Privacy Policy

1. Who we are

Echo Cards is a product of Echo Heights Agency, in Dar es Salaam, Tanzania. We send event invitations over WhatsApp and SMS, collect the replies, and check guests in at the door with a QR code. This policy covers the Echo Cards website and the Echo Cards application.

It is written to describe what the system actually does. Where we do not do something, we say so rather than leaving a reassuring sentence in place.

2. What we collect from you

If you hold an account with us — you are organising an event — we hold:

• Your name, phone number and email address.
• The name of your company or committee, if you give us one.
• Your events: the date, the venue, the card design, and what you were quoted.
• Payments: the amount, the method, the reference and whether it cleared. We never see or store your card or mobile-money PIN — those are entered with the payment provider, not with us.
• Messages you send our support team, and our replies.
• Ordinary technical records that a web server keeps: the pages requested, the time, and the address they came from.

3. Your guests, and who is responsible for them

This is the most important section in this policy, and the one most likely to be skipped.

To send an invitation we need a guest's name and phone number. You provide those. Your guests never visit this website and never agree to anything here, so the responsibility for having a reason to hold their details sits with you, and we process them on your instruction. In the language of the Personal Data Protection Act 2022, you are the controller and we are the processor.

What that means in practice:

• Your guest list is used for your event and for nothing else. We do not sell it, rent it, share it with other clients, or message your guests about anything other than the event you invited them to.
• You can take it back or have it deleted at any time — see section 7.
• Alongside the names and numbers we hold what the event produced: whether each guest replied, whether they arrived, and what they pledged or contributed.

4. Who else sees it

We do not sell your information or your guests', and we do not share it with anyone for their own purposes. Parts of it do reach the companies that carry out specific jobs on our instruction, because there is no way to deliver an invitation without giving a messaging network the number to deliver it to. Those are:

• Messaging networks, which receive the guest's phone number and the message so that it can be delivered, and nothing else.
• Media hosting, which stores card designs and event photographs. It receives images, not guest lists.
• Payment processing, which receives the amount and the reference, and handles the payment details we never see ourselves.

Each of them is bound to use what they receive only for that job. We will tell you which specific companies these are if you ask — write to us and we will answer; we simply do not publish our supplier list.

Beyond those, we disclose information only where the law requires it, or where it is needed to establish or defend a legal claim. If the business were ever sold, the data would move with it, and you would be told before that happened.

5. Where it is held

The application and its database run on servers we control. The companies in section 4 operate internationally, so a message you send is processed outside Tanzania on its way to being delivered. That is inherent to sending a WhatsApp message and cannot be avoided by choosing a different provider.

6. How it is protected

We take reasonable measures to protect what we hold, and we describe them in terms rather than in detail — a public inventory of exactly how a system is defended is useful mainly to the people it is defended against.

• Everything between your browser and the application travels encrypted.
• Passwords are stored hashed, never in a form anyone here can read.
• Accounts see only their own events. Access is checked on every request rather than hidden in the interface.
• Administrator actions against client data are recorded.
• Two-factor authentication is available, and required for staff accounts.

No system is perfectly secure and we will not tell you otherwise. We keep improving this, and if something ever goes wrong that affects you, you will hear it from us.

7. How long we keep it, and how to have it deleted

We keep your account and your events for as long as you have an account with us. There is no automatic deletion schedule — we would rather say that than quote a retention period the software does not enforce.

Ask us and we will delete it. Write to info@echocards.co.tz and say what you want removed — a single guest list, one event, or your whole account. We will do it and confirm when it is done. Records we are required to keep for tax or accounting purposes are the exception, and we will tell you which those are.

8. Your rights

Under the Personal Data Protection Act 2022 you may ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete it, subject to section 7.
• Stop a particular use of it.
• Export it in a form you can take elsewhere.

There is no charge and no form. Write to us and a person will answer. If you are a guest rather than a client and you want your details removed, you can write to us directly — we will act on it and tell the client whose list it was.

9. Cookies

The site sets what it needs to keep you signed in and to remember your language and theme. Anything beyond that is asked for first, through the notice at the foot of the page, and you can change your answer at any time from the Cookie settings link in the footer. Saying no costs you nothing: the site works the same either way.

10. Children

Echo Cards is for people organising events and is not directed at children. We do not knowingly collect account details from anyone under 18.

11. Changes to this policy

If this policy changes in a way that affects you, we will say so on this page and move the date at the top. Material changes to how we handle guest data will also be sent to account holders by email rather than only posted here.