Legal
Privacy policy
Last updated: 2026-10-06
Who we are
Ecomrank (ecomrank.ai) connects to your Shopify or WooCommerce store, writes blog articles around your product catalog with artificial intelligence and publishes them on your store blog. The service is operated from France. For any question about your data, write to contact@ecomrank.ai.
This policy covers the public website and the application.
Two kinds of data
- Your data as an Ecomrank user: your account, your subscription and how you use the product. Ecomrank is responsible for it.
- Data from your store: your catalog, your blog and your orders. It stays yours. Ecomrank processes it on your behalf, only to provide the service to your account, and never for another customer.
We never sell your data.
What we collect
- Account: your email address, your name when your sign-in method provides one, and your language. You sign in with Google or with an email and a password, through Supabase Auth. Ecomrank never sees your password.
- Team: the email address of each person you invite to your team.
- Store connection: your store address and the access you grant (a WordPress application password, a WooCommerce read key or a Shopify app token). This access is encrypted before it is stored.
- Store content: your product catalog (names, descriptions, prices, images, links) and your blog posts.
- Orders, where you allow it: your recent orders (last 90 days on WooCommerce, last 60 days on Shopify) with their date, amount, status, products and the origin of the visit (referring site, landing page, campaign tags, device type). Ecomrank does not request the names, emails or addresses of your buyers.
- Google connection, if you add it: a read-only access to Search Console and Google Analytics, stored encrypted. Disconnecting it from the Integration screen revokes the access at Google.
- Articles: the articles Ecomrank writes for your store, their settings and their publication status.
- Billing: your plan, the status of your subscription and the identifiers Stripe gives us. Your card details go to Stripe only: Ecomrank never stores them.
- Technical data: the logs of the requests made to the service (IP address, browser, date), and the origin of your first visit (referring site and campaign tags), kept in a cookie for 30 days. If you create an account, this origin is attached to your signup.
Why we use it
- To provide the service (contract): your account, the connection to your store, writing and publishing articles, billing.
- To send service emails (contract): the welcome message and team invitations.
- To measure how the site and the product are used (your consent): see the Cookies section below.
- To keep the service secure (legitimate interest): technical logs and usage limits against abuse.
- To meet legal obligations: keeping invoices and payment records.
Artificial intelligence
To analyze your store and write an article, Ecomrank sends store data to an AI language model through OpenRouter: the name and description of your store, product information (names, descriptions, links), the titles and links of your blog posts and your writing settings. Order data is never sent to the model.
Who receives your data
Ecomrank relies on a small number of providers, each for one job:
- Supabase: database and authentication. Our project is hosted in the European Union (Ireland).
- Vercel: hosting of the website and the application.
- Stripe: payment, subscriptions and invoices.
- Resend: service emails.
- OpenRouter and the provider of the AI model it routes to: store analysis and article writing.
- Google: sign-in with Google when you choose it, and Google Analytics after your consent.
- PostHog (United States cloud): product analytics, after your consent.
Several of these providers are based in the United States, so your data may be processed there, under the data protection terms of each provider.
How long we keep it
Ecomrank keeps your data for as long as your account is open. Disconnecting a store or your Google account from the Integration screen deletes the access Ecomrank stored. To close your account and delete its data, write to contact@ecomrank.ai: it is deleted within one month, except the invoices and payment records the law requires us to keep.
Your rights
Under the GDPR you can ask to access, correct, export or delete your data, to restrict or object to a processing, and to withdraw your consent at any time. Write to contact@ecomrank.ai from the email address of your account. Ecomrank answers within one month. You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).
If a request concerns the data of a store connected to Ecomrank, it is forwarded to the owner of that store, who remains responsible for it.
Security
Store access keys and tokens are encrypted (AES-256-GCM) before they are stored. Each account only accesses its own data. If a breach affects your data, Ecomrank informs you.
Changes
This page is updated when the product changes. The date at the top shows the current version.