Privacy Policy

1. Who we are

EcomRank ("we", "us") is an SEO + GEO content automation tool for Shopify merchants. The service is operated from France. Contact: [email protected].

2. What we collect

From the merchant (you):

• Account email + authentication tokens (via Supabase Auth — Google OAuth or email magic link).
• Voice / brand preferences you enter during onboarding.
• Subscription + billing metadata via Lemon Squeezy (we never see your card number — Lemon Squeezy handles it).

From your Shopify store (with your explicit consent at install time):

• Product catalogue: titles, descriptions, tags, vendor, collections, images, variants, prices.
• Shop metadata: name, locale, domain, blog handle.
• Existing blog posts (read-only, to avoid duplicate titles before publishing).
• An offline OAuth access token, used solely to read your catalogue and publish articles to your blog.

We do NOT collect or process data about your storefront buyers (customers). EcomRank doesn't read or store customer emails, orders, addresses, or any PII tied to your shoppers.

3. How we use your data

• Generate SEO + GEO articles tailored to your catalogue (via LLMs: Google Gemini, Anthropic Claude).
• Push generated articles to your Shopify blog via Admin API.
• Run keyword research via third-party SEO APIs (DataForSEO).
• Fetch competitor content for analysis (via Firecrawl).
• Operate, debug, and improve the service.

We do NOT sell your data. We do NOT use it to train models we don't own.

4. Third-party data processors

• Supabase (Postgres + Auth) — primary data store, hosted in us-west-2.
• Anthropic / Google — LLM inference for article generation. Snippets of your catalogue are sent during article drafting. No retention by these providers per their API terms.
• DataForSEO — keyword volume + SERP analysis. We send keywords (e.g. product titles), not your private data.
• Firecrawl — scraping competitor content. No data from your shop is sent.
• Lemon Squeezy — billing (merchant of record), only if you subscribe.
• PostHog(US cloud, Data Privacy Framework certified): site and product analytics. See "Analytics & cookies" below for exactly what it receives.
• Hetzner — VPS hosting (Coolify orchestration). Data resides in Germany / Finland depending on region selected.

5. Analytics & cookies

We measure how the site is used with PostHog. What runs depends on your choice in the cookie banner:

• Before you make a choice, and if you decline: analytics run in cookieless mode. Nothing is stored on your device (no cookies, no local storage), events are anonymous aggregate audience measurement (pages viewed, referring site, country), no user profile is created, and your IP address is not stored.
• If you accept: we set an analytics cookie to recognize returning visits, we may enable session replay (everything you type is masked and never recorded), and when you are signed in, usage is linked to your account so we can improve the product and help with support.
• You can withdraw consent at any time by clearing this site's cookies and site data in your browser; analytics then return to the anonymous cookieless mode.

6. Data retention

While you have an active subscription: as long as you keep the Shopify app installed AND your EcomRank account active.

When you uninstall the Shopify app: Shopify sends us a shop/redact webhook 48 hours after uninstall. We then delete all shop-level data: Session tokens, product mirror, generated articles, keyword candidates, cluster runs.

When you delete your EcomRank account: we delete your Supabase auth row and any associated Site rows (cascade-deleting everything tied to your account). Email [email protected] to request deletion (we'll honor within 30 days).

7. Security

• Supabase Postgres with row-level security and HTTPS-only access.
• Shopify OAuth tokens stored in a dedicated Session table, accessible only to authenticated server-side processes.
• All inter-service traffic over HTTPS / TLS.
• No customer (buyer) data ever leaves your Shopify admin — we don't request scopes that would let us see it.

8. Your rights

Under GDPR (EU) and CCPA (California) you can:

• Request a copy of the data we hold about you.
• Request correction or deletion.
• Object to processing.
• Withdraw consent (= uninstall + delete account).

Email [email protected] and we'll respond within 30 days.

9. Changes to this policy

We'll post material updates here with a new "last updated" date. For substantive changes (new data categories, new processors) we'll also email registered users at least 14 days before the change takes effect.

10. Contact

Questions, complaints, or data requests: [email protected].