Privacy Policy

For the purposes of this Policy, the following definitions apply, without prejudice to those set forth in Article 5 of the LGPD:

• "User": the individual or legal entity that subscribes to the Platform and/or uses it through access credentials, including team members invited by it;
• "Data Subject": the natural person to whom the personal data being processed refers;
• "Integrated Platforms": marketplaces, e-commerce platforms, ERPs, advertising platforms and other third-party services that the User connects to the Platform upon express authorization (OAuth protocol or equivalent), such as Mercado Livre, Shopee, Amazon, Magalu, TikTok, KaBuM, Nuvemshop, Yampi, Bagy, Bling and Meta Ads;
• "End Customers": consumers who purchase through the User’s sales channels, whose data may be processed on the Platform under the User’s instructions;
• "Sub-processors": third parties engaged by Ecomy that process personal data on its behalf in the context of the service.

With respect to registration and usage data of the User and its collaborators, Ecomy acts as CONTROLLER, pursuant to Article 5, VI, of the LGPD, being responsible for the decisions concerning the processing.

With respect to personal data of End Customers — processed in the shipment tracking, sales recovery, abandoned carts, customer service, CRM and related modules —, Ecomy acts as PROCESSOR, pursuant to Article 5, VII, of the LGPD, carrying out the processing exclusively on behalf of and under the lawful instructions of the User, who, as controller, is responsible for ensuring an adequate legal basis vis-à-vis the respective Data Subjects.

Each party shall be liable for its own obligations under Articles 42 to 44 of the LGPD.

Ecomy observes the principles of purpose, adequacy, necessity and data minimization (Article 6 of the LGPD), processing the following categories of data:

• Registration data of the User and its collaborators: full name, e-mail, phone number and access credentials (password stored exclusively under an irreversible cryptographic hash function);
• Operational data of the User’s business, obtained from the Integrated Platforms upon authorization: sales orders, product catalog, inventory, costs, prices, fees, commissions, financial settlements, advertising spend, reputation indicators and performance metrics;
• Financial data entered by the User in the management modules (accounts payable and receivable, cash flow, management income statement), processed exclusively for display to the User;
• End Customer data, strictly to the extent necessary for the subscribed modules: name, contact details, delivery address, order history, abandoned carts and the content of communications exchanged in the customer service and messaging modules;
• Public market data collected by the competition and radar modules (publicly available listings, prices and offer conditions), which as a rule does not constitute personal data;
• Subscription payment data: processed directly by the engaged payment services provider; Ecomy does not store credit card numbers;
• Access logs and technical data: IP address, date and time of access, device and actions performed on the Platform (audit trail), including in compliance with the legal retention duty set forth in Article 15 of the Brazilian Internet Civil Framework.

The processing of personal data by Ecomy is grounded on the following legal bases of Article 7 of the LGPD:

• Performance of the agreement and preliminary procedures (Article 7, V): provision of the Platform, data synchronization with the Integrated Platforms, generation of dashboards, profitability reports, communication automations and other subscribed features;
• Compliance with legal or regulatory obligations (Article 7, II): retention of access logs, response to requests from competent authorities and tax obligations;
• Legitimate interest (Article 7, IX): information security, fraud and abuse prevention, service improvement and defense of rights in judicial, administrative or arbitration proceedings, always within the Data Subject’s legitimate expectations;
• Consent (Article 7, I): sending of marketing communications and product news, revocable at any time, free of charge and by facilitated means.

Ecomy does not sell personal data. Sharing occurs exclusively in the events below, under contractual instruments that ensure confidentiality and data protection obligations consistent with this Policy:

• Infrastructure sub-processors: cloud server providers, content delivery network and application firewall (currently Vultr and Cloudflare) and Amazon Web Services, for object storage (S3) and transactional e-mail delivery (SES);
• Payment services provider, for subscription processing;
• Communication service providers (WhatsApp, SMS and Telegram notifications), when the User uses the messaging and alert modules;
• Carriers and logistics lookup services, for tracking shipments of the User’s orders;
• Artificial intelligence providers, exclusively for subscribed assistive features (such as reply suggestions and copilot analyses), transferring the minimum data necessary for the operation;
• Judicial, administrative or law enforcement authorities, upon legally grounded order or request, pursuant to Article 7, II and VI, of the LGPD.

