Legal
Privacy Policy
Data controller: Jan Derdelinckx, eenmanszaak · Belgium
Effective date: [DATE] · Last updated: [DATE]
1. Who we are
EcomVue (operated by Jan Derdelinckx, a sole trader established in Belgium) is an online AI visibility audit tool for e-commerce stores. This Privacy Policy explains what personal data we collect when you use ecomvue.ai (the "Service"), why we collect it, how we use it, and your rights under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the Belgian Data Protection Act of 30 July 2018, and — for California residents — the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
Data controller:
Jan Derdelinckx (trading as EcomVue)
Moleneindstraat 38, 9160 Lokeren, Belgium
Email: hello@ecomvue.ai
We have not appointed a Data Protection Officer, as this is not required for a business of our size and processing activities under GDPR Art. 37. Direct data protection queries to the contact above.
2. Data we collect and why
2.1 Data you provide
| Data | When collected | Why |
|---|---|---|
| Store URL | When you submit a URL | To generate your Report — the core service |
| Email address | At checkout, account sign-up, or optionally for updates | To deliver your Report link, purchase confirmation, and account/subscription management |
| Account credentials | Creating an account for a Subscription Plan | To authenticate you and secure access to your dashboard |
| Competitor URLs | Using competitor-tracking features (Pro/Agency) | To generate the competitor comparison Reports you requested |
2.2 Data collected automatically
| Data | When collected | Why |
|---|---|---|
| Payment transaction data | At checkout, via Lemon Squeezy | To confirm payment and unlock your Report or Subscription |
| Report ID and status | On Report generation | To associate your payment with your Report |
| IP address and browser metadata | On each page visit; also used for API rate-limiting (Upstash) | Security monitoring and abuse prevention (retained 30 days) |
What we do not collect:
- ✓We do not collect payment card numbers or CVV codes — handled entirely by Lemon Squeezy.
- ✓We do not build behavioural advertising profiles or use your data for third-party targeted advertising.
- ✓We do not sell your personal data to any third party, and have not done so in the preceding 12 months.
- ✓We do not knowingly process special category data (GDPR Art. 9) or "sensitive personal information" under the CPRA.
- ✓We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
3. Legal bases for processing (GDPR Art. 6)
| Processing activity | Legal basis |
|---|---|
| Generating your Report from the submitted URL | Performance of a contract (Art. 6(1)(b)) |
| Processing payment and delivering Report/Subscription access | Performance of a contract (Art. 6(1)(b)) |
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Storing your email for purchase confirmation | Performance of a contract (Art. 6(1)(b)) |
| Server/security logs and rate-limiting (IP address, metadata) | Legitimate interests (Art. 6(1)(f)) — protection against fraud, abuse, and service disruption |
| Sending product updates or marketing emails | Consent (Art. 6(1)(a)) — only where you have opted in |
| Legal compliance (e.g. VAT records) | Legal obligation (Art. 6(1)(c)) |
4. Sub-processors and third-party recipients
To deliver the Service, we share your data with the following processors. Each is engaged under contractual terms consistent with GDPR.
Anthropic, PBC
Privacy policy →Lemon Squeezy
Privacy policy →Supabase, Inc.
Privacy policy →Vercel, Inc.
Privacy policy →Upstash, Inc.
Privacy policy →Resend, Inc.
Privacy policy →Klaviyo, Inc.
Privacy policy →We do not share your personal data with any other third party except where required by law (e.g. a court order or request from a competent authority), or in connection with a merger, acquisition, or sale of business assets (in which case you will be notified as required by law).
5. International data transfers
Some of our sub-processors (Anthropic, Lemon Squeezy, Vercel, Resend, Klaviyo) are based in the United States, which does not have a blanket EU adequacy decision. We ensure these transfers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Art. 46(2)(c), and in applicable cases, the EU–US Data Privacy Framework.
If you would like more information about the specific transfer mechanisms in place, contact us at hello@ecomvue.ai.
