Privacy Policy

This Privacy Policy ("Policy") explains how EcomVision EcomVision Tecnologia Ltda. (Brazilian taxpayer ID CNPJ 47.237.851/0001-16), Rua Bras Pierro, 134, Jardim Nossa Senhora Auxiliadora, Campinas, SP, 13075-510, Brazil ("EcomVision," "we," "us," or "our") collects, uses, stores, shares, protects, retains, and deletes information when providing the EcomVision platform — our marketing website, web app (app.ecomvision.com.br), mobile web version, and mobile apps (the "Service").

For data obtained through Amazon's APIs, we also follow the Amazon Services API Acceptable Use Policy and Data Protection Policy. By using the Service, you ("you" or "user") acknowledge that you have read and understood this Policy.

1. Summary in plain English

• We collect the data needed for you to create an account, connect your Amazon accounts, and use the platform.
• We access your Amazon account data only after you authorize it (OAuth), and use it solely for your benefit.
• We do not sell your personal information and do not share it for third-party marketing or cross-context behavioral advertising.
• Credentials and sensitive data are encrypted; buyer data is minimized and pseudonymized.
• You can access, correct, export, and delete your data and revoke access at any time.
• We send reports you configure and notices about platform updates and new articles by email and, if you connect it, Telegram. You choose what you receive and can unsubscribe at any time (see section 4.1).

2. Who this Policy applies to

This Policy applies to people who use the Service — Amazon sellers, their teams, and authorized agencies. It does not apply to third-party services (Amazon, financial institutions, payment providers), which have their own policies. The Service is intended for professional use by individuals 18 or older.

3. Information we collect

3.1. Information you provide: registration and account details (name, email, phone, password stored as a hash, company/brand); emails and roles of invited team members; payment information (payments are processed by our payment provider Stripe, which handles full card details — we do not store full card numbers); the content of support messages; and, if you connect Telegram to our bot (@EcomVisionNewsBot), the chat ID and profile name that Telegram provides at the time of connection.

3.2. From your Amazon accounts (with your authorization): through official APIs, only what is needed for the features you use — Amazon Ads API (campaigns, keywords, bids, metrics, search terms, placements) and Selling Partner API (sales and orders, fees, payouts/settlements, inventory, listings/catalog, and FBA shipments).

3.3. Financial data (reconciliation): transaction data from OFX/CSV files you upload. Bank connection through Open Finance (Pluggy) is available only for Brazilian bank accounts and, if you choose it, requires your consent, which you can revoke at any time.

3.4. End-buyer data (third parties): some features process order data that may contain personal information. We apply minimization, pseudonymization (hash-derived keys), and encryption. For this data we act as a service provider/processor on behalf of the seller.

3.5. Usage information: logs and technical data (IP address, date/time, actions, device, errors), cookies, and, in the mobile app, device permissions you grant — for example, microphone (Vision voice) and notifications.

3.6. Vision (AI): the content of your questions and the necessary context are processed to generate answers (see section 5).

4. How we use information

• To create and manage your account, authenticate access, and provide the features.
• To access and sync data from your connected Amazon accounts.
• To reconcile financial data you upload or connect.
• For billing, invoicing, and collections.
• To operate, secure, and improve the platform, including fraud prevention.
• To understand where sign-ups come from (channel, campaign, and affiliate), to evaluate our marketing and pay affiliate commissions (see section 6.1).
• To comply with legal, tax, and regulatory obligations.
• To send reports and alerts you configure in Push Reports (email and/or Telegram).
• To send notices about platform updates and new articles on our website (email and/or Telegram), with the option to unsubscribe at any time; we do not send article notices to users who opted out of marketing communications in their profile.
• For other communications about the Service.

We use Amazon account data solely for the benefit of the seller who owns the account. We do not sell data and do not share it for advertising.

