Privacy Policy

Ecom Intelligence is operated by ROA BUSINESS SOLUTIONS LLC.

This policy describes what information we collect, how we use it, and the controls you have over it.

1. Information We Collect

1.1 Data Categories

• Account data: email address and name used to register (authentication is provided by Supabase).
• Integration data: when you connect Shopify or Meta Ads, we access store and campaign information (products, orders, ad metrics). Access tokens are encrypted at rest and never exposed to the browser.
• Content you create: audits, reports, briefs, generated images/videos, and other content produced with the platform's tools.
• Usage data: AI usage logs used to enforce plan limits and show your estimated billing, plus basic product analytics (pages visited, time per module).
• Payment data: today, plans and credits are charged by Shopify, approved in your Shopify Admin and shown on your Shopify invoice; we keep only the Shopify subscription and charge identifiers. Card payment on our website is not available yet; it will arrive when Stripe is active, and Stripe will then process the card. We never store card numbers.
• Legal consent records: when you create an account, we record which Terms and Privacy Policy versions you accepted, the date of acceptance, and your account identifier.
• Access request data: if you request access, we collect your name, email address, self-reported ecommerce experience level, and an optional source tag. We use these fields to send you the access code for creating your account, notify the team of requests, and measure aggregate experience/source counts. We may send one notice about the access you requested, not recurring marketing emails. We record the consent time and the Terms and Privacy Policy versions shown when you request access. Requesting access does not subscribe you to a marketing newsletter.

1.2 Operational Identifiers and Retention

The service also processes limited operational identifiers for service delivery: security events may include account ID, IP address, browser user-agent and approximate location; crash reports may include a pseudonymous account key, normalized route, redacted error/stack details and browser type; product analytics may include account ID, top-level module/page, time spent and timestamps. Support submissions can contain free-text personal information. Consent records include accepted document versions, time, locale and verified email. Email-delivery and suppression records include recipient email, template/category, subject, delivery state, provider reference and bounce/complaint detail so we can operate delivery and honor suppression requests. When you request account deletion, we immediately deactivate the account and begin purging its live data. We delete the remaining account data, including copies in backups, no later than 30 days after the request. We retain only records that we are legally required to keep, and only for the period required by law.

2. How We Use Your Information

• To provide, operate, and improve the service.
• To generate AI analyses of your stores and campaigns at your request.
• To enforce usage limits according to your plan and prevent abuse.
• To communicate with you about your account, billing, and support.
• We may use operational data, usage data, product context, generated reports, error logs, and related service data to operate Ecom Intelligence, detect bugs, secure the platform, evaluate quality, improve the product, and run internal agents such as reliability, quality, and workflow-assistance systems.
• When data is used for general product improvement, we use aggregated or minimized data where reasonably possible.

3. Data Isolation

Customer data is scoped by authenticated user, workspace, and, where applicable, the product it belongs to. Product-specific reports, research, assets, and performance data are not accessible to other users or workspaces unless access is explicitly authorized. Third-party tokens (Shopify, Meta) are encrypted at rest and used only on the backend. See our Security Practices.

4. Shopify Privacy Requests

When Shopify sends a mandatory privacy request for a connected store, it delivers the request to our verified compliance receiver. We verify Shopify's cryptographic signature before accepting it. We do not retain Shopify customer-level records or webhook payloads for these requests. Customer data requests and customer-redaction requests are recorded as a minimal workflow outcome; shop-redaction requests remove the connected store's Shopify-derived catalog, app-billing records, and encrypted integration credentials without deleting independent workspace content.

For operational product, store, uninstall, and refund webhooks, we persist only the fields required to authenticate the store and complete retryable processing. The minimized payload is deleted when processing reaches a terminal state; the delivery identifier, topic, status, timestamps, and sanitized error metadata may remain as an operational audit record.

5. Sharing With Third Parties

We do not sell customer data. We share information only with the providers required to operate the service — AI providers (Google Gemini, Anthropic Claude, and image-generation providers listed on our Subprocessors page) to process your requests, Shopify for payments today (Stripe for card payment on our website once it is active), Resend for transactional email, and the platforms you choose to connect (Shopify, Meta). Each processes data under its own applicable terms and privacy policies.

• Apify — collection of public advertising data for Competitive Intelligence.
• Kalodata — market and product data for Market Intelligence.
• PostHog — product analytics and privacy-masked session replay; sensitive content is masked.
• Sentry — error tracking, technical breadcrumbs, and performance monitoring, with sensitive information scrubbed.

6. External AI Provider Training

We configure external AI providers, where available, so that customer private content is not used to train public third-party models. Provider data handling also depends on the applicable provider terms, account settings, and product configuration. We do not make absolute guarantees beyond what provider settings and terms support.

7. Retention and Deletion

We retain your data while your account is active. You can request deletion of your account and data at any time — see the Data Deletion Policy. Consent records and billing records may be retained where required for legal or accounting purposes.

8. Your Rights

To export your data or request account deletion in the platform, go to Settings → Data.

You can access, export, correct, or delete your data. Use the Account section inside the app or write to info@ecomintelligence.ai. Depending on your location, you may have additional rights (e.g., under GDPR or CCPA); we will honor verified requests as required by applicable law.

9. Cookies and Tracking

We use essential authentication and session storage, security-related tokens, and local preferences such as language and theme. PostHog provides product analytics and privacy-masked session replay, and Sentry processes technical error and performance diagnostics. See the Cookie Policy for the applicable categories and choices.

10. International Transfers

Our infrastructure providers may process data in the United States and other countries. Data transfers rely on the applicable terms, data-processing commitments, and transfer mechanisms of each provider we use.

11. Changes and Contact

Material changes to this policy will be announced with reasonable notice and reflected in the version and Effective Date above. Privacy questions: info@ecomintelligence.ai.

English is the controlling version of this Privacy Policy. Any translations provided are for convenience only.

If you use the platform for your store, see also the Data Processing Addendum (DPA).