Privacy Policy

1. Who we are

EcomStat is provided by ECOMSTAT SOFTWARES LTD, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. In this policy, “EcomStat,” “we,” “us” and “our” refer to this company.

EcomStat helps merchants understand revenue, advertising spend, product costs, recurring expenses and profitability. This policy covers our website and service. Shopify, connected platforms and individual merchants have their own privacy policies for the processing they control.

2. Information we process

The information available to EcomStat depends on the services you connect, the permissions you grant and the features you use.

• Account and business information: your name, email address, business or store name, store domain, account settings, subscription details and communications with us.
• Shopify store information: store identifiers and settings, products, variants, SKUs, inventory information, orders, line items, sales, discounts, taxes, shipping charges, refunds and related transaction information used in reporting.
• Customer information: customer identifiers, order history and purchasing activity used to calculate customer insights, such as repeat purchases and lifetime value. Where included in the data made available under your authorized permissions, this may also include customer names, email addresses, phone numbers and billing or shipping addresses.
• Financial information you provide: product costs, business expenses, recurring costs and other entries you add to your dashboard.
• Connected marketing account information: account and campaign identifiers, advertising spend and performance metrics from services you choose to connect, such as Meta Ads Manager.
• Connection and technical information: authorization tokens needed to maintain integrations, IP addresses, browser and device information, usage events and diagnostic or error logs.

We receive information directly from you, through authorized platform APIs and webhooks, and through your interactions with our service. Please do not include passwords, full payment-card details or unnecessary sensitive personal information in support messages or expense notes.

3. How we use information

We use information to operate your account; synchronize authorized data; calculate revenue, expenses, margins and profit and loss; provide product, customer and advertising insights; and display reports you request.

We also use relevant information to provide support, administer subscriptions, communicate service updates, troubleshoot errors, maintain security, prevent misuse and meet applicable legal obligations. Any promotional communications are subject to applicable consent requirements, and you can ask us to stop sending them.

Access to connected platform data is limited by the permissions granted for that integration. Connecting a platform does not give EcomStat unrestricted access to all information in that account.

4. Our role and legal bases

For account administration, our website and our direct business relationship with you, EcomStat acts as a controller of personal information. For customer and order information processed on a merchant’s behalf to deliver analytics, the merchant generally acts as controller and EcomStat acts as processor or service provider.

Where UK or European data protection law applies to processing we control, our legal bases include performing our contract with you, complying with legal obligations, consent where required, and legitimate interests such as securing and improving the service or responding to business enquiries, balanced against your rights.

Merchants are responsible for providing appropriate notices to their customers and having a valid basis for sharing customer information with EcomStat. Installing an app does not replace those responsibilities.

5. Sharing and service providers

Information may be processed by service providers supporting infrastructure, data storage, communications, support, security and billing. Shopify and any platforms you connect also process information under their own terms and privacy policies.

We share information as needed to deliver the service to the merchant and its authorized users, operate requested integrations, comply with lawful requests, protect rights and security, or support a business transfer subject to appropriate confidentiality and data protection requirements. You may request further information about relevant service providers by contacting us.

This policy does not authorize the sale of Shopify customer personal information or its use for unrelated advertising. Store data provided for analytics is to be used for the merchant’s service, rather than unrelated purposes.

6. Cookies and similar technologies

Our website, application and service providers may use cookies or similar storage for sign-in, session management, preferences and security. Where non-essential analytics or advertising technologies are used, any consent required by applicable law must be obtained before they are enabled.

You can manage cookies through your browser settings. Blocking essential cookies may prevent sign-in or affect features. External services opened from our website, such as a demo-booking service, apply their own cookie and privacy policies.

7. Retention, uninstalling and deletion

Personal information is retained for as long as needed for the purpose for which it was collected, taking account of your active service, reporting needs, legal recordkeeping requirements, security and the resolution of disputes. Different categories of information may have different retention periods; contact us for details about your account.

Uninstalling EcomStat from Shopify revokes the app’s Shopify access. It does not necessarily delete a separate EcomStat account or disconnect other services you have linked. You can delete your store from EcomStat at any time. Deleting your store will delete all data related to that store. If you need help deleting your store or closing your account, email us with your store domain.

Shopify provides processes for customers to request access to their data or request deletion through a merchant, and for store data to be deleted after an app is uninstalled. Requests concerning data held by EcomStat should be directed to us or submitted through the merchant’s Shopify privacy process. Applicable Shopify requirements and legal obligations govern the handling of these requests.

8. Security and international transfers

Protecting personal information requires appropriate technical and organizational safeguards, including controls over access and the handling of integration credentials. No internet transmission or storage system can be guaranteed completely secure. Please keep your credentials confidential and contact us promptly if you suspect unauthorized access.

Our providers may process information in countries other than your own. Where UK or European law requires a transfer safeguard, transfers must rely on an applicable adequacy decision, approved contractual safeguards or another valid legal mechanism. Contact us for information about the safeguards applicable to your data.

9. Your rights and choices

Depending on your location and applicable law, you may have rights to access, correct or delete personal information; obtain a portable copy; restrict or object to processing; withdraw consent; and complain to a supervisory authority. UK residents can contact the Information Commissioner’s Office. Where applicable, California residents may also request information about collection and disclosure and exercise rights relating to sale, sharing or sensitive information.

To submit a request, email info@ecomstatapp.com. Include your relationship to EcomStat and the relevant store domain, but do not send passwords. We may need information to verify your identity and authority. Requests are subject to applicable legal exceptions and response deadlines; exercising your rights should not result in unlawful discrimination.

If you are a shopper at a store using EcomStat, contact that merchant first. The merchant controls its customer records, and EcomStat can assist with requests concerning information processed on its behalf. You may also contact us for help identifying the appropriate route.

Merchants can revoke an integration through the relevant platform or uninstall EcomStat from Shopify. Revoking access stops future authorized access but does not, by itself, erase previously processed information.

10. Changes to this policy

We may update this policy as the service or applicable requirements change. The latest version will be available on this page with an updated date. Where required, material changes will be communicated through an appropriate notice and consent obtained for processing that requires it.

11. Contact us

For privacy questions, data requests or concerns about this policy:

Please use the subject line “Privacy request” and include your store domain where relevant.