Effective date: 20/07/2026
Data controller: eCom Pal, United Kingdom.
Contact: [email protected]
| Data | Why | Lawful basis |
|---|---|---|
| Account details: email address, name, password (stored as an Argon2 hash — we cannot read it) | Sign-in, account notices, alert emails you enable | Contract |
| Store connection credentials: WooCommerce API keys, eBay and Amazon access tokens, webhook secrets | Reading and updating stock/prices on your own stores — the service itself | Contract |
| Order-derived records: order ID, status, SKU, quantity, line total | Adjusting shared stock when something sells; your revenue reporting | Contract |
| Inventory history: stock changes, their cause, timestamps | The audit trail and sync-health features you see in the app | Contract |
| Subscription state: Stripe customer/subscription IDs, purchase history | Billing and plan limits | Contract |
| Basic server logs (IP address, request timing) | Security, rate-limiting, debugging | Legitimate interests, Security |
What we deliberately do not collect: your buyers’ names, addresses,
emails, or payment details — our platform API access requests exclude
buyer-identifying data entirely. We also never see your card details
(payments are handled by Stripe), and we use no analytics trackers or
advertising cookies; the only cookie is the session cookie that keeps you
logged in.
Nobody, except the processors needed to run the service, each receiving
only what their role requires:
We do not sell, rent, or trade any data, and we use Amazon selling-partner
data solely to provide the sync service to the seller it belongs to, in
accordance with Amazon’s Data Protection Policy.
For as long as your account is active. Disconnecting a store deletes its
stored credentials; deleting your account deletes your personal data and
store credentials, with minimal billing records retained only as required
by law (typically 6 years for UK tax purposes). Backups are retained on a
rolling basis and expire automatically.
Under UK GDPR you may request access to, correction of, deletion of, or a
copy of your personal data, object to or restrict processing, and complain
to the ICO (ico.org.uk). Email [email protected] and we’ll respond within one
month.
We’ll notify you by email or in-app of material changes to this policy
before they take effect.
