eCom Pal — Privacy Policy
Effective date: 20/07/2026
Data controller: eCom Pal, United Kingdom.
Contact: [email protected]
What we collect, and why
| Data | Why | Lawful basis |
|---|---|---|
| Account details: email address, name, password (stored as an Argon2 hash — we cannot read it) | Sign-in, account notices, alert emails you enable | Contract |
| Store connection credentials: WooCommerce API keys, eBay and Amazon access tokens, webhook secrets | Reading and updating stock/prices on your own stores — the service itself | Contract |
| Order-derived records: order ID, status, SKU, quantity, line total | Adjusting shared stock when something sells; your revenue reporting | Contract |
| Inventory history: stock changes, their cause, timestamps | The audit trail and sync-health features you see in the app | Contract |
| Subscription state: Stripe customer/subscription IDs, purchase history | Billing and plan limits | Contract |
| Basic server logs (IP address, request timing) | Security, rate-limiting, debugging | Legitimate interests, Security |
What we deliberately do not collect: your buyers’ names, addresses,
emails, or payment details — our platform API access requests exclude
buyer-identifying data entirely. We also never see your card details
(payments are handled by Stripe), and we use no analytics trackers or
advertising cookies; the only cookie is the session cookie that keeps you
logged in.
How it’s protected
- Store credentials and tokens are encrypted at rest with AES-256-GCM.
- All traffic is HTTPS/TLS. Databases are not reachable from the internet.
- Hosted on a server in the EU, access limited to server admins.
Who we share it with
Nobody, except the processors needed to run the service, each receiving
only what their role requires:
- Stripe — payments and subscription state.
- The platforms you connect (WooCommerce/your own site, eBay, Amazon) —
stock and price updates you’ve asked us to make. - Amazon Web Services (SQS) — receives Amazon’s own order-change event
messages en route to us. - iCloud — sends the emails you receive from us.
We do not sell, rent, or trade any data, and we use Amazon selling-partner
data solely to provide the sync service to the seller it belongs to, in
accordance with Amazon’s Data Protection Policy.
How long we keep it
For as long as your account is active. Disconnecting a store deletes its
stored credentials; deleting your account deletes your personal data and
store credentials, with minimal billing records retained only as required
by law (typically 6 years for UK tax purposes). Backups are retained on a
rolling basis and expire automatically.
Your rights
Under UK GDPR you may request access to, correction of, deletion of, or a
copy of your personal data, object to or restrict processing, and complain
to the ICO (ico.org.uk). Email [email protected] and we’ll respond within one
month.
Changes
We’ll notify you by email or in-app of material changes to this policy
before they take effect.