6. Data retention
| Data | Retention period |
|---|---|
| Report content (store URL, Report JSON) | 12 months from date of generation, then permanently deleted |
| Account data (email, credentials, subscription history) | While your account is active, plus 24 months after cancellation, or until you request deletion |
| Email address (one-time purchase, no account) | 24 months from last purchase, or until you request deletion |
| Payment transaction records | 7 years (required by Belgian accounting and VAT law) |
| Server/security logs (IP address) | 30 days |
| Rate-limiting counters (Upstash) | Minutes to hours (sliding window) |
| Email marketing consent and activity | Until you withdraw consent or unsubscribe |
7. Your rights under GDPR
To exercise any of the following rights, contact hello@ecomvue.ai. We will respond within 30 days and may ask you to verify your identity.
| Right | What it means |
|---|---|
| Right of access (Art. 15) | Request a copy of the personal data we hold about you |
| Right to rectification (Art. 16) | Ask us to correct inaccurate or incomplete data |
| Right to erasure (Art. 17) | Ask us to delete your data, subject to legal retention obligations |
| Right to restrict processing (Art. 18) | Ask us to limit how we use your data while a dispute is resolved |
| Right to data portability (Art. 20) | Receive your data in a structured, machine-readable format |
| Right to object (Art. 21) | Object to processing based on legitimate interests |
| Right to withdraw consent (Art. 7(3)) | Withdraw marketing consent at any time via the unsubscribe link |
Supervisory authority
If you believe we are not handling your data correctly, you have the right to lodge a complaint with:
Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD)
Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, Belgium
8. Your privacy rights under CCPA/CPRA (California residents)
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), gives you the following rights regarding your personal information ("PI"):
| Right | What it means |
|---|---|
| Right to know | Disclosure of categories/specific PI collected, sources, purposes, and categories of third parties it was disclosed to (preceding 12 months) |
| Right to delete | Request deletion of PI we've collected from you, subject to legal exceptions (e.g. completing a transaction, legal compliance, security) |
| Right to correct | Request correction of inaccurate PI we maintain about you |
| Right to opt out of sale/sharing | We do not sell or “share” (incl. for cross-context behavioural advertising) your PI — nothing to opt out of today |
| Right to limit use of sensitive PI | We do not collect “sensitive personal information” under the CPRA, so this is not currently applicable |
| Right to non-discrimination | We will not deny goods/services, charge different prices, or reduce service quality because you exercised a CCPA/CPRA right |
Categories of PI collected (Cal. Civ. Code § 1798.140): identifiers (email, IP address), commercial information (purchase/subscription history), internet or network activity (page visits, server logs), and account information — collected for the business purposes in Section 2 (providing the Service, payment processing, security, and, with consent, marketing).
How to submit a request: email hello@ecomvue.ai with "CCPA Request" in the subject line. We verify your identity using the email/order details tied to your use of the Service and respond within the timeframes required by the CCPA/CPRA (generally 45 days, extendable once by 45 days with notice).
Authorized agent: you may designate an agent to submit a request on your behalf; we may require proof of authorization and independent identity verification.
Shine the Light (Cal. Civ. Code § 1798.83): we do not share personal information with third parties for their own direct marketing purposes, so no disclosure request is applicable.
Financial incentives: we do not currently offer any financial incentive or price/service difference in exchange for retention, sale, or sharing of personal information.
9. Cookies and tracking
EcomVue uses only the cookies and local storage strictly necessary to operate the Service (e.g. authentication session, storing a Report ID in the browser session). We do not use advertising or analytics tracking cookies, and we do not use cookies to sell or share personal information as defined under CCPA/CPRA. If we introduce optional analytics or marketing cookies in the future, we will update this policy and seek your consent (EU/UK visitors) or provide an opt-out (California visitors) before placing them.
EcomVue Lens Chrome Extension
The EcomVue Lens extension analyzes page metadata and visible content only when activated by the user. See our Extension Privacy Policy for full details.
10. Children
The Service is not directed at children under 16 (or under 13 for CCPA purposes) and we do not knowingly collect personal data from children. We do not knowingly sell or share the personal information of consumers under 16 years of age. If you believe a child has submitted data through the Service, contact us and we will delete it promptly.
11. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified via a prominent notice on the website at least 14 days before taking effect. The "Last updated" date at the top will always reflect the most recent revision.
12. Contact
Privacy enquiries and data subject requests (GDPR or CCPA/CPRA):
Email: hello@ecomvue.ai
Address: Moleneindstraat 38, 9160 Lokeren, Belgium
We aim to respond to all privacy enquiries within 5 business days, and to formal requests within the timeframes required by applicable law (30 days under GDPR, up to 45 days under CCPA/CPRA).