An updated list of sub-processors may be requested from the Data Protection Officer at any time.

Ecomy’s access to data held on the Integrated Platforms occurs exclusively through official application programming interfaces (APIs), upon the User’s prior, express and specific authorization, and is limited to the scopes strictly necessary for the subscribed features.

Ecomy complies with the data protection policies of each Integrated Platform, including, by way of example, the Amazon Selling Partner API Data Protection Policy and the Partner Center do TikTok data policies, refraining from processing buyer personal data beyond what is strictly made available and necessary.

The User may revoke the authorization at any time, either directly on the Integrated Platform or by disconnecting the integration on the Platform, in which case synchronization will be immediately interrupted.

The main hosting infrastructure of the Platform is currently located in the United States of America (cloud computing providers), with object storage and transactional e-mail delivery performed in the São Paulo, Brazil region (AWS sa-east-1), and content delivery processed globally through the Cloudflare network. The international transfers arising from this architecture comply with Article 33 of the LGPD and are carried out under contractual safeguards executed with the Sub-processors that ensure a level of protection equivalent to the principles and Data Subject rights provided for in Brazilian law.

In compliance with Articles 46 et seq. of the LGPD, Ecomy adopts technical and administrative measures capable of protecting personal data from unauthorized access and from accidental or unlawful destruction, loss, alteration, communication or dissemination, including: encryption in transit (TLS) for all communications; role-based access control under the least-privilege principle; multi-factor authentication on critical infrastructure accounts; web application firewall (WAF); audit trail of collaborator actions; and a formalized incident response plan with defined roles and periodic review.

In the event of a security incident that may entail relevant risk or damage to Data Subjects, Ecomy will notify the Brazilian National Data Protection Authority (ANPD) and the affected Data Subjects, under the terms and deadlines of Article 48 of the LGPD, as well as any impacted Integrated Platforms, in accordance with the applicable policies.

Personal data is retained for as long as the contractual relationship lasts and, after its termination, for the period necessary to comply with legal obligations, to exercise rights in proceedings and for the other events of Article 16 of the LGPD.

Without prejudice to the right of deletion upon the Data Subject’s request, Ecomy runs automated purge routines for operational data: non-converted trial accounts are deleted within 90 (ninety) days from the end of the trial period, and cancelled subscription accounts within 180 (one hundred and eighty) days from the end of the paid period.

Pursuant to Article 18 of the LGPD, the Data Subject may obtain from Ecomy, at any time and free of charge: confirmation of the existence of processing; access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data or data processed in non-compliance; portability; information on sharing; information on the possibility of not providing consent and its consequences; and withdrawal of consent.

Requests shall be addressed to the Data Protection Officer through the channel indicated in this Policy and handled within the deadlines of the legislation and ANPD regulations. The Data Subject may also file a petition directly with the ANPD.

Where Ecomy acts as processor (End Customer data), requests received will be forwarded to the controlling User, to whom Ecomy will provide the cooperation necessary for their fulfillment.

The Platform uses exclusively cookies strictly necessary for authentication, security and session preferences. No third-party behavioral advertising cookies are used. Blocking essential cookies in the browser may impair the operation of the Platform.

Ecomy has appointed a Data Protection Officer, pursuant to Article 41 of the LGPD, who may be contacted at [email protected] for the exercise of rights, clarification of questions and receipt of communications from the ANPD and Data Subjects.

The Platform is intended exclusively for persons over 18 (eighteen) years of age and is not directed at children or adolescents. Should the inadvertent processing of minors’ data be identified, such data will be deleted as soon as detected.

This Policy may be revised to reflect legislative, regulatory or service changes. Material changes will be notified to the User at the registered e-mail address at least 7 (seven) days before taking effect, and the current version, with its date, will remain permanently available on this page. Continued use of the Platform after the new version takes effect will imply awareness of the changes, without prejudice to rights that depend on specific consent.