4.1. Email and Telegram notices — how to choose and how to stop

• What we send: reports and alerts you configure; notices when we publish platform updates; and notices when we publish new articles on our website. Every update or article notice is reviewed by EcomVision before it is sent. We do not use these channels for third-party ads.
• How to choose: in the app, under Push Reports, you decide whether to receive each type of notice, on which channel (email, Telegram, or both), and how often.
• By email: every notice email includes an "unsubscribe" link that stops that type of notice with one click, without signing in.
• On Telegram: send /stop to @EcomVisionNewsBot, block the bot, or click Disconnect in Push Reports — the link to your chat is deleted immediately. The public channel @EcomVisionNews is optional: you join and leave it in Telegram itself, and we do not receive its list of followers.
• We record each subscription and unsubscribe (date, channel, and source) as proof of your choice. Essential account messages (security, billing, contract changes) continue while your account is active.

5. Artificial Intelligence (Vision)

• Vision uses third-party AI models (currently from Anthropic) to generate analyses, recommendations, and text.
• We send only the content needed (your question and the context of the selected account).
• Under the provider's commercial API terms, your data is not used to train the models.
• Answers are generated automatically, may contain inaccuracies, and are decision support only.

6. Cookies and website analytics

On our marketing website, in addition to essential preference storage, we use Google Analytics (GA4) and Microsoft Clarity to understand how the site is used and improve its content — visits, page views, button clicks, and (via Clarity) heatmaps and anonymized session recordings, without capturing sensitive data typed into forms.

This tracking is enabled only with your consent, given in the banner shown on your first visit. Until you accept, no measurement data is sent to Google (we use Google Consent Mode) and the Microsoft Clarity script does not load in your browser. You can decline without affecting browsing or site functionality, and you can change your mind by clearing your browser storage for this site (the banner will reappear on your next visit).

The app (app.ecomvision.com.br) does not use third-party tracking cookies or analytics — only the essential/functional storage described in section 3.5 and the sign-up source record described in section 6.1.

6.1. Where your sign-up came from

When you create an account, we record where the visit that led to your sign-up came from: the referring site (domain only, e.g., google.com), the page of our site where you landed, the link's campaign parameters (utm_source, utm_medium, and utm_campaign), and, if you came through an affiliate link, that affiliate's code. If you answer, we also store how you heard about EcomVision (an optional sign-up question).

To remember this source until you sign up, the website and the app store this data in your browser for up to 30 days. If you arrived from a Google ad and accepted the cookie banner, we also store the ad click ID (gclid); without consent, we record only that the visit came from an ad, without identifying it.

We use this data only to understand which channels bring new customers and to attribute affiliate commissions. The only exception is the ad click ID (gclid): when present, we report to Google Ads the sign-up date and, if applicable, the date and amount of the first subscription payment, to measure our ad results — without your name, email, ID, or any other personal data. Otherwise, we do not share this data with third parties.

7. AI Connectors (Claude and ChatGPT)

• You can connect EcomVision to your own AI assistant — currently Claude (Anthropic) and ChatGPT (OpenAI) — to query your accounts through conversation.
• You set up the connection with your EcomVision login, and it is read-only: the assistant queries ad, sales, cost, profit, and listing metrics for the accounts you already access in EcomVision. Nothing is changed on Amazon or on the platform.
• Account data is sent to the AI provider only when you ask a question that requires it, and is then handled by that provider under the terms and privacy policy of your Claude or ChatGPT account. EcomVision does not control how conversations are stored by those services.
• We do not receive the full content of conversations — only the parameters of each query (for example, the campaign or period requested). We log connector usage (tool called, user, date and time, and response time) for security, usage limits, and support, for up to 12 months.
• You can disconnect at any time in your Claude or ChatGPT settings. Changing your EcomVision password also revokes all granted authorizations.

8. Automated actions

Automations apply changes according to rules you configure or actions you approve (Vision's "Act" mode). You can define, review, and turn off rules, use simulation mode, and request a review of automated decisions by contacting us.

9. Sharing and sub-processors

We do not sell data. We share only what is necessary, with service providers bound by contract and security obligations:

We may also share information when required by law, in a corporate reorganization, merger, or acquisition (under the same obligations), or with people or agencies you authorize to manage your account.

