Legal

Privacy policy

What ecommerce.com collects, why we collect it, who processes it for us, how long we keep it, and the rights you have.

Effective and last updated October 2, 2026

In short

We read public data about online stores. The personal data we keep is mostly your email address and your account.
We do not sell or share your personal data for advertising. We use no third-party analytics and no advertising cookies.
Payments go to Stripe. Your card number never reaches our servers.
You can delete your account and the data under your email at any time, from the Team page of your dashboard.

1. Who we are

ecommerce.com is a service owned by Optimum7 and Zen Media and operated by Zen Media, 4614 SW 74th Ave, Miami, FL 33155, United States ("we", "us"). We are the controller of the personal data described in this policy.

For any question about your data or to use your rights, write to info@zenmedia.com with the subject "ecommerce.com privacy". You can also reply to any email we send you.

2. Words we use

Personal data: Information about a person who can be identified, for example an email address. It has a wider meaning than "personally identifiable information" in US law.
Store data: Public information about an online store: its pages, products, prices, sitemap, search results, AI answers, public reviews and public ads. Store data is about a business, not about you.
Visitor: A person who uses the site without an account.
Member: A person with an account who is in the team of one or more stores.
Processor: A company that processes personal data for us, on our instructions, under a contract.

3. The data we collect

Email and contact data: Your email address when you give it: to confirm that you work at a store, to sign in, to join a waiting list, in an invite to a team, or in a form. With a form, also the name, company and message that you write.
Account data: Your email, the store teams you are in, your role in each team, who invited you, and when you signed in.
Payment data: Stripe collects your card. We receive and keep the brand of the card, its last four digits, its expiry month and year, the Stripe customer and payment ids, the billing email, and the history of the credits of your store team.
Usage data: A random browser id (cookie ec_vid) and the events of our own analytics: the pages you open, for how long they are visible, the store addresses you enter, the analyses you start, and the site that sent you (its host name only).
Technical data: Your IP address. We keep it only as a salted hash (a one-way code) to limit the free analyses of one address and to block abuse. Our host keeps standard server logs with IP addresses for a short time.
Store data: When you enter a store address, we read the public data of that store. See "Store data and AI" below.

We do not ask for and do not want sensitive data (health, religion, political views and similar). Do not put it in a form.

4. Why we use it and our legal bases

If you are in the European Economic Area, the United Kingdom or Switzerland, the law asks us to name a legal basis for each use. We use your data only for these purposes:

Purpose	Data	Legal basis
Run the analysis and the dashboard, and show it only to the store's team	Email, account data, store data	Contract (to give you the service you asked for)
Sign you in with an email link and confirm that you work at a store	Email, account data	Contract
Take payments, keep the credit history, send receipts	Payment data, email	Contract; legal duty (tax and accounting records)
Answer your form, request or invite, and keep your place on a waiting list	Email and contact data	Contract or the steps you ask for before one
Limit free analyses, block abuse and Tor exit nodes, keep the service secure	Technical data, usage data	Legitimate interest (a safe and fair service)
Improve the product from our own analytics	Usage data	Legitimate interest (a better product); no advertising use
Tell you about a material change to these terms or this policy	Email	Legitimate interest; legal duty where it applies

We do not send marketing emails today. If we start, we ask for your consent first where the law requires it, and every such email has a link to stop them.

We make no decision about you by automated means that has a legal or similar effect on you. The scores in a dashboard are about a store's pages and products, not about a person.

5. Store data and AI

To analyze a store, we read its public pages and feeds, its results on Google, the answers of AI assistants about it, its public reviews on Trustpilot, and the public ad libraries. We send the store's address and its public pages to AI models and data providers (listed below) to read and score them.

Public reviews can contain the name of the person who wrote them. We show them as the review site publishes them, as part of the analysis of the store, and we do not combine them with other data about that person.

We do not send your email or your account data to the AI models. AI readings in the dashboard are labeled as model answers.

6. Who receives your data

We do not sell your personal data. We do not share it for cross-context behavioral advertising. We give it only to these parties:

Party	What it does for us	Data it receives
Supabase	Accounts and store teams (database)	Email, account data
Postmark	Sends our emails (sign-in links, invites, waiting lists)	Email, the content of the email
Stripe	Payments and receipts	Email, card and payment data
Railway	Hosts the service and its files	All data the service keeps
Google (Gemini), OpenAI, Typesafe	AI models that read store pages	Store data only
AnyAPI, DataForSEO, Store Leads	Read public pages, search results, reviews and store facts	Store data only
Google, Brandfetch	Store logos that your browser loads	Your IP address and browser data, as with any image on the web

The members of a store's team see the dashboard of that store, the emails of the other members and the open invites. The owners of a team see the emails of people who asked to join it.

