rstillwell/echos-ocr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add privacy policy and terms of service pages

Browse source 
- Create comprehensive privacy policy covering all data categories:
  account info, org data, scanned card PII (20+ field types),
  AI processing (OpenAI via Vercel AI Gateway), subprocessors
  (Supabase, Vercel, Upstash, Brevo), configurable retention,
  data controller/processor roles, and individual rights
- Create terms of service covering eligibility, accounts, acceptable
  use, data responsibilities, subscriptions/billing, free tier,
  IP, third-party integrations, availability, liability limitation,
  indemnification, termination, and governing law
- Add /privacy and /terms to middleware public paths
- Update footer links from placeholder # hrefs to actual pages
- Add metadata layouts for both pages

Made-with: Cursor
This commit is contained in:
Randall Stillwell 2026-04-16 20:53:25 -05:00
parent 7ab2fe6894
commit 2c765e05c4
6 changed files with 998 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
src/app/(marketing)/privacy/layout.tsx Normal file
View file

@ -0,0 +1,17 @@
import type { Metadata } from "next";
export const metadata: Metadata = {
title: "Privacy Policy",
description:
"Learn how Echo collects, uses, stores, and protects personal data — including scanned card information, account data, and third-party integrations.",
openGraph: {
title: "Privacy Policy | Echo",
description:
"How Echo handles your congregation's data — collection, AI processing, storage, retention, and your rights.",
images: ["/og-image.png"],
},
};
export default function PrivacyLayout({ children }: { children: React.ReactNode }) {
return <>{children}</>;
}

510
src/app/(marketing)/privacy/page.tsx Normal file
View file

@ -0,0 +1,510 @@
"use client";
import Link from "next/link";
import { Shield } from "lucide-react";
import { MarketingNav } from "@/components/marketing/nav";
import { MarketingFooter } from "@/components/marketing/footer";
function Section({
id,
title,
children,
}: {
id: string;
title: string;
children: React.ReactNode;
}) {
return (
<section id={id} className="scroll-mt-24">
<h2 className="text-xl font-bold tracking-tight mb-4">{title}</h2>
<div className="space-y-4 text-[15px] leading-relaxed text-muted-foreground">
{children}
</div>
</section>
);
}
const EFFECTIVE_DATE = "April 16, 2026";
export default function PrivacyPolicyPage() {
return (
<div className="min-h-screen bg-background">
<MarketingNav />
{/* Hero */}
<section className="relative pt-32 pb-12 sm:pt-40 sm:pb-16 overflow-hidden">
<div className="absolute inset-0 gradient-mesh pointer-events-none" />
<div className="relative mx-auto max-w-3xl px-6 text-center">
<div className="inline-flex items-center gap-2 rounded-full border border-border/60 bg-card/60 px-4 py-1.5 text-xs font-medium text-muted-foreground mb-8 glass">
<Shield className="h-3.5 w-3.5" />
Your data, your trust
</div>
<h1 className="text-3xl sm:text-4xl font-bold tracking-tight leading-[1.1] mb-4">
Privacy Policy
</h1>
<p className="text-muted-foreground">
Effective {EFFECTIVE_DATE}
</p>
</div>
</section>
{/* Body */}
<article className="mx-auto max-w-3xl px-6 pb-24 space-y-12">
{/* Intro */}
<div className="text-[15px] leading-relaxed text-muted-foreground space-y-4">
<p>
Echo (&ldquo;we,&rdquo; &ldquo;us,&rdquo; or &ldquo;our&rdquo;) provides
AI-powered response card scanning for churches, ministries, and nonprofits.
This Privacy Policy explains how we collect, use, store, and protect personal
information when you use the Echo platform at{" "}
<Link href="/welcome" className="underline hover:text-foreground">
echoocr.com
</Link>{" "}
(the &ldquo;Service&rdquo;).
</p>
<p>
We take the protection of your congregation&rsquo;s personal data seriously. Many of the
individuals whose information flows through Echo &mdash; first-time guests, prayer
request submitters, families &mdash; have entrusted that data to your church.
We treat it with the same care you do.
