Privacy Policy

EcomClarity ("we", "us") is a profit, advertising and customer-support service for Shopify stores, operated by AA Ecom AB (Sweden). This policy explains what data we process, why, who else receives it, and what rights you have. We aim to keep it short and honest.

Who is responsible for what

• Your customers' data — the merchant (the store) is the controller. EcomClarity is a processor: we handle that data only on the merchant's behalf, only to provide the features the merchant uses, and never for our own purposes.
• Your merchant account data, and visitors to this website — AA Ecom AB is the controller.

What we collect and why

• Shopify store data — orders (amounts, line items, discounts, refunds, transaction fees, payment method, shipping country, shipment tracking), products, inventory and payouts, fetched via the Shopify API you authorize at install. Used to calculate your store's profit and analytics.
• Meta (Facebook) ads data — campaigns, ad sets, ads, creatives, spend and performance metrics, fetched via the Meta Marketing API when you connect your Meta account. Used to show your advertising performance and to make the changes you ask for (see "What we change on your behalf").
• Google Ads data — campaigns, spend and performance, fetched with the Google account you connect. Used the same way as Meta ads data; see "Google user data" below.
• Order attribution data — the landing page, referrer and marketing parameters (UTM tags) of the visits that led to an order, provided by Shopify. Used to match orders to the ads that drove them.
• Account data — your email address, name (optional), a securely hashed password, and your conversations with the ClarityPilot assistant.

Your customers' personal data

Depending on which features the store uses, EcomClarity stores the following about the store's customers:

• Customer profile (CustomerClarity) — Shopify customer ID, first and last name, email address, city and country of the default address, and when the account was created. Used to show lifetime value, repeat purchases and top customers. We do not store phone numbers or street addresses.
• Orders linked to a customer — each order carries the Shopify customer ID, so profit and lifetime value can be calculated per customer.
• Support conversations (SupportClarity) — emails received in the store's connected support mailbox (sender name and address, subject, message text and attached images), the store's replies, storefront chat conversations (the messages, and an email address if the visitor leaves one), and comments on the store's Facebook and Instagram posts and ads (the commenter's name and account ID, and the comment text). Used to organise, answer and analyse customer support.
• Post-purchase survey answers — the channel a customer says they heard about the store from, and any free text they type, linked to their order. Used for attribution.

Shopify grants this access only to apps approved for its protected customer data requirements, which EcomClarity is. We never sell this data and never use it to train AI models or for any purpose other than the store's own.

Who else receives data (sub-processors)

• Hetzner Online GmbH (Germany) — hosting of the application, database and encrypted backups. All stored data lives here, in the European Union.
• Anthropic, PBC (USA) — the AI model behind ClarityPilot, the storefront chat and support draft replies. When one of these features runs, the text it needs is sent to Anthropic for that request: for example the customer's message, their name or email, and the related order, or the top-customer list when you ask ClarityPilot about customers. Anthropic does not use this data to train its models. Transfers to the USA rely on the European Commission's Standard Contractual Clauses.
• Meta Platforms Ireland Ltd — receives what you send through the Meta features: ad changes, and support replies posted as your Page on Facebook and Instagram comments.
• Google Ireland Ltd — receives the Google Ads changes you make in EcomClarity. No customer data is sent to Google.
• Zoho Corporation (EU data centre) — sends EcomClarity's own emails, including notifications to you about new support tickets, which can include the ticket subject and the customer's name, and our answer to a customer's data access request (see below).
• GitHub Inc. — application delivery; no store or customer data.

Replies to customers are sent through the store's own mailbox, which the merchant connects and controls. If you connect an AI assistant of your own (for example through the EcomClarity MCP server), the data it reads goes to that assistant on your instruction.

What we change on your behalf

• We change your Meta or Google ad accounts only on your instruction: an action you click, or a rule or automation you have set up and switched on.
• We post to your Facebook and Instagram only when you send a reply to a comment (or an automatic reply you have switched on).
• In your Shopify store we add only what you enable: the post-purchase survey on the thank-you page and the storefront chat.