Our team can open a dashboard to support you and to keep the service safe.

We disclose data when the law requires it (a court order, a subpoena, a request of a public authority) or to protect our rights, our users or the public.

If the service is sold or merged, or its owners change, the data moves to the new owner, who must keep the promises of this policy. We tell you before that happens.

7. Cookies and local storage

We use only first-party cookies that the service needs or that hold your own choices. We use no advertising cookies and no third-party analytics cookies, so there is no cookie banner.

Name	Purpose	Lifetime
ec_vid	A random browser id for our own analytics and the limits on free analyses. It holds no name and no email.	1 year
sb-…-auth-token	Keeps you signed in to your account.	Until you log out, at most 400 days
pd-theme	Your choice of a light or dark screen.	1 year
ec_gate	Only on our private test build: the password of that build.	30 days

The site also keeps your theme choice in your browser's local storage (lp-theme), and a short flag in its session storage so a page view counts once. You can delete cookies in your browser at any time; you then must sign in again.

8. Do Not Track and Global Privacy Control

We do not track you across other sites and we do not sell or share personal data for advertising, so a Do Not Track or Global Privacy Control signal has nothing more to turn off. If that changes, we will honor Global Privacy Control as an opt-out of sale and sharing.

9. How long we keep data

Account data: while your account exists. When you delete your account, we delete it at once.
Emails, forms and waiting list entries: until you ask us to delete them or delete your account, or until we no longer need them for the request.
Payment and credit records: as long as tax and accounting law requires, usually up to 7 years, also after you delete your account.
Usage data and hashed IP addresses: as long as we need them for the limits, security and product decisions. We review them and delete what we no longer need.
Analyses of a store: they hold store data, not personal data, and stay with the store's team.
Copies in backups are deleted when the backup expires.

10. Security

Every connection to the service uses HTTPS. The tables of accounts and teams are closed to the public: only our server reaches them. Sign-in links are signed, expire, and work only after you press a button, so a mail scanner cannot use them. We keep no passwords for your account, and IP addresses only as a salted hash.

No system is completely secure. If a breach puts your personal data at risk, we tell you and the authorities as the law requires. Keep your email account safe: whoever controls it can sign in to your ecommerce.com account.

11. International transfers

We are in the United States, and our processors store and process data in the United States and other countries. When personal data from the European Economic Area, the United Kingdom or Switzerland goes to a country without an adequacy decision, we rely on the EU-U.S. Data Privacy Framework where the processor is certified, or on the Standard Contractual Clauses of the European Commission in the processor's data processing terms.

12. Your rights

Depending on where you live, you have some or all of these rights about your personal data:

To know what we collect and how we use it (this policy), and to get a copy of your data.
To correct data that is wrong.
To delete your data. Signed in, use "Delete my account" on the Team page of your dashboard; otherwise write to us.
To get your data in a common, machine-readable format (portability).
To object to a use based on our legitimate interest, and to restrict a use while we check a complaint.
To withdraw consent at any time, where a use is based on consent. This does not affect what we did before.
To opt out of the sale or sharing of personal data and of targeted advertising. We do neither.
To not be treated differently because you used a right.
To complain to a data protection authority, for example the one of the country where you live or work.

To use a right, write to info@zenmedia.com. We answer within one month (GDPR) or 45 days (US state laws), and tell you if we need more time as the law allows. We may ask you to confirm the email address the request is about. An authorized agent can make a request for you with your signed permission.

California residents: in the last 12 months we collected the categories in "The data we collect" (identifiers, commercial information, internet activity) for the purposes above. We did not sell or share personal information and we do not use sensitive personal information. Under California Civil Code 1798.83 you can ask whether we gave personal information to third parties for their direct marketing: we do not.

13. Children

ecommerce.com is a business service for people aged 18 and older. We do not knowingly collect personal data of anyone under 16. If you think a child gave us personal data, write to us and we delete it.

14. Other websites

The dashboard links to the stores we analyze, to search results and to other websites. Their own privacy policies apply there, not this one.

15. Changes to this policy

We update the date at the top of this page when the policy changes. Before a material change to how we use personal data, we email the members and give at least 30 days' notice. Older versions are available on request.

16. Contact

Zen Media, for ecommerce.com. 4614 SW 74th Ave, Miami, FL 33155, United States. Email: info@zenmedia.com.