</p>
</div>
{/* TOC */}
<nav className="rounded-xl border border-border/50 bg-card/40 p-6 glass-card">
<h2 className="text-sm font-semibold mb-3">Contents</h2>
<ol className="grid sm:grid-cols-2 gap-x-8 gap-y-1.5 text-sm text-muted-foreground list-decimal list-inside">
{[
["#information-we-collect", "Information We Collect"],
["#how-we-use", "How We Use Your Information"],
["#ai-processing", "AI Processing & OCR"],
["#third-party-integrations", "Third-Party Integrations"],
["#subprocessors", "Subprocessors"],
["#data-storage", "Data Storage & Security"],
["#data-retention", "Data Retention & Deletion"],
["#your-rights", "Your Rights"],
["#children", "Children\u2019s Privacy"],
["#international", "International Data"],
["#changes", "Changes to This Policy"],
["#contact", "Contact Us"],
].map(([href, label]) => (
<li key={href}>
<a href={href} className="hover:text-foreground transition-colors">
{label}
</a>
</li>
))}
</ol>
</nav>
{/* 1 */}
<Section id="information-we-collect" title="1. Information We Collect">
<h3 className="text-base font-semibold text-foreground mt-2">
a) Account Information
</h3>
<p>
When you create an Echo account, we collect your <strong>display name</strong>,{" "}
<strong>email address</strong>, and a <strong>password</strong> (stored as a
bcrypt hash &mdash; we never store passwords in plain text). If you sign in via
single sign-on (SSO/OIDC), we receive a unique identifier and email from your
identity provider.
</p>
<h3 className="text-base font-semibold text-foreground mt-6">
b) Organization & Team Data
</h3>
<p>
Organization administrators provide an <strong>organization name</strong>,{" "}
<strong>type</strong> (e.g., church), <strong>timezone</strong>, and optionally{" "}
<strong>allowed email domains</strong> for auto-join. Team member records include
the member&rsquo;s role (owner, admin, editor, reviewer, or viewer) and the date
they joined.
</p>
<h3 className="text-base font-semibold text-foreground mt-6">
c) Scanned Card Data (Congregation PII)
</h3>
<p>
This is the most sensitive category. When your team scans or uploads response
cards, our AI extracts fields that may include:
</p>
<ul className="list-disc list-inside space-y-1 ml-2">
<li>Full name, gender, date of birth, marital status</li>
<li>Email address, cell phone, home phone</li>
<li>Mailing address (street, apartment, city, state, ZIP)</li>
<li>Prayer requests (including confidential flags)</li>
<li>Spiritual decisions and next steps (e.g., baptism, salvation)</li>
<li>Visit type, attendance history, campus preferences</li>
<li>How the visitor heard about your church</li>
<li>Service time attended, message topics of interest</li>
</ul>
<p>
We also store the <strong>original scanned images</strong> (PDF, JPEG, PNG) and{" "}
<strong>processed front/back card images</strong> in encrypted object storage.
</p>
<h3 className="text-base font-semibold text-foreground mt-6">
d) Usage & Technical Data
</h3>
<p>
We collect standard server logs including IP addresses, browser user-agent
strings, page views, and timestamps. We use this data for security monitoring,
performance optimization, and debugging &mdash; not for advertising.
</p>
</Section>
{/* 2 */}
<Section id="how-we-use" title="2. How We Use Your Information">
<p>We use the information we collect to:</p>
<ul className="list-disc list-inside space-y-1 ml-2">
<li>
<strong>Provide the Service</strong> &mdash; process scanned cards with AI OCR,
display results in your dashboard, and sync data to your integrations
</li>
<li>
<strong>Authenticate and authorize</strong> &mdash; verify your identity,
manage team roles, and enforce permissions
</li>
<li>
<strong>Send transactional emails</strong> &mdash; email verification,
team invitations, and service notices (we do not send marketing emails)
</li>
<li>
<strong>Maintain and improve the Service</strong> &mdash; fix bugs, monitor
performance, and develop new features
</li>
<li>
<strong>Enforce our Terms</strong> &mdash; detect abuse and protect the
security of the platform
</li>
</ul>
<p>
We <strong>never</strong> sell personal data. We do <strong>not</strong> use
your congregation&rsquo;s scanned card data to train AI models, build advertising
profiles, or for any purpose other than providing the Service to your organization.
</p>
</Section>
{/* 3 */}
<Section id="ai-processing" title="3. AI Processing & OCR">
<p>
Echo uses vision AI models to extract text and structured data from scanned
card images. When a card is processed:
</p>
<ul className="list-disc list-inside space-y-1 ml-2">
<li>
The card image is sent to an AI model provider (by default,{" "}
<strong>OpenAI via the Vercel AI Gateway</strong>) along with a structured
extraction prompt
</li>
<li>
The AI returns structured field data (name, email, prayer requests, etc.)
which is stored in your organization&rsquo;s database
</li>
<li>
Self-hosted organizations may configure a local <strong>Ollama</strong> instance
for fully on-premises processing, meaning card images never leave your network
</li>
</ul>
<p>
We use OpenAI&rsquo;s API, which, per their enterprise data use policies, does
not use API inputs to train their models. The Vercel AI Gateway acts as a
routing proxy and does not persistently store your image data.
