EKHO — Privacy Policy

Last updated: March 2026

EKHO, Sociedade Unipessoal, Lda, a company registered in Portugal (NIF: 519205073) ("EKHO", "we", "us") is committed to protecting your privacy and handling personal data responsibly. This Privacy Policy explains what data we collect, why we collect it, how we use it, who we share it with, and the choices and rights you have.

This Policy applies to the EKHO mobile app, the EKHO website at ekhoapp.com, and related services (together, the "Service").

Controller. For GDPR purposes, EKHO is the data controller for the processing described in this Policy.

Contact: privacy@ekhoapp.com

1) Data we collect

1.1 Information you provide to us

Account data: phone number, name (if provided), username, profile photo, account preferences, and basic settings.

User Content: photos, videos, BOOTH sequences, and other content you choose to share within the app. Content you create but do not share remains on your device and is not collected by EKHO.

Profile content: Spotlights images you curate for your profile, and any other content you add to your public-facing profile.

Communications: messages you send through the Service (where messaging exists), and communications with us (support emails, reports, complaints).

Artist/promoter account data: if you create an artist or promoter account, we collect additional information necessary to manage events and process payments, including event details you provide and your payment provider account identifier.

1.2 Payment and transaction data

When you purchase a ticket or sell tickets through the Service, we collect transaction information including the items purchased, transaction amount, date, and a transaction reference. Payment card details are collected and processed directly by our third-party payment provider and are not stored by EKHO. For artists and promoters receiving payouts, we process payout amounts and related transaction records.

1.3 Information collected automatically

Device and app data: device type, operating system version, app version, language, time zone, device identifiers and/or app instance identifiers, and technical logs.

Usage data: actions taken in the app (e.g., creating or joining EKHOs, viewing events, purchasing tickets), approximate interaction timestamps, and diagnostic events.

Proximity interaction data: when you use the device-proximity feature to create or join an EKHO, we process limited technical data necessary to establish the connection. We do not store proximity data beyond the session or use it for tracking purposes.

1.4 Location data (only if you enable it)

If you grant permission, we may process approximate or precise location depending on your device settings, to support features such as Concert Mode and event-related experiences (see Section 3).

2) Special note about public content and other people's data

EKHO is a social app. If you post content publicly, it may be visible to other users according to your settings and the features you use. You are responsible for what you choose to upload and share.

If you upload content that includes other people (faces/voices) or personal information, you must have a lawful basis to share it. We may remove or restrict content on privacy grounds where appropriate (see Section 9).

3) How we use location data

When enabled, location supports live-event functionality:

• Concert Mode detection: to detect when you are at or near an event/venue, and enable event-specific features.
• Event features: to help you access event-related content and experiences.

Your control: You can disable location at any time in your device settings.
No ad sharing: We do not sell your location data and do not share it with third parties for behavioural advertising.

We aim to minimise location processing to what is reasonably necessary for these features.

4) Why we process your data (purposes) and our legal bases (GDPR)

4.1 Providing the Service (Contract necessity — GDPR Art. 6(1)(b))

• Create and manage accounts
• Enable core social features (posting, viewing, following, interactions)
• Provide customer support
• Maintain basic functionality and reliability

4.2 Safety, security, and integrity (Legitimate interests — Art. 6(1)(f); sometimes Legal obligation — Art. 6(1)(c))

• Prevent fraud, spam, and misuse
• Protect users and the Service
• Enforce our Terms of Use
• Investigate reports and violations
• Maintain logs necessary for security and auditing

4.3 Location-based features (Consent — Art. 6(1)(a))

Concert Mode and event-related experiences
You may withdraw consent at any time by disabling location permissions.

4.4 Communications and notifications (Legitimate interests and/or Consent)

• Service messages (security alerts, account notices)
• Optional push notifications (you can control these in device/app settings)

4.5 Legal compliance (Legal obligation — Art. 6(1)(c))

• Comply with lawful requests from authorities
• Respond to claims, disputes, and legal proceedings

4.6 Product improvement and analytics (Legitimate interests — Art. 6(1)(f))

• Understand usage patterns
• Fix bugs and improve performance

Where appropriate, we use aggregated or pseudonymised data.

Balancing test: Where we rely on legitimate interests, we consider the impact on your rights and implement safeguards (data minimisation, security controls, access limitations).

5) How we share data (and what we never do)

5.1 We do not sell your personal data

We do not sell personal data.

5.2 We share data only as necessary

We may share personal data with:

• Service providers (processors): hosting/cloud infrastructure, content delivery, analytics, crash reporting, customer support tools and push notification services — strictly to operate the Service under contractual confidentiality and security obligations.
• Other users: when you make content public or interact in ways that reveal information (e.g., comments, profiles, public posts), subject to your settings.
• Legal and safety disclosures: where required by law, or where reasonably necessary to protect rights, safety and security.

5.3 Third-party links (ticketing and external services)

EKHO may link to ticketing providers and other external sites. Those third parties process data under their own policies. EKHO is not responsible for third-party privacy practices.

6) Content storage and visibility

Your content is stored on secure cloud infrastructure. Visibility depends on your in-app settings and the features you use.

Please remember: if you share content publicly, other users can view it, and they may copy, share, or screenshot it. EKHO cannot guarantee third parties will not do so.

7) Data retention

We retain personal data only for as long as needed for the purposes described in this Policy, including:

• Active account: we retain core account data and content while your account remains active.
• Deletion requests: when you delete your account, we delete or de-identify personal data within a reasonable period, except where retention is necessary for legal compliance, security and fraud prevention, dispute resolution, enforcing our terms or technical backup integrity (limited retention).

We may retain aggregated or anonymised analytics data that does not identify you.

8) Your rights (GDPR)

If you are in the EU/EEA (and in many other jurisdictions), you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (subject to legal exceptions)
• Restrict processing in certain cases
• Data portability (for data you provided, in certain cases)
• Object to processing based on legitimate interests
• Withdraw consent at any time (where processing is based on consent)

To exercise rights: privacy@ekhoapp.com

Response time: We aim to respond within one month; this may be extended by up to two additional months for complex requests, as permitted by GDPR.

9) Reporting privacy violations and content involving you

If you appear in content on EKHO and believe it violates your privacy, image rights, or personal data rights, you can report it:

• In-app: "•••" → Report
• Email: complaints@ekhoapp.com (include link/screenshot + reason)

We may restrict or remove content to reduce harm, particularly where consent is unclear or sensitive circumstances apply.

10) Security

We use administrative, technical, and organisational safeguards designed to protect personal data (e.g., encryption in transit, access controls, and security practices). However, no system is completely secure, and we cannot guarantee absolute security.

11) Children's privacy

EKHO is not intended for children under 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected such data, we will take steps to delete it.

12) International transfers

Your data may be processed in countries other than your own (including outside the EU/EEA), depending on where our service providers operate.

Where required, we use appropriate safeguards for international transfers (such as Standard Contractual Clauses and other lawful mechanisms).

13) Complaints to a supervisory authority (Portugal / EU)

If you are in the EU/EEA, you have the right to lodge a complaint with your local data protection authority. In Portugal, this is the CNPD (Comissão Nacional de Proteção de Dados).

We encourage you to contact us first at privacy@ekhoapp.com, so we can try to resolve your concern quickly.

14) Changes to this Policy

We may update this Policy from time to time. If changes are material, we will provide notice (e.g., in-app). The "Last updated" date at the top shows when it was last revised.

15) Contact

For privacy questions or rights requests: privacy@ekhoapp.com

For content reports/takedown and appeals: complaints@ekhoapp.com