10. International data transfers

EcomVision and some of its service providers may be located outside the United States, and your information may be processed in other countries (for example, in Brazil, in the United States for hosting and AI, in the European Union for email delivery and, if you connect it, on Telegram's infrastructure). Data protection laws in those countries may differ from those in your state. We use contractual data protection terms and appropriate security standards to protect information wherever it is processed.

11. Retention and deletion

• Registration and account: while the account is active and for a reasonable period after it is closed.
• Daily reports: a recent rolling window; aggregated data may be kept longer.
• Credentials/tokens: until revoked or the account is closed.
• AI connector usage logs: up to 12 months.
• Tax and billing records: for the periods required by applicable law.
• Telegram link (chat ID and name): until you disconnect, send /stop, block the bot, or delete the recipient.
• Notice subscription and unsubscribe records: while the account exists and as long as needed to prove your choice.

12. Security

We use encryption at rest for credentials and sensitive data, TLS/HTTPS in transit, hashed passwords, pseudonymization and minimization, role-based access control, isolation between accounts (multi-tenant), and audit logs. No system is 100% secure; we continuously improve our safeguards and maintain incident response procedures.

13. Our role and multi-user accounts

For registration and usage data of your users, we act as a business/controller. For buyer and business data processed from your accounts, we act as a service provider/processor on your behalf. In accounts managed by agencies or with multiple members, data may be accessed by the people you authorize, according to their permissions.

14. Security incidents

If an incident creates a significant risk, we will notify affected users and, where required, the competent authorities within the timeframes required by applicable law, and take steps to mitigate it.

15. Your privacy rights

Depending on your state of residence, you may have the right to: know and access the personal information we hold about you; correct it; delete it; obtain a portable copy; opt out of the sale or sharing of personal information and of targeted advertising (we do not sell or share it for those purposes); limit the use of sensitive personal information; and appeal a decision we make about your request. You can also revoke access to your Amazon accounts (in Seller Central) and close your account at any time.

California residents: under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), you have the rights to know, access, correct, and delete your personal information, to opt out of its sale or sharing, and to limit the use of sensitive personal information. We do not sell or share personal information as those terms are defined in the CCPA/CPRA, and we will not discriminate against you for exercising your rights. You may use an authorized agent to submit a request on your behalf.

To exercise any of these rights, email help@ecomvision.tech. We may need to verify your identity before fulfilling your request.

16. Children

The Service is intended for individuals 18 or older. We do not knowingly collect personal information from children under 13 or from minors.

17. EcomVision Radar extension (Chrome and Opera)

This section specifically describes how the "EcomVision Radar" extension, published for Google Chrome and Opera (same code and same data handling in both browsers), processes data, in addition to the sections above.

• What the extension reads: when you open an Amazon.com or Amazon.com.br product page, it identifies the ASIN of the active page and, when you act, reads elements of the page itself (title, brand, category, bullets, images) — locally, in your browser.
• What it sends to our backend: the ASIN and marketplace of the open page, to fetch price/BSR/reviews (via Keepa) and, when the ASIN belongs to an account you manage, that account's real P&L. Questions to Vision follow section 5.
• Authentication: when you connect the extension, a session token scoped to Radar only is kept in the extension's local storage (chrome.storage.local, also used by Opera) — never in the localStorage of any website you visit.
• Permissions (host_permissions): amazon.com.br, amazon.com, and the EcomVision API domain. No other site is accessed.
• What the extension does NOT do: it does not show ads, does not sell browsing data, does not track you outside the product research flow, and is read-only — it takes no write action on your Amazon account.
• Disconnect/uninstall: revokes the local token immediately. Data already sent follows the retention in section 11.

18. Changes to this Policy

We may update this Policy. The effective date above indicates the current version; we will communicate material changes through the Service.

19. Contact

For any matter, including privacy and exercising your rights: help@ecomvision.tech. Privacy contact: Nestor Sartoretto (Data Protection Officer), help@ecomvision.tech. Company: EcomVision Tecnologia Ltda. (Brazilian taxpayer ID CNPJ 47.237.851/0001-16), Rua Bras Pierro, 134, Jardim Nossa Senhora Auxiliadora, Campinas, SP, 13075-510, Brazil.