</p>
</Section>
{/* 4 */}
<Section id="third-party-integrations" title="4. Third-Party Integrations">
<p>
Echo can send scanned card data to external services <strong>that you
explicitly configure</strong>. No data is sent to third parties unless your
organization enables an integration. Available integrations include:
</p>
<div className="overflow-x-auto">
<table className="w-full text-sm border border-border/50 rounded-lg overflow-hidden">
<thead>
<tr className="bg-muted/30">
<th className="text-left p-3 font-semibold text-foreground">Integration</th>
<th className="text-left p-3 font-semibold text-foreground">Data Sent</th>
</tr>
</thead>
<tbody className="divide-y divide-border/30">
<tr>
<td className="p-3 font-medium text-foreground">Planning Center</td>
<td className="p-3">Name, email, phone, gender &mdash; used to match or create people records and manage list membership</td>
</tr>
<tr>
<td className="p-3 font-medium text-foreground">Google Sheets</td>
<td className="p-3">Mapped card fields appended as rows to your specified spreadsheet</td>
</tr>
<tr>
<td className="p-3 font-medium text-foreground">Monday.com</td>
<td className="p-3">Mapped card fields as board item columns; optionally card images as file attachments</td>
</tr>
<tr>
<td className="p-3 font-medium text-foreground">Airtable</td>
<td className="p-3">Mapped card fields as Airtable record fields</td>
</tr>
<tr>
<td className="p-3 font-medium text-foreground">Webhooks</td>
<td className="p-3">Full card data as JSON payload to your specified URL, with optional HMAC-SHA256 signature verification</td>
</tr>
<tr>
<td className="p-3 font-medium text-foreground">CSV Export</td>
<td className="p-3">Downloadable file generated locally &mdash; no data sent to external servers</td>
</tr>
</tbody>
</table>
</div>
<p>
Each integration uses <strong>your own credentials</strong> (OAuth tokens, API
keys, or personal access tokens) and field mappings that you control. You can
disable any integration at any time.
</p>
</Section>
{/* 5 */}
<Section id="subprocessors" title="5. Subprocessors">
<p>
We use the following third-party services to operate Echo:
</p>
<div className="overflow-x-auto">
<table className="w-full text-sm border border-border/50 rounded-lg overflow-hidden">
<thead>
<tr className="bg-muted/30">
<th className="text-left p-3 font-semibold text-foreground">Provider</th>
<th className="text-left p-3 font-semibold text-foreground">Purpose</th>
<th className="text-left p-3 font-semibold text-foreground">Data Processed</th>
</tr>
</thead>
<tbody className="divide-y divide-border/30">
<tr>
<td className="p-3 font-medium text-foreground">Supabase</td>
<td className="p-3">Managed PostgreSQL database and S3-compatible object storage</td>
<td className="p-3">All application data, card images, and uploaded files</td>
</tr>
<tr>
<td className="p-3 font-medium text-foreground">Vercel</td>
<td className="p-3">Application hosting, edge network, and AI Gateway</td>
<td className="p-3">HTTP requests, server-side rendering, AI API routing</td>
</tr>
<tr>
<td className="p-3 font-medium text-foreground">OpenAI</td>
<td className="p-3">AI vision model for OCR extraction (via Vercel AI Gateway)</td>
<td className="p-3">Card images and extraction prompts (not used for model training)</td>
</tr>
<tr>
<td className="p-3 font-medium text-foreground">Upstash</td>
<td className="p-3">QStash message queue for async job processing</td>
<td className="p-3">Job IDs and processing metadata (no card PII)</td>
</tr>
<tr>
<td className="p-3 font-medium text-foreground">Brevo</td>
<td className="p-3">Transactional email delivery</td>
<td className="p-3">Recipient email addresses and email content (verification links, invitations)</td>
</tr>
</tbody>
</table>
</div>
</Section>
{/* 6 */}
<Section id="data-storage" title="6. Data Storage & Security">
<p>We implement multiple layers of security to protect your data:</p>
<ul className="list-disc list-inside space-y-1 ml-2">
<li>
<strong>Encryption in transit</strong> &mdash; all connections use TLS/HTTPS
</li>
<li>
<strong>Encryption at rest</strong> &mdash; database and object storage are
encrypted at rest via our infrastructure providers (Supabase, AWS)
</li>
<li>
<strong>Password security</strong> &mdash; passwords are hashed using bcrypt
