deletes them or closes its account. It is responsible for telling callers and obtaining any consent the law requires. EchoNova processes this data only to provide the service to that business, under a data processing agreement.

We use conversation data to train and improve our AI models, de-identified where possible, unless the business has turned this off in its account settings. The business is responsible for telling its callers about this use.

9A. Generation records and watermarks

When you generate audio or text on the platform, we keep a record of the generation (account, time, voice used, identifiers of the input and output, IP address and device data) for up to 12 months. Your text and audio stay until you delete them (section 6). We use these records to bill you, secure the platform, and investigate reports of misuse under our Acceptable Use Policy and Voice Usage Policy. We train our models on a separate copy of your content with your name, email and the account link removed, and keep these copies for up to 3 years after your last activity. You can turn training off at any time in Settings > Data use (Platform Terms, section 4.2); after that we take no new copies, and copies taken before stay until their period ends unless you ask us to delete them at privacy@echonova.ai. What a model has already learned cannot be removed. Every audio file generated on the platform carries an inaudible watermark identifying it as produced by EchoNova. If a person affected by a misuse report, including a voice owner, asks us for evidence, we may provide the relevant records and audio to them, and to the competent authorities where the law requires it.

9B. Voice data

A voice is personal data, and under the UAE and Saudi laws a voiceprint can be biometric data. We handle it as follows:

• Voice artists: recordings and the voice model built from them are kept under the artist's signed agreement and the Voice Artist Terms, in secure storage, and never given to any third party.
• Voice cloning by account holders: we create a clone only from your own voice or from a voice whose owner has given documented consent. We keep the consent recording, its transcript and the results of our identity and consent checks while the clone exists, and for 12 months after it is deleted. You can delete a clone at any time; it is also deleted when you close your account. The voice model is deleted within 30 days.
• Callers to our customers' assistants: call audio is processed for the customer that runs the assistant, as a processor (section 9). We do not create voiceprints of callers unless the customer has enabled that feature and confirmed the caller's explicit consent.
• Demos and the playground: what you submit is used to make the demo, and the demo files are deleted after 1 day.

10. Children

The Services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children as controller. If you believe we have, contact us and we will delete it.

11. Data protection contact

EchoNova AI L.L.C-FZ Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates Email: privacy@echonova.ai

We do not offer the Services in the European Economic Area.

12. Changes

We will post any update on this page with a new "last updated" date. If a change is significant, we will also notify account holders by email before it takes effect.

13. Language

This Policy is published in Arabic and English. Where UAE law requires the Arabic version to prevail, it prevails; otherwise the two versions have equal standing, and we will resolve any difference in the way that best protects you.