eCHO SEO Privacy Policy

Last Updated: September 2, 2026

Digital Stride ("we," "us," or "our") — Experience 1st, LLC, a Pennsylvania limited liability company — publishes the ECHO SEO WordPress plugin (the "Software") and operates the hosted services it can connect to (the "Services").

This policy describes exactly what leaves your website, what reaches us, and how long we keep it. Where a claim below can be checked against the plugin's source code, it was written from that code rather than from intent.

1. The free plugin makes no requests to our servers

The free version of ECHO SEO does not contact Digital Stride. It sends no telemetry, no usage statistics, no license checks, and no update pings to us — on activation or at any other time. We operate no analytics of any kind inside it.

Your business identity, addresses, opening hours, service areas, schema configuration, page titles, meta descriptions, redirects, 404 log, Page Speed history, and any tracking IDs you enter are stored only in your own WordPress database. We cannot see them, and we have no mechanism to request them. If you contact support for troubleshooting, we see only what you choose to send us.

There is exactly one exception, and it only happens if you ask for it — the optional registration on the last step of the setup wizard, described in Section 2.

2. Optional setup registration (free and premium)

The final step of the setup wizard offers to introduce you to us. It is entirely optional:

- No field on that step is required, and there is a "Skip & finish" button next to the finish button.

- Both consent checkboxes start unticked.

- If you finish the wizard with neither box ticked, nothing is stored and nothing is sent — identical to skipping the step.

It is not an API call, a beacon, or a background sync. It is a single plain-text email sent from your own website using WordPress's wp_mail() function, once, at the moment you complete the wizard, and never again.

Each checkbox controls its own part of that email:

You tick - The email contains

Marketing consent - The first name, last name, email address and company you typed on that step, plus your site's URL and title, plus a record of which boxes you ticked

Data consent - All of the above, plus the business profile entered earlier in the wizard: business name and type, business phone, business email, street address, service areas, opening hours, and social profile URLs

Neither - No email is sent

  • Purpose and legal basis. We process this on the basis of your consent. Marketing consent is used to send you product updates, tips and promotions about ECHO SEO. Data consent is used to understand what kinds of businesses use the plugin so we can prioritise features and improve the SEO guidance the plugin gives — we do not sell it, share it with advertisers, or use it to build profiles about you or your customers.

  • Withdrawing consent. Every marketing email carries an unsubscribe link, which takes effect immediately. To withdraw the data consent, or to have the whole registration record deleted, email [email protected] and we will action it and confirm. Withdrawing consent does not affect the plugin: nothing stops working, and the wizard never asks again.

  • Retention. Registration records are kept until you unsubscribe or ask us to delete them, and are reviewed every 24 months — records with no engagement in that period are deleted.

3. What the premium add-on sends (licensed users only)

ECHO SEO Premium is a separate, paid add-on, sold on echo-seo.com and not distributed through WordPress.org. Installing it adds these connections:

License validation. On activation, on deactivation, and once daily thereafter, the plugin sends your license key, your site URL, the plugin version and your WordPress version to our license server, and receives back the license status.

Update checks. When WordPress checks for plugin updates, the plugin asks our update server whether a newer version exists, sending the same four values. The request's user-agent string also carries the plugin version and your site URL.

Page Speed relay. Licensed sites that have not entered their own Google API key can run performance checks through our relay, which holds the API key on their behalf. When you click "Run", we receive your license key, your site URL, the page URL being tested, and whether you chose mobile or desktop. We pass the request to Google, return the result, and do not retain the metrics. No visitor data is involved.

Google connection (OAuth relay). If you connect Google Business Profile or Search Console, the authorization is brokered by our relay so you never need your own Google Cloud project.

  • We request only two scopes: business.manage and webmasters.readonly. We never request access to Google Analytics.

  • The relay does not store your tokens. It exchanges Google's authorization code, hands the tokens straight to your site, and destroys the session. On refresh, your site sends the refresh token, the relay calls Google and returns a new access token without keeping either. Your tokens live in your own WordPress database.