with a cost factor of 12; we never store or log plain-text passwords
</li>
<li>
<strong>Role-based access control</strong> &mdash; five permission tiers
(owner, admin, editor, reviewer, viewer) restrict who can view, edit,
delete, and export card data within your organization
</li>
<li>
<strong>Invitation-only teams</strong> &mdash; team members must be explicitly
invited by an admin or owner; optional domain-based auto-join
</li>
<li>
<strong>Email verification</strong> &mdash; required to confirm account
ownership
</li>
<li>
<strong>API key security</strong> &mdash; API keys are stored as hashes with
only a short prefix visible; keys can be scoped with specific permissions and
expiration dates
</li>
<li>
<strong>Webhook signatures</strong> &mdash; outbound webhook payloads can be
signed with HMAC-SHA256 so you can verify authenticity
</li>
<li>
<strong>Job queue verification</strong> &mdash; async processing jobs verify
Upstash cryptographic signatures before execution
</li>
</ul>
</Section>
{/* 7 */}
<Section id="data-retention" title="7. Data Retention & Deletion">
<h3 className="text-base font-semibold text-foreground mt-2">
Configurable Retention
</h3>
<p>
Organization administrators can configure retention periods for:
</p>
<ul className="list-disc list-inside space-y-1 ml-2">
<li>
<strong>Source uploads</strong> (original PDFs/images) &mdash; default 30 days
</li>
<li>
<strong>Card images</strong> (processed front/back images) &mdash; default 180
days
</li>
</ul>
<p>
When retention periods expire, files are permanently deleted from object
storage. The structured data extracted from cards (names, contact info, etc.)
is retained in the database until explicitly deleted.
</p>
<h3 className="text-base font-semibold text-foreground mt-6">
Manual Deletion
</h3>
<p>
Organization admins and owners can delete individual cards at any time. Deletion
removes the database record <strong>and</strong> all associated images from
object storage permanently. Deleted data cannot be recovered.
</p>
<h3 className="text-base font-semibold text-foreground mt-6">
Account Deletion
</h3>
<p>
To request deletion of your account and all associated data, please contact us
at{" "}
<a href="mailto:privacy@echoocr.com" className="underline hover:text-foreground">
privacy@echoocr.com
</a>
. We will process deletion requests within 30 days.
</p>
</Section>
{/* 8 */}
<Section id="your-rights" title="8. Your Rights">
<p>
Depending on your jurisdiction, you may have the right to:
</p>
<ul className="list-disc list-inside space-y-1 ml-2">
<li>
<strong>Access</strong> &mdash; request a copy of the personal data we hold
about you
</li>
<li>
<strong>Correction</strong> &mdash; request correction of inaccurate data
</li>
<li>
<strong>Deletion</strong> &mdash; request deletion of your personal data
</li>
<li>
<strong>Data portability</strong> &mdash; export your data via CSV export or
the API
</li>
<li>
<strong>Restriction</strong> &mdash; request that we limit processing of your
data
</li>
<li>
<strong>Objection</strong> &mdash; object to processing of your data for
certain purposes
</li>
</ul>
<p>
For scanned card data (congregation PII), your church or organization is the{" "}
<strong>data controller</strong>. Echo acts as a <strong>data processor</strong>{" "}
on behalf of your organization. Individuals whose data appears on scanned cards
should direct access, correction, or deletion requests to the church or
organization that collected their information.
</p>
<p>
To exercise your rights regarding your Echo account, contact us at{" "}
<a href="mailto:privacy@echoocr.com" className="underline hover:text-foreground">
privacy@echoocr.com
</a>
.
</p>
</Section>
{/* 9 */}
<Section id="children" title="9. Children&rsquo;s Privacy">
<p>
Echo is not directed at children under 13. We do not knowingly collect personal
information from children under 13. Scanned response cards may occasionally
contain information about minors (e.g., children&rsquo;s ministry forms).
This data is processed under the authority and responsibility of the
organization that collected it.
</p>
<p>
If you believe we have inadvertently collected information from a child under 13
without appropriate consent, please contact us immediately at{" "}
<a href="mailto:privacy@echoocr.com" className="underline hover:text-foreground">
privacy@echoocr.com
</a>
.
