Privacy Policy

1. Who we are

Ecom360 ("Ecom360", "we", "us") is an e-commerce advertising and inventory-management platform operated by Semicolon Digital Ltd (registered in England and Wales). We help merchants and agencies manage advertising campaigns, product listings, inventory, and analytics across platforms including Google Ads, Google Merchant Center, Google Analytics, Microsoft Advertising, Amazon, Meta, TikTok, OpenAI (ChatGPT Ads), and Shopify. This policy explains what data we process and why. If you have questions, contact us at privacy@ecom360.ai.

2. Information we collect

• Account data — name, email address, and authentication identifiers you provide when you sign up (via Firebase Authentication).
• Connected-platform data — when you authorize a connection, we access data from that platform's API on your behalf (see Section 4 for the specific Google data).
• Enquiry data — the name, email address, company and message you send through our website contact form, kept so we can reply to you.
• Usage data — logs and diagnostic information needed to operate, secure, and debug the service.

3. How we use your information

We use the data we process solely to provide and improve the features you use, namely to:

• display your advertising, merchant, and analytics performance in dashboards and reports;
• create, update, pause, and optimize advertising campaigns and product listings that you direct;
• forecast demand, manage inventory, and surface restock and optimization recommendations;
• authenticate you and keep your account and connected integrations secure.

We do not sell your data, use it for advertising to you, or use it to train generalized AI/ML models.

4. Google user data & Limited Use

When you connect a Google account, Ecom360 requests only the OAuth scopes required for the features you enable. We access the following Google data on your behalf:

• Google Ads (auth/adwords) — to read campaign, ad group, keyword, and performance data and to apply changes you initiate (budgets, status, bids, campaign creation).
• Google Merchant Center (auth/content) — to read product feeds and item issues and to submit listing/feed optimizations you approve.
• Google Analytics (auth/analytics.readonly) — to read traffic, conversion, and ecommerce metrics used in reporting and demand signals.
• Search Console (auth/webmasters) — to read search-performance data used in cross-channel demand analysis.
• Data Manager (auth/datamanager) — to upload the customer segments you choose to sync to Google Ads Customer Match. Identifiers are hashed before they leave our servers.

That is the complete list. Ecom360 does not request access to your Gmail, Drive, YouTube, Tag Manager, BigQuery, or Business Profile data. Google Sheets inventory imports do not use your Google account at all: you share a specific spreadsheet with Ecom360's service account, which can read only the sheets you share with it.

Limited Use disclosure. Ecom360's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use Google user data to provide or improve user-facing features that are prominent in the requesting interface; we do not transfer this data except as necessary to provide those features, to comply with applicable law, or as part of a merger/acquisition; we do not use it for serving advertisements; and we do not allow humans to read it unless we have your consent, it is necessary for security or to comply with law, or the data is aggregated and anonymized.

AI features. Some features you ask for — for example drafting ad copy or product titles, or suggesting keywords — send the relevant data, which can include Google user data such as search terms or product details, to the AI model provider configured for your workspace (Anthropic, OpenAI or Google Gemini, or another provider your workspace administrator adds). This happens only when you use those features, only to produce the result you requested, and only as permitted by the Limited Use requirements above. We do not send Google user data to AI providers for the purpose of training their models, and we do not use it to train our own.

5. Storage, security & retention

Data is stored on Google Cloud Platform (region europe-west2). OAuth tokens and other credentials are encrypted at rest using AES-256-GCM. Access is restricted to authenticated requests scoped to your tenant. We retain data for as long as your account is active.

The embedded Shopify edition uses Shopify sign-in and reads product, inventory, unit-cost and order information live to display it to authorized store staff. Its online access tokens are used for the current request and are not stored. This edition does not persist customer contact details or copies of order records. It stores the shop identifier, name, currency, timezone, installation status and a short-lived subscription-verification snapshot. Uninstallation disables the installation; Shopify's shop-redaction request deletes that stored shop metadata. Minimal webhook replay receipts contain a hashed shop reference, event identifier, topic and receipt time, with scheduled retention of 90 days by default. These details describe the embedded edition; separately connected integrations in the main Ecom360 platform follow the broader processing described in this policy.

6. User Data Deletion & Access Revocation

You have full control over your connected accounts and data at all times:

• Revoking Google Access: You can revoke Ecom360's access to your Google Account at any time through your Google Account Security Settings. Revoking access terminates all current and future API requests immediately.
• Disconnecting Integrations: Within the Ecom360 dashboard under Settings → Connections, you can disconnect any connected platform at any time, after which Ecom360 stops accessing it. If you also want the stored credentials and synced data deleted, email us as described below.
• Account & Data Deletion Requests: You may request permanent deletion of your account and all associated data by sending an email to privacy@ecom360.ai. We will confirm when the deletion is complete, within the time limits set by UK GDPR (normally one month). Deleted data may persist in encrypted backups until those backups expire.

7. Sharing & Sub-processors

We share data only with sub-processors necessary to operate the service: Google Cloud Platform for hosting and database storage, Firebase for authentication, and — only when your workspace configures and uses AI features — the AI model providers Anthropic, OpenAI and Google (Gemini) or another provider your administrator adds, which process the data needed to produce the result you requested (see Section 4). We never sell, rent, or monetize personal data or platform data.

8. Your rights (GDPR / UK GDPR)

Under UK GDPR and EU GDPR, you have the right to access, rectify, export, or erase your personal data, as well as the right to restrict or object to certain processing. Contact privacy@ecom360.ai to exercise any of these rights.

9. Changes to this policy

We may update this policy periodically to reflect changes in our services or legal obligations. Material changes will be reflected by updating the "Last updated" date above.

10. Contact & Legal Entity

Semicolon Digital Ltd
Registered in England and Wales
Support: support@ecom360.ai
Privacy Inquiries: privacy@ecom360.ai