  • Disconnecting in the plugin settings deletes those tokens from your site, which ends our ability to act on your behalf. You can also revoke access directly from your Google Account's security settings at any time.

  • Your Business Profile and Search Console data travels directly between your site and Google. It does not pass through us, and we never index, aggregate or store it.

Lead tracking (premium, entirely local). The lead-tracking feature records clicks on phone, email and CTA links on your public pages. This data never reaches us: it is written to a table in your own database via your own site's admin-ajax endpoint. It stores the page, landing page, referrer and UTM parameters, and whether a Google click ID was present. It does not store raw visitor IP addresses — an IP is used only to compute a salted hash for de-duplication and rate limiting — and it never captures the contents of form fields. You choose a retention window of 3, 6, 12 or 24 months in the plugin settings.

4. What our servers store, and for how long

For licensed premium users only:

| Data | Why | Retention |

| License record — key, customer name and email, seat count, status, expiry | To sell and validate licenses | Purged 12 months after the license expires. Lifetime licenses are kept while active |

| Activation record — site URL, plugin version, WordPress version, first and last seen | To enforce the seat limit and support you | Deleted with the license record |

| Request log — IP address of the server making the call, action, license key, site URL, result, timestamp | Rate limiting, per-site daily caps, and investigating abuse | Deleted after 30 days, automatically |

The IP addresses in the request log are those of the web server making the licensing call, not of your website's visitors. We never receive your visitors' IP addresses through any part of the Software.

We do not sell any of this data, and we do not share it except with the processors needed to run the service (hosting and email delivery), who act on our instructions.

5. Services you connect yourself

The Software can connect to third parties on your behalf. In each case the connection runs directly between your site (or your visitor's browser) and that provider — Digital Stride operates none of them and receives none of the data:

  • Google PageSpeed Insights — when you click "Run" on the Page Speed screen. Free users go direct to Google; licensed users may use our relay instead (Section 3).

  • IndexNow (Microsoft) — off by default. Once enabled, publishing or updating a publicly viewable post or page submits that page's URL and your site's generated IndexNow key. No personal data and no statistics are sent.

  • OpenStreetMap Nominatim — when you click "Find Coordinates", the address you typed is sent to convert it into map coordinates.

  • Google Tag Manager, Meta Pixel, LinkedIn Insight Tag — loaded on your public pages only if you enter the corresponding ID. Your visitors' browsers then load those scripts directly.

  • QR code image (premium) — the review-request screen displays a QR code rendered by api.qrserver.com from your public Google review link. It appears in your admin screen only, never on your public site.

If you enable any visitor-facing tracking, disclosing it in your own privacy policy and collecting any consent your jurisdiction requires is your responsibility, not ours.

6. Your rights

Wherever you are, you may ask us to give you a copy of what we hold about you, correct it, delete it, or stop using it — and if you are in the EEA, the UK or Switzerland, you also have the right to object to processing, to request portability, and to lodge a complaint with your supervisory authority. Where we rely on consent, you may withdraw it at any time, and doing so does not affect processing that already took place.

Email [email protected] and we will respond within 30 days.

7. Security

All traffic between the Software and our Services uses TLS. Access to license and log data is restricted to the personnel who need it, and the relay and licensing components run on isolated infrastructure.

8. International transfers

Our infrastructure is in the United States. If you are in the EEA, the UK or Switzerland, the data described in Sections 2 and 4 is transferred to and processed in the United States under standard contractual clauses.

9. Children

The Software is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.

10. Changes

Material changes will be reflected in the "Last Updated" date above and, where the change affects data we already hold about you, notified by email to registered contacts.

11. Contact

Digital Stride (Experience 1st, LLC), Pennsylvania, USA — [email protected]

© Copyright 2026. Experience 1st, LLC. All rights reserved.