</p>
</Section>
{/* 10 */}
<Section id="international" title="10. International Data">
<p>
Echo&rsquo;s infrastructure is hosted in the United States. If you access the
Service from outside the United States, your data will be transferred to and
processed in the United States. By using the Service, you consent to this
transfer.
</p>
</Section>
{/* 11 */}
<Section id="changes" title="11. Changes to This Policy">
<p>
We may update this Privacy Policy from time to time. If we make material
changes, we will notify you by posting a prominent notice on the Service or
sending you an email. Your continued use of the Service after changes take
effect constitutes acceptance of the revised policy.
</p>
</Section>
{/* 12 */}
<Section id="contact" title="12. Contact Us">
<p>
If you have questions about this Privacy Policy or our data practices, please
contact us:
</p>
<ul className="list-none space-y-1 ml-2">
<li>
Email:{" "}
<a href="mailto:privacy@echoocr.com" className="underline hover:text-foreground">
privacy@echoocr.com
</a>
</li>
<li>
General support:{" "}
<a href="mailto:support@echoocr.com" className="underline hover:text-foreground">
support@echoocr.com
</a>
</li>
</ul>
</Section>
</article>
<MarketingFooter />
</div>
);
}

17
src/app/(marketing)/terms/layout.tsx Normal file
View file

@ -0,0 +1,17 @@
import type { Metadata } from "next";
export const metadata: Metadata = {
title: "Terms of Service",
description:
"Terms governing your use of the Echo platform — accounts, data responsibilities, subscriptions, acceptable use, and liability.",
openGraph: {
title: "Terms of Service | Echo",
description:
"Terms governing your use of Echo — accounts, data responsibilities, subscriptions, and acceptable use.",
images: ["/og-image.png"],
},
};
export default function TermsLayout({ children }: { children: React.ReactNode }) {
return <>{children}</>;
}

450
src/app/(marketing)/terms/page.tsx Normal file
View file

@ -0,0 +1,450 @@
"use client";
import Link from "next/link";
import { FileText } from "lucide-react";
import { MarketingNav } from "@/components/marketing/nav";
import { MarketingFooter } from "@/components/marketing/footer";
function Section({
id,
title,
children,
}: {
id: string;
title: string;
children: React.ReactNode;
}) {
return (
<section id={id} className="scroll-mt-24">
<h2 className="text-xl font-bold tracking-tight mb-4">{title}</h2>
<div className="space-y-4 text-[15px] leading-relaxed text-muted-foreground">
{children}
</div>
</section>
);
}
const EFFECTIVE_DATE = "April 16, 2026";
export default function TermsOfServicePage() {
return (
<div className="min-h-screen bg-background">
<MarketingNav />
{/* Hero */}
<section className="relative pt-32 pb-12 sm:pt-40 sm:pb-16 overflow-hidden">
<div className="absolute inset-0 gradient-mesh pointer-events-none" />
<div className="relative mx-auto max-w-3xl px-6 text-center">
<div className="inline-flex items-center gap-2 rounded-full border border-border/60 bg-card/60 px-4 py-1.5 text-xs font-medium text-muted-foreground mb-8 glass">
<FileText className="h-3.5 w-3.5" />
Legal
</div>
<h1 className="text-3xl sm:text-4xl font-bold tracking-tight leading-[1.1] mb-4">
Terms of Service
</h1>
<p className="text-muted-foreground">
Effective {EFFECTIVE_DATE}
</p>
</div>
</section>
{/* Body */}
<article className="mx-auto max-w-3xl px-6 pb-24 space-y-12">
{/* Intro */}
<div className="text-[15px] leading-relaxed text-muted-foreground space-y-4">
<p>
These Terms of Service (&ldquo;Terms&rdquo;) govern your access to and use of the
Echo platform (&ldquo;Service&rdquo;), operated by Echo (&ldquo;we,&rdquo;
&ldquo;us,&rdquo; or &ldquo;our&rdquo;). By creating an account or using the
Service, you agree to be bound by these Terms.
</p>
<p>
If you are using the Service on behalf of a church, ministry, nonprofit, or other
organization, you represent that you have the authority to bind that organization
to these Terms, and &ldquo;you&rdquo; refers to both you individually and the
organization.
