Privacy Policy

Echo is a powerful meditation timer, built to minimize the friction of starting a session.

You set the duration by dragging the wheel. It has weight, it clicks under your thumb, and you can set it without really looking. Then: bell, silence, bell.

If you want something underneath the silence, we offer a curated selection of high quality audio tracks, currently only rain and wind. Both optional, both off unless you turn them on.

Echo is currently only aimed at intermediate/experienced meditators, who don't need a voice to guide them through their practice.

This Privacy Policy explains how TheBrainCompany ("TheBrainCompany", "we", "us" or "our") processes personal data in connection with the Echo mobile application (the "App") and related services (collectively, the "Service").

The Service is designed to collect only the information reasonably necessary to provide, secure and maintain the App and its functionality.

1. Controller and Contact

TheBrainCompany, established in the Netherlands, is the controller of personal data processed under this Privacy Policy for the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR").

Questions, requests and complaints concerning this Privacy Policy or our processing of personal data may be submitted to: hello@thebraincompany.co.

2. Personal Data We Process

Depending on how you use the Service, we may process the following categories of personal data:

• Account and authentication data. We create an account identifier when the App is first used. If you elect to sign in, we may process the email address and, where supplied through your selected sign-in method or by you, name associated with that account. We do not require a password for the Service.
• Service and activity data. We process limited records needed to provide the Service, including meditation-session start and completion times and duration, and information derived from those records, such as totals and streaks.
• Technical and usage information. We may process limited technical information needed to operate and secure the Service, such as language or regional settings, time zone, country or region inferred from a connection, and connection or security information. We do not use this information for behavioural advertising or cross-context tracking.
• Communications. If you contact us, we process the information contained in your correspondence and any information reasonably necessary to respond.

The App may retain limited information locally on your device, such as authentication credentials, settings and cached Service data, in order to enable ordinary App functionality, including offline functionality. Such information is not made available to us merely because it is stored on your device.

3. Purposes and Legal Bases

We process personal data only where a lawful basis applies. In particular, we process personal data:

• to provide, personalise at your direction, administer and support the Service, including account access and synchronisation of Service data, where necessary for the performance of our contract with you (Article 6(1)(b) GDPR);
• to maintain the security, integrity and availability of the Service; prevent fraud, abuse and unauthorised use; troubleshoot; and understand the Service's general operation and availability, where necessary for our legitimate interests (Article 6(1)(f) GDPR). We have assessed that these interests are not overridden by your rights and freedoms, taking account of the limited nature of the information concerned and the safeguards we apply;
• to comply with legal obligations to which we are subject (Article 6(1)(c) GDPR); and
• where required by applicable law, with your consent (Article 6(1)(a) GDPR). Where processing is based on consent, you may withdraw that consent at any time; withdrawal does not affect the lawfulness of processing before withdrawal.

We do not sell personal data, use personal data for targeted advertising, or use personal data to track you across third-party apps or websites. We do not knowingly collect special-category personal data through the Service.

4. Sources of Personal Data

We receive personal data directly from you, automatically through your use of the Service, and, if you choose to use a third-party sign-in method, from the relevant identity provider. The information received from an identity provider is governed additionally by that provider's terms and privacy practices.

5. Disclosure of Personal Data

We may disclose personal data to service providers that perform services on our behalf, including providers of cloud hosting, data storage, authentication, communications delivery, security and infrastructure. Such providers may process personal data only as necessary to provide services to us and subject to appropriate contractual and organisational safeguards.

We may also disclose personal data where reasonably necessary to comply with applicable law, legal process or a lawful request; to protect the rights, safety, security or property of TheBrainCompany, our users or others; or in connection with a corporate transaction, subject to applicable law.

We do not disclose personal data to third parties for their independent direct-marketing purposes.

6. International Transfers

Personal data may be processed in countries other than the country in which you reside, including countries that may not provide the same level of data protection. Where personal data is transferred outside the European Economic Area, the United Kingdom or Switzerland, as applicable, we will use an appropriate transfer mechanism and supplementary safeguards where required by applicable law, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

7. Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, meet legal, accounting and reporting obligations, resolve disputes, and enforce our agreements.

Account and Service data are generally retained while your account remains active. You may request deletion of your account through the App or by contacting us. Upon a valid deletion request, we will delete or anonymise the relevant personal data, subject to data we are required or permitted to retain by law and data retained temporarily in secure backup systems until overwritten in accordance with our backup-retention processes. Local data retained solely on your device may be removed by deleting the App or using available in-App deletion controls.

8. Your Rights

Subject to applicable law, including the GDPR, you may have the right to request access to, rectification of, erasure of, restriction of, or portability of your personal data, and to object to processing based on our legitimate interests. You may also lodge a complaint with a competent data-protection authority, including the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or with the authority in your habitual residence, place of work or place of an alleged infringement.

To exercise a right, contact us at hello@thebraincompany.co. We may request information reasonably necessary to verify your identity and authority before acting on a request. We will respond within the period required by applicable law.

For accounts used without an email address or other identifying contact information, we may be unable to identify the relevant account from an email request alone. Where available, use the deletion controls in the App to delete such an account.

9. Security

We implement reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. No method of transmission or storage is completely secure; accordingly, we cannot guarantee absolute security.

10. Children

The Service is not directed to children under the age of 16, and we do not knowingly collect personal data from children under that age. If you believe that a child has provided us with personal data in contravention of applicable law, please contact us and we will take appropriate steps.

11. Changes to This Privacy Policy

We may amend this Privacy Policy from time to time. Where required by applicable law, we will provide notice of material changes by appropriate means before they take effect. The "Last updated" date indicates when this Privacy Policy was most recently revised.

12. Contact

TheBrainCompany
Netherlands
hello@thebraincompany.co