Privacy Policy

Controller contact for privacy requests: privacy@ecomboostai.com (or support@ecomboostai.com).

Account data: name, email, password hashes / auth provider IDs, workspace role, and support messages.

Billing data: processed by Stripe (payment method details, billing address, tax IDs when provided). We receive limited billing metadata (e.g. customer ID, plan, invoice status), not full card numbers. If you buy extra credits, turn on automatic credits or take credits on loan, Stripe keeps your payment method on file so it can be charged again on the schedule you chose or when a loan falls due, and we keep a record of those purchases, loans and late fees.

Connected platform data: when you authorize Shopify, Meta, TikTok, Google Search Console, or similar integrations — store catalog, orders, analytics, ad accounts, search performance, and related metadata needed to run the features you use. Google user data is covered in section 12.

Usage & device data: logs, IP address, browser type, pages viewed, feature usage, crash/diagnostic data, and cookies as described in our Cookie Policy.

Content you submit: prompts, uploads, generated drafts you save, and similar inputs.

We use personal data to:

• Provide, secure, and improve the Service
• Authenticate users and manage workspaces
• Sync and act on connected stores/ad accounts as you instruct
• Generate AI outputs you request
• Process subscriptions, taxes, and invoices
• Send transactional email (receipts, security, product notices)
• Detect abuse, fraud, and security incidents
• Comply with law and enforce our Terms

We do not sell personal information.

Where GDPR / UK GDPR applies, we process data under one or more of:

• Contract — to provide the Service you request
• Legitimate interests — security, product improvement, fraud prevention
• Consent — cookies/analytics where required, and optional marketing
• Legal obligation — tax, accounting, and compliance

We share data with:

• Processors that help run the Service (hosting, database, email, analytics, AI model providers, error monitoring)
• Stripe for payments and tax
• Platforms you connect (Shopify, Meta, TikTok, etc.) when you authorize actions
• Professional advisors or authorities when required by law or to protect rights

Processors are bound by contractual confidentiality and data-protection obligations where applicable.

We and our processors may process data in the United States and other countries. For transfers from the EEA, UK, or Switzerland, we use appropriate safeguards such as Standard Contractual Clauses where required.

We retain account and billing records for as long as your account is active and as needed for legal, tax, and dispute purposes. Store sync data is retained while integrations remain connected and for a reasonable period after disconnect to support recovery and audits, unless you request earlier deletion where feasible.

We use administrative, technical, and organizational measures designed to protect personal data (encryption in transit, access controls, secrets management). No method of transmission or storage is 100% secure.

Depending on where you live, you may have rights to access, correct, delete, or export personal data; object to or restrict certain processing; withdraw consent; and lodge a complaint with a supervisory authority (GDPR / UK GDPR and similar laws).

To exercise rights, email privacy@ecomboostai.com. We may need to verify your identity. Some requests may be limited where we must keep data for legal reasons or where it would affect others' rights.

The Service is not directed to children under 16 (or higher age required locally). We do not knowingly collect personal data from children. If you believe a child provided data, contact us to delete it.

Prompts and store context you provide may be sent to AI subprocessors to generate results. Do not submit sensitive personal data you are not authorized to process. You remain responsible for lawful use of outputs on your store and ads.

If you choose to connect Google Search Console, EcomBoost AI requests read-only access (the webmasters.readonly scope) plus your Google account email address (openid and email).

What we access: the list of Search Console properties your Google account can read, and, for the property you select for your store, search performance data — clicks, impressions, click-through rate, average position, the search queries and the pages that received traffic. We also read the email address of the Google account you connect so you can see which account is linked.

How we use it: only to show you your own store's search performance inside the Service (Analytics → SEO). We do not change anything in your Search Console account; access is read-only.

Storage and security: we store an encrypted refresh token and the selected property so the report can load when you return. Search performance data is fetched from Google when you view it and is not kept in our database. Tokens are encrypted at rest and only our servers can read them.

Sharing: we do not sell Google user data, do not share it with third parties (except as required by law), do not use it for advertising, and do not use it to develop, improve, or train generalized AI or machine-learning models. It is not sent to AI providers.

Your control: you can disconnect Search Console at any time from Analytics → SEO, which deletes the stored token, and you can revoke access from your Google Account at myaccount.google.com/permissions. To ask us to delete any related data, email privacy@ecomboostai.com.

EcomBoost AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect the Service to Claude through our connector, Claude can request read-only data about the store you approved: sales, products and inventory, ad results, the opportunities and change history the Service recorded, and competitor analyses you ran. The connector cannot change your store. We receive the tool requests Claude sends (for example, which period or product to look up), not your Claude conversations, and we use them only to answer those requests and to protect the Service (rate limiting and abuse prevention).

We store the access you granted (hashed credentials, the connecting application's name, and when access was created and last used) until you disconnect it in Claude or in the Service under Settings → Integrations. Data returned to Claude is then handled under that provider's own terms and privacy policy. See EcomBoost AI for Claude for setup and details.

We may update this policy by posting a new version with a revised date. Material changes may be highlighted in-product or by email when appropriate.

Terms of Service · Cookie Policy · Refunds & Billing