</p>
</div>
{/* TOC */}
<nav className="rounded-xl border border-border/50 bg-card/40 p-6 glass-card">
<h2 className="text-sm font-semibold mb-3">Contents</h2>
<ol className="grid sm:grid-cols-2 gap-x-8 gap-y-1.5 text-sm text-muted-foreground list-decimal list-inside">
{[
["#service-description", "Description of Service"],
["#eligibility", "Eligibility"],
["#accounts", "Accounts & Access"],
["#acceptable-use", "Acceptable Use"],
["#your-data", "Your Data & Responsibility"],
["#data-processing", "Data Processing"],
["#subscriptions", "Subscriptions & Billing"],
["#free-tier", "Free Tier"],
["#intellectual-property", "Intellectual Property"],
["#integrations", "Third-Party Integrations"],
["#availability", "Service Availability"],
["#limitation", "Limitation of Liability"],
["#indemnification", "Indemnification"],
["#termination", "Termination"],
["#changes", "Changes to These Terms"],
["#governing-law", "Governing Law"],
["#contact", "Contact Us"],
].map(([href, label]) => (
<li key={href}>
<a href={href} className="hover:text-foreground transition-colors">
{label}
</a>
</li>
))}
</ol>
</nav>
{/* 1 */}
<Section id="service-description" title="1. Description of Service">
<p>
Echo is a cloud-based platform that uses artificial intelligence to extract
structured data from scanned response cards, guest cards, prayer request forms,
and similar paper documents. The Service includes:
</p>
<ul className="list-disc list-inside space-y-1 ml-2">
<li>AI-powered optical character recognition (OCR) for handwritten and printed text</li>
<li>Document ingestion via web upload, email, and FTP</li>
<li>A team dashboard for reviewing, assigning, and managing extracted data</li>
<li>Integrations with third-party services (Planning Center, Google Sheets, Monday.com, Airtable, webhooks)</li>
<li>Collection day and event management</li>
<li>Multi-site organization support</li>
<li>Data export via CSV and API</li>
</ul>
</Section>
{/* 2 */}
<Section id="eligibility" title="2. Eligibility">
<p>
You must be at least 18 years old (or the age of majority in your jurisdiction)
to create an account. By using the Service, you represent that you meet this
requirement. The Service is designed for use by churches, ministries, nonprofits,
and similar organizations.
</p>
</Section>
{/* 3 */}
<Section id="accounts" title="3. Accounts & Access">
<p>
You are responsible for maintaining the confidentiality of your account
credentials and for all activity that occurs under your account. You agree to:
</p>
<ul className="list-disc list-inside space-y-1 ml-2">
<li>Provide accurate and complete registration information</li>
<li>Keep your password secure and not share it with others</li>
<li>Notify us immediately if you suspect unauthorized access to your account</li>
<li>Not create accounts for automated use without our prior written consent</li>
</ul>
<p>
Organization owners and administrators are responsible for managing team member
access, assigning appropriate roles, and removing members who should no longer
have access.
</p>
</Section>
{/* 4 */}
<Section id="acceptable-use" title="4. Acceptable Use">
<p>You agree not to:</p>
<ul className="list-disc list-inside space-y-1 ml-2">
<li>Use the Service for any unlawful purpose or in violation of any applicable law</li>
<li>Upload content that you do not have the right to process (e.g., cards collected without consent)</li>
<li>Attempt to gain unauthorized access to the Service, other users&rsquo; accounts, or our infrastructure</li>
<li>Interfere with or disrupt the integrity or performance of the Service</li>
<li>Reverse engineer, decompile, or disassemble any part of the Service</li>
<li>Use the Service to build a competing product</li>
<li>Resell or redistribute access to the Service without our written consent</li>
<li>Upload malicious files, malware, or content designed to exploit the system</li>
</ul>
<p>
We reserve the right to suspend or terminate accounts that violate these
restrictions.
</p>
</Section>
{/* 5 */}
<Section id="your-data" title="5. Your Data & Responsibility">
<p>
You retain all rights to the data you upload to the Service (&ldquo;Your
Data&rdquo;). This includes scanned card images, extracted text and structured
fields, and any other content you provide.
</p>
<p>
<strong>You are the data controller.</strong> As the organization using Echo, you
are responsible for:
</p>
<ul className="list-disc list-inside space-y-1 ml-2">
<li>
Ensuring you have appropriate consent or legal basis to collect and process the
personal information on scanned cards
</li>
<li>
Complying with applicable data protection laws (including GDPR, CCPA, state
privacy laws, and any church- or denomination-specific data policies)
</li>
<li>
Responding to data subject requests (access, correction, deletion) from
individuals whose information appears on scanned cards
</li>
<li>
Configuring appropriate data retention settings and deleting data when it is
no longer needed
</li>
</ul>
<p>
Echo acts as a <strong>data processor</strong> on your behalf. We process Your
Data only as necessary to provide the Service and in accordance with our{" "}
<Link href="/privacy" className="underline hover:text-foreground">
Privacy Policy
</Link>
.
