Privacy Policy

Introduction

This Privacy Policy describes how ECG ONLINE Sp. z o.o. ("we", "us", or "our") collects, uses, stores, and protects personal and business data when you access or use the Ecom-AI platform available at ecom-ai.dev ("the Platform").

Ecom-AI is a suite of software tools for authorized Amazon sellers and brands, providing services including Amazon Advertising analytics, campaign optimization, inventory monitoring, product listing analysis, marketplace reporting, account-health alerts, and operational workflow dashboards. Some features may be provided as private or customer-specific applications rather than as publicly listed software.

By using our Platform, you agree to the collection and use of information in accordance with this Policy. We are committed to protecting your privacy and handling your data in an open and transparent manner, in compliance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

Depending on the service, the customer relationship, and the applicable agreement, ECG ONLINE Sp. z o.o. may act as a Data Controller or as a Data Processor for data processed through the Ecom-AI platform. Where we process a selling partner's Amazon business data to provide an authorized service, we process that data only for the documented service purposes and instructions applicable to that customer. If you have questions about this Policy, please contact us using the details provided in the Contact Information section.

Data Collection

We collect only the data that is necessary to provide our services. The categories of data we may collect and process are described below.

2.1 Data you provide directly:

• Full name and business name
• Email address and contact details
• Amazon Seller Central account identifiers (Seller ID, Merchant Token)
• Amazon Advertising account IDs and profile information
• Billing and subscription information (processed via third-party payment providers)
• Support requests and communications with our team

2.2 Data collected automatically:

• IP address and approximate geographic location (country/city level)
• Browser type, version, and operating system
• Pages visited, features used, and session duration
• Timestamps and interaction logs for service improvement
• OAuth tokens and API authorization credentials (encrypted at rest)

2.3 Data retrieved via Amazon APIs:

When you authorize our Platform through Amazon's OAuth 2.0 flow (Login with Amazon / Amazon Ads API), we retrieve business and performance data on your behalf. Depending on the application and the permissions approved by Amazon, this may include listing, pricing, fulfillment, inventory, order, account-performance, and buyer-communication data. The specific data types and purposes are described in Section 3.

Amazon API Access

Ecom-AI integrates with Amazon's official APIs — including the Amazon Selling Partner API (SP-API) and the Amazon Advertising API — to retrieve and display your account data within the Platform. All API access is performed using Amazon's standard OAuth 2.0 authorization mechanism.

3.1 Authorization flow:

To connect your Amazon account, you are redirected to Amazon's secure login page ("Login with Amazon"). You grant specific permissions directly to Amazon, and we receive a limited-scope access token. We never see or store your Amazon username or password.

3.2 Data accessed through Amazon Advertising API:

3.3 Data accessed through Amazon SP-API:

3.4 Token storage:

OAuth access tokens and refresh tokens issued by Amazon are stored in encrypted form using industry-standard AES-256 encryption. Tokens are never transmitted in plaintext and are accessible only to authenticated server-side processes running on your behalf.

3.5 Revoking access:

You can revoke Ecom-AI's access to your Amazon data at any time by visiting Apps & Services → Manage Your Apps in your Amazon Seller Central or Amazon account settings. Upon revocation, your API tokens are invalidated and we will delete all associated cached data within 30 days.

3.6 Buyer communication limitations:

Buyer Communication data is processed only where the relevant application has been approved by Amazon for the required role and the selling partner has authorized the application. Ecom-AI is not described as a complete Buyer–Seller Messaging inbox. Where incoming customer information is received through email, Seller Central exports, screenshots, or another agreed support channel, that information is processed separately from SP-API data and only for the authorized customer-service workflow.

Purpose of Data Usage

We process your data based on the following legal grounds and for the following purposes:

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you.

Data Sharing

We may share limited data with the following categories of trusted service providers, strictly under Data Processing Agreements (DPAs) and only to the extent necessary to operate the Platform:

• Cloud infrastructure providers — servers and databases used to host the Platform (EU-based or GDPR-compliant)
• Payment processors — for handling subscription billing (e.g., Stripe). We do not store full card numbers.
• Email delivery services — for sending transactional notifications and alerts
• Error monitoring tools — for detecting and diagnosing platform errors (anonymized data only)

All third-party service providers are contractually prohibited from using your data for their own purposes and must comply with GDPR requirements.

5.1 Cross-border transfers:

If data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or we rely on the recipient country's adequacy decision.

5.2 Legal disclosure:

We may disclose data if required by applicable law, court order, or governmental authority. We will notify you of such requests unless prohibited by law from doing so.

Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. Our security measures include:

• Encrypted communication — all data transmitted between your browser and our servers is protected using TLS 1.2+ (HTTPS)
• Encrypted storage — sensitive data including API tokens and credentials is stored using AES-256 encryption at rest
• Access controls — strict role-based access controls; only authorized team members can access production systems
• API token isolation — Amazon OAuth tokens are stored per-user and are never shared between accounts
• Regular security reviews — we periodically audit our infrastructure and code for vulnerabilities
• Minimal data exposure — internal logs are anonymized and do not contain personally identifiable information

While we implement strong security measures, no method of internet transmission or electronic storage is 100% secure. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with GDPR requirements (within 72 hours of becoming aware of the breach).

User Rights (GDPR)

Under the General Data Protection Regulation, if you are a resident of the European Economic Area, you have the following rights regarding your personal data:

• Right of access (Art. 15) — You have the right to request a copy of the personal data we hold about you and to receive information about how it is processed.
• Right to rectification (Art. 16) — You have the right to request correction of inaccurate or incomplete personal data we hold about you.
• Right to erasure / "Right to be forgotten" (Art. 17) — You may request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to restriction of processing (Art. 18) — You may request that we restrict the processing of your data in certain circumstances (e.g., while accuracy is being disputed).
• Right to data portability (Art. 20) — You may request a machine-readable export of personal data you have provided to us.
• Right to object (Art. 21) — You have the right to object to processing based on our legitimate interests, including for direct marketing purposes.
• Right to withdraw consent (Art. 7.3) — Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint — You have the right to lodge a complaint with the relevant supervisory authority. In Poland, this is the Urząd Ochrony Danych Osobowych (UODO) at uodo.gov.pl.

To exercise any of these rights, please contact us at the email address provided in Section 8. We will respond to all legitimate requests within 30 days. In complex cases we may extend this period by up to two additional months, and will inform you accordingly.

Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

We aim to respond to all privacy-related inquiries within 5 business days. For formal GDPR data subject requests, the statutory response period of 30 days applies.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, sending you a notification via email or in-app message.

We encourage you to review this Policy periodically. Your continued use of the Platform following the posting of changes constitutes your acceptance of the updated Policy.