Google user data

When you connect Google Ads, EcomClarity asks Google for one permission: to manage your Google Ads campaigns (https://www.googleapis.com/auth/adwords). This section describes how we access, use, store and share the data that permission gives us.

• What we access — the Google Ads accounts you connect: campaigns, ad groups, ads, keywords, assets, budgets, bid strategies and performance metrics (impressions, clicks, cost, conversions and conversion value). We do not access your Gmail, Drive, contacts or any other Google data, and Google Ads gives us no personal information about the people who saw or clicked your ads.
• How we use it — to show your Google Ads spend and results next to your store's own orders and profit, to tie orders to the campaigns that drove them, and to make the changes you ask for: creating campaigns, ad groups, ads and keywords, pausing or enabling them, and changing budgets or bid strategies. We change your Google Ads account only on your instruction.
• How we store it — the access (refresh) token Google issues is encrypted at rest. Synced campaign data and daily metrics are stored with the rest of your store's data on our servers in the European Union.
• How we share it — we never sell Google user data and never use it for advertising. It is shared only with Anthropic, PBC, when you ask the ClarityPilot assistant about your ads (the figures needed for that answer, under the terms described above); with an AI assistant you connect yourself through the EcomClarity MCP server, on your instruction; or where the law requires it. We do not use Google user data to develop, improve or train generalized AI or machine-learning models.
• Limited Use — EcomClarity's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Disconnecting and deletion — disconnecting Google Ads in Settings → Connections deletes the token immediately and stops all syncing. You can also revoke access at any time at myaccount.google.com/permissions. Google Ads figures already synced stay part of your store's history until you ask us to delete them at hello@ecomclarity.io or uninstall the app (see "Data retention & deletion").

Where your data lives

All data is stored on servers in the European Union (Hetzner Online GmbH, Germany), encrypted in transit. Access tokens and mailbox passwords are encrypted at rest. Nightly database backups are encrypted with a key that is kept offline, and are deleted after 30 days. Access to customer data by our staff is logged.

Cookies

In the app (app.ecomclarity.io) we use a single essential session cookie to keep you signed in — no advertising or tracking cookies.

On this marketing site (ecomclarity.io) we ask for your consent to set one measurement cookie (the Meta pixel), used only to understand whether our own ads work. If you decline, nothing is loaded and no data is shared with Meta. You can change your mind by clearing this site's data in your browser.

Demo store

Our public demo store (app.ecomclarity.io/demo) uses only fictional sample data. To understand how the demo is used, we collect anonymous, cookieless usage statistics — which features are viewed and a per-day salted hash of your IP address so we can count unique visitors. We never store your raw IP address and set no cookies on the demo. Legal basis: legitimate interest (product statistics and abuse prevention). This applies only to the demo — it does not run for merchants signed in to their own store.

Data retention & deletion

• Store and customer data is kept while the store uses EcomClarity, so that history and lifetime value stay correct.
• A customer's data — when a customer asks the store to erase their data, Shopify sends us a redaction request and we delete that customer's profile, support conversations, attachments and survey answers, and remove the link between their orders and them. The orders remain only as anonymous financial records.
• A customer's access request — when Shopify forwards one, we email the store's contact address everything we hold about that customer, for the merchant to pass on.
• Uninstalling stops all data collection immediately and deletes the store's access token. Following Shopify's store-erasure request (sent ~48 hours after uninstall), all data associated with the store, including all customer data, is permanently deleted.
• Deleted data disappears from our encrypted backups within 30 days, when those backups expire.
• You can request deletion at any time at hello@ecomclarity.io.

Your rights (GDPR)

You may request access to, correction of, or deletion of your data, and you may lodge a complaint with your local supervisory authority (in Sweden: IMY). Contact us at hello@ecomclarity.io — we respond within 30 days.

If you are a customer of a store that uses EcomClarity, the store is responsible for your data: please contact the store directly. If you contact us, we pass your request on to the store and help it respond.

Changes

If this policy changes materially we will note it here and update the date above.