</p>
</Section>
{/* 6 */}
<Section id="data-processing" title="6. Data Processing">
<p>
By using the Service, you authorize us to process Your Data as described in our{" "}
<Link href="/privacy" className="underline hover:text-foreground">
Privacy Policy
</Link>
, including:
</p>
<ul className="list-disc list-inside space-y-1 ml-2">
<li>
Transmitting card images to AI model providers for OCR extraction (by default,
OpenAI via the Vercel AI Gateway)
</li>
<li>
Storing Your Data on our infrastructure providers (Supabase for database and
object storage, Vercel for hosting)
</li>
<li>
Sending Your Data to third-party integrations that you have explicitly
configured (Planning Center, Google Sheets, etc.)
</li>
<li>
Using Brevo to deliver transactional emails to your team members
</li>
</ul>
<p>
We will not process Your Data for any purpose other than providing, maintaining,
and improving the Service. We will not sell, rent, or share Your Data with third
parties for their own purposes.
</p>
</Section>
{/* 7 */}
<Section id="subscriptions" title="7. Subscriptions & Billing">
<p>
Paid plans are billed on a monthly or annual basis as selected at the time of
purchase. By subscribing to a paid plan, you agree to pay the applicable fees.
</p>
<ul className="list-disc list-inside space-y-1 ml-2">
<li>
<strong>Billing cycle</strong> &mdash; charges are billed in advance at the
start of each billing period
</li>
<li>
<strong>Card limits</strong> &mdash; each plan includes a monthly card
processing allowance. Cards exceeding the limit are billed at the overage rate
specified in your plan ($0.08/card unless otherwise agreed)
</li>
<li>
<strong>Upgrades and downgrades</strong> &mdash; you may change your plan at
any time. Upgrades take effect immediately with prorated charges; downgrades
take effect at the next billing cycle
</li>
<li>
<strong>Cancellation</strong> &mdash; you may cancel your subscription at any
time. Cancellation takes effect at the end of the current billing period. No
refunds are provided for partial periods
</li>
<li>
<strong>Free trials</strong> &mdash; paid plans include a 14-day free trial.
If you do not cancel before the trial ends, you will be charged for the first
billing period
</li>
</ul>
<p>
We reserve the right to change pricing with 30 days&rsquo; notice. Price changes
will not affect your current billing period.
</p>
</Section>
{/* 8 */}
<Section id="free-tier" title="8. Free Tier">
<p>
Echo offers a free tier with limited features and a monthly card processing
cap. The free tier is provided &ldquo;as is&rdquo; and may be modified or
discontinued at any time with reasonable notice.
</p>
<p>
Free tier accounts that remain inactive (no cards processed, no logins) for
12 consecutive months may be subject to deletion after a 30-day notice email.
</p>
</Section>
{/* 9 */}
<Section id="intellectual-property" title="9. Intellectual Property">
<p>
The Service, including its design, code, features, documentation, and branding,
is owned by Echo and protected by intellectual property laws. These Terms do not
grant you any rights to our trademarks, logos, or brand assets.
</p>
<p>
You grant us a limited, non-exclusive license to use, store, and process Your
Data solely for the purpose of providing the Service. This license terminates
when you delete Your Data or close your account.
</p>
</Section>
{/* 10 */}
<Section id="integrations" title="10. Third-Party Integrations">
<p>
The Service allows you to connect to third-party services. Your use of those
services is governed by their own terms and privacy policies. We are not
responsible for the availability, accuracy, or practices of third-party services.
</p>
<p>
You are responsible for providing valid credentials and ensuring that your use of
integrations complies with the third party&rsquo;s terms. We may disable an
integration if it causes service instability or violates these Terms.
</p>
</Section>
{/* 11 */}
<Section id="availability" title="11. Service Availability">
<p>
We strive to maintain high availability but do not guarantee uninterrupted
access. The Service may be temporarily unavailable due to maintenance, updates,
or circumstances beyond our control.
</p>
<p>
Enterprise plans include a 99.9% uptime SLA. Details of the SLA, including
remedies for downtime, are provided in the Enterprise agreement.
</p>
<p>
We will make reasonable efforts to notify you of planned maintenance in advance.
