Privacy policy
Last updated: 16 October 2026
This policy explains what personal data EcomDeck collects through this website and the EcomDeck app, why, and what you can do about it.
In short: we collect what you connect and what you enter, and use it only to show you your profit. We never sell it, never use it for advertising, and never share it beyond the providers listed below. Access keys are encrypted and connections use HTTPS. You can disconnect any account or have everything deleted at any time.
Who we are
This policy covers EcomDeck (“we”), currently in private beta. Contact: office@ecomdeck.io.
For your own account and use of the service we are the controller. For the store data you connect, you remain the controller and we process it on your behalf to provide the service.
This website
This website uses no cookies, no analytics and no tracking. Fonts are served from our own site, not from third parties. If you switch between light and dark mode, your choice is remembered in your browser’s local storage; it never leaves your device. Our hosting provider keeps standard server logs (such as IP address and time of request) for security, for a short period.
What we collect in the app
Your account. Name, email address, a password stored only as a one-way hash (Argon2id) — or, if you sign in with Google, the name and email address Google shares with us — and — if you turn on two-factor sign-in — its secret, stored encrypted. A session cookie keeps you signed in; it is strictly necessary and used for nothing else.
Your team. The organizations you belong to, your role, and the email addresses of people you invite.
Store data from Shopify, once you connect your store, with read-only access:
- store details: domain, name, currency, time zone;
- products and variants: titles, SKUs, prices and costs;
- orders: number, dates, amounts, discounts, taxes, shipping charged, line items, payment method name, payment fees, fulfilment and cancellation status, refunds.
We do not request your customers’ names, email addresses, phone numbers or addresses. When Shopify sends us a privacy request about one of your customers, we keep a record of the request (with the identifiers it contains) for two years, as proof that it was handled.
Advertising data from Meta, Google and TikTok, once you connect an ad account, with read-only access: account name, currency and time zone; campaign names and statuses; daily spend, impressions and clicks; and the web addresses your ads link to.
Costs you enter: product costs, VAT, shipping costs, the cost of refused parcels and other costs.
Access keys for Shopify, Meta, Google and TikTok are stored encrypted.
Stored in your browser. Besides the session cookie, the app keeps a few preferences in your browser’s local storage: language, light or dark mode, the shop you last selected and whether the side menu is collapsed. They stay on your device, are not used for tracking, and are removed when you clear your browser’s site data.
Technical data. When you use the app, our servers see your IP address and browser type. The web server’s access log records them, for security, and keeps them for up to 14 days. Your IP address is also used, in memory only, to limit repeated sign-in attempts. We do not store it with your account.
Data from Shopify, Meta, Google and TikTok
We read this data only with the access you grant, and only to show you, and the people you invite to your organization, your own figures. We do not use it for advertising or profiling, do not sell it, and do not share it with anyone except the providers below that run the service for us. You can withdraw our access at any time in EcomDeck or directly at the platform; see data deletion.
EcomDeck’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Why we use it
Only to provide the service: to calculate your profit, keep your account secure, send you service emails (such as invitations and password resets) and answer your requests. The legal basis is the contract with you, and our legitimate interest in keeping the service secure. We do not sell data, use it for advertising, or share it beyond the providers listed below.
Who processes it for us
- Hosting — DigitalOcean, servers in Amsterdam (European Union).
- Email delivery — Resend, for service emails.
- Monitoring — Grafana Cloud, servers in the European Union, for the app’s technical logs, which can include your user ID and email address.
- Sign-in — Google, if you choose “Sign in with Google”.
- Website and domain — Cloudflare, which serves this website.
- Payments — when paid plans start, the payment provider named at checkout.
These providers process data only on our instructions. Where a provider is outside the EU or Serbia, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.
How long we keep it
| Data | Kept |
|---|---|
| Account data | As long as your account exists |
| Store data from Shopify | While the store is connected; deleted 48 hours after you uninstall the app |
| Advertising data | While the ad account is connected, or until you ask us to delete it |
| Costs you enter | As long as the store’s data is kept |
| Web server log (IP address, browser) | Up to 14 days |
| Records of customer privacy requests | Two years |
| Preferences in your browser | Until you clear them |
Your rights
You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, or object to processing. Write to office@ecomdeck.io; we answer within 30 days. You may also complain to the data protection authority — in Serbia the Commissioner for Information of Public Importance and Personal Data Protection, or the authority in your EU country.
See also how to delete your data.
Security
Connections are encrypted (HTTPS). Passwords are hashed, access keys encrypted, and each organization’s data is separated at the database level. Two-factor sign-in is available for every account. If a security incident affects your data, we tell you without delay and within 72 hours of finding it, together with the authority where the law requires. New passwords are checked against passwords known from data breaches; only the first five characters of the password’s hash leave our server for that check.
Children
EcomDeck is a service for businesses and is not meant for anyone under 16. We do not knowingly collect their data.
Changes
If we change this policy, we update the date above and, for significant changes, tell account owners by email.