Privacy Policy

Echo Archive is a platform for artists and galleries to document artworks, organise their practice, manage exhibitions and related activity.

Echo Archive is operated by Brains & Brawn Studio Limited (“Echo Archive”, “we”, “us” or “our”).

For the purposes of UK data protection law, we are the controller of personal information described in this policy, except where we process information solely on behalf of another organisation.

We collect only the information we need to provide, maintain and improve Echo Archive.

Account information

When you create an account, we may collect information such as:

• Your name
• Your email address
• Your profile image, if provided
• Your account or workspace information
• Whether you are using Echo Archive as an artist, gallery or other organisation

Information you add to Echo Archive

The platform allows you to create and store information connected with your work or organisation. Depending on how you use Echo Archive, this may include:

• Artwork images and files
• Artwork titles, descriptions and metadata
• Notes and working records
• Progress and version history
• Collections and editions
• Exhibition information
• Installation and wall plans
• Contacts and collector information
• Sales and pricing records
• Calendar events and tasks
• Open-call submissions, reviews and related information
• Other information you choose to add to your archive or workspace

Technical information

When you use Echo Archive, our systems may process basic technical information needed to operate and secure the service. This may include your IP address, browser or device information, request logs, login activity and error information.

Uploading artwork, images, documents or other material to Echo Archive does not transfer ownership of that material to us.

You retain your rights in the content you add to Echo Archive. We process and store that content only as necessary to provide the platform and the features you choose to use.

Content in your private archive is not made public simply because it has been uploaded to Echo Archive. Where Echo Archive provides sharing or public-profile features, you control what you choose to make available through those features.

We do not use your artwork, images, notes or other archive content to train artificial intelligence or machine-learning models.

We also do not run AI or so-called “smart” features over your artwork or private archive content without your knowledge.

Your archive exists to serve you and your practice. It is not a training dataset.

Echo Archive currently supports sign-in by email and Google.

Email sign-in

If you sign in using your email address, we use that address to identify your account and send the authentication message required for you to access Echo Archive.

Echo Archive does not need to store a traditional account password when passwordless email authentication is used.

Google sign-in

If you choose to sign in with Google, Google authenticates your identity and provides us with the account information required to create or access your Echo Archive account. This will typically include your Google account identifier, name, email address and, where available, profile image.

We do not receive your Google password.

Google's processing of information during authentication is governed by Google's own privacy terms and policies.

We use personal information where necessary to operate Echo Archive and provide the service you have requested.

This includes using information to:

• Create and manage your account
• Authenticate you securely
• Store and display your archive and workspace content
• Provide artist and gallery functionality
• Process actions you request within the platform
• Maintain the reliability and security of Echo Archive
• Diagnose technical problems and prevent misuse
• Respond when you contact us for help
• Send important service or account communications
• Comply with our legal obligations

We do not sell your personal information.

We do not sell your artwork or archive data.

We do not share your personal information with advertisers for targeted advertising.

Under UK data protection law, we need a lawful basis for processing personal information.

Depending on the circumstances, we generally rely on:

• Contract — where processing is necessary to create your account and provide Echo Archive to you.
• Legitimate interests — where necessary to operate, protect, maintain and improve the service, provided those interests are not overridden by your rights.
• Legal obligation — where we are required to process or retain information by law.
• Consent — where we specifically ask for your consent and consent is the appropriate legal basis.

We do not sell your information and we do not share it with third parties for their own advertising or marketing purposes.

Some information may be processed by service providers where this is necessary to operate Echo Archive. For example, infrastructure may be required for hosting, data storage, authentication or delivering transactional email.

These providers process information only for the purpose of providing the relevant service to us and are not given permission by us to use your private archive for their own purposes.

If you choose Google sign-in, relevant information is also exchanged with Google as described in the sign-in section above.

We may also disclose information where we are legally required to do so, where necessary to protect the security or integrity of Echo Archive, or in connection with a legitimate corporate transaction subject to appropriate safeguards.

Echo Archive may use cookies or similar browser storage where necessary to keep you signed in, maintain your session, remember essential application state and protect the security of your account.

We do not use advertising cookies to build advertising profiles about you.

Where we introduce any non-essential cookie or tracking technology that requires consent, we will request that consent before using it.

We take reasonable technical and organisational measures designed to protect your information against unauthorised access, loss, alteration or disclosure.

No internet service can guarantee absolute security. We therefore continually consider how Echo Archive stores and handles information and take proportionate measures to protect it.

Where service providers process information outside the United Kingdom, we take appropriate steps where required by data protection law to protect that information.

We keep personal information for as long as it is reasonably necessary to provide Echo Archive, maintain your account and meet our legal obligations.

If you close your account or request deletion, we will delete or anonymise personal information that we no longer need, subject to information we are required or permitted to retain for legal, security, accounting, dispute-resolution or backup purposes.

Backup copies may remain for a limited period before being overwritten as part of our normal backup cycle.

Depending on the circumstances, UK data protection law gives you rights in relation to your personal information. These may include the right to:

• Ask what personal information we hold about you
• Receive a copy of your personal information
• Correct inaccurate or incomplete information
• Ask us to delete your personal information
• Ask us to restrict how information is used
• Object to certain types of processing
• Receive certain information in a portable format
• Withdraw consent where processing is based on consent

These rights are not absolute and may depend on the circumstances and the legal basis on which information is being processed.

To exercise a privacy right, contact us using the details below. We may need to verify your identity before completing a request.

If you are in the United Kingdom, you also have the right to raise a concern with the Information Commissioner's Office (ICO). Information about doing so is available at ico.org.uk.

Echo Archive is intended as a professional platform for artists, galleries and arts organisations. It is not designed as a service directed at children.

If you believe a child has provided personal information to Echo Archive in circumstances where they should not have done so, please contact us.

We may update this Privacy Policy as Echo Archive develops or where legal requirements change.

When we make changes, we will update the “Last updated” date at the top of this page. Where a change materially affects how we handle your information, we will take reasonable steps to bring it to your attention.

If you have a question about this Privacy Policy, your personal information or how Echo Archive handles privacy, please contact:

Brains & Brawn Studio Limited
Echo Archive
Email: team@echoarchive.art