</p>
</Section>
{/* 12 */}
<Section id="limitation" title="12. Limitation of Liability">
<p>
TO THE MAXIMUM EXTENT PERMITTED BY LAW, ECHO SHALL NOT BE LIABLE FOR ANY
INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS
OF PROFITS, DATA, OR GOODWILL, ARISING OUT OF OR RELATED TO YOUR USE OF THE
SERVICE.
</p>
<p>
OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS RELATED TO THE SERVICE SHALL NOT
EXCEED THE AMOUNT YOU PAID US IN THE 12 MONTHS PRECEDING THE CLAIM, OR $100,
WHICHEVER IS GREATER.
</p>
<p>
THE SERVICE IS PROVIDED &ldquo;AS IS&rdquo; AND &ldquo;AS AVAILABLE&rdquo;
WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND
NON-INFRINGEMENT.
</p>
<p>
AI-powered OCR is not 100% accurate. You are responsible for reviewing extracted
data before relying on it or syncing it to external systems.
</p>
</Section>
{/* 13 */}
<Section id="indemnification" title="13. Indemnification">
<p>
You agree to indemnify, defend, and hold harmless Echo and its officers,
employees, and agents from any claims, liabilities, damages, losses, or
expenses (including reasonable attorneys&rsquo; fees) arising out of:
</p>
<ul className="list-disc list-inside space-y-1 ml-2">
<li>Your use of the Service</li>
<li>Your violation of these Terms</li>
<li>Your violation of any applicable law or regulation</li>
<li>Your failure to obtain appropriate consent for the personal data you process through the Service</li>
</ul>
</Section>
{/* 14 */}
<Section id="termination" title="14. Termination">
<p>
Either party may terminate these Terms at any time. You may stop using the
Service and delete your account by contacting{" "}
<a
href="mailto:support@echoocr.com"
className="underline hover:text-foreground"
>
support@echoocr.com
</a>
.
</p>
<p>
We may suspend or terminate your access if you violate these Terms, fail to pay
applicable fees, or if we are required to do so by law. We will provide
reasonable notice before termination, except in cases of severe violation.
</p>
<p>
Upon termination, your right to use the Service ceases. You may export Your
Data before termination. We will retain Your Data for 30 days after
termination to allow for export, after which it will be permanently deleted.
</p>
</Section>
{/* 15 */}
<Section id="changes" title="15. Changes to These Terms">
<p>
We may update these Terms from time to time. If we make material changes, we
will notify you by posting a prominent notice on the Service or sending you an
email at least 30 days before the changes take effect. Your continued use of
the Service after changes take effect constitutes acceptance.
</p>
</Section>
{/* 16 */}
<Section id="governing-law" title="16. Governing Law">
<p>
These Terms are governed by and construed in accordance with the laws of the
State of Texas, without regard to its conflict of law provisions. Any disputes
arising under these Terms shall be resolved in the state or federal courts
located in Texas.
</p>
</Section>
{/* 17 */}
<Section id="contact" title="17. Contact Us">
<p>
If you have questions about these Terms, please contact us:
</p>
<ul className="list-none space-y-1 ml-2">
<li>
Email:{" "}
<a
href="mailto:legal@echoocr.com"
className="underline hover:text-foreground"
>
legal@echoocr.com
</a>
</li>
<li>
General support:{" "}
<a
href="mailto:support@echoocr.com"
className="underline hover:text-foreground"
>
support@echoocr.com
</a>
</li>
</ul>
</Section>
</article>
<MarketingFooter />
</div>
);
}

4
src/components/marketing/footer.tsx
View file

@ -33,8 +33,8 @@ export function MarketingFooter() {
<ul className="space-y-2.5 text-sm text-muted-foreground">
<li><a href="mailto:support@echoocr.com" className="hover:text-foreground transition-colors">Support</a></li>
<li><a href="mailto:sales@echoocr.com" className="hover:text-foreground transition-colors">Sales</a></li>
<li><a href="#" className="hover:text-foreground transition-colors">Privacy Policy</a></li>
<li><a href="#" className="hover:text-foreground transition-colors">Terms of Service</a></li>
<li><Link href="/privacy" className="hover:text-foreground transition-colors">Privacy Policy</Link></li>
<li><Link href="/terms" className="hover:text-foreground transition-colors">Terms of Service</Link></li>
</ul>
</div>
</div>

2
src/middleware.ts
View file

@ -5,6 +5,8 @@ const publicPaths = [
"/welcome",
"/features",
"/pricing",
"/privacy",
"/terms",
"/login",
"/signup",
"/invite",