Privacy & General Policies

Introduction

EagleLytics® (“EagleLytics”) is a product and service operated by LaFountain Design, doing business as Ecomm Eagle (“Ecomm Eagle,” “we,” “us,” or “our”). Ecomm Eagle is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our EagleLytics® platform and services.

The two roles we act in. For information about you — your account, your billing details, and your use of this website — we are the controller: we decide why and how it is processed, and this policy governs it. For the supplier catalogue and store data the Service reads on your instruction when you add a supplier or connect a store, we act as a processor on your behalf: you decide what is monitored and we act on that instruction. Business customers in the EEA or the UK who need a data processing agreement covering that second role should contact us and we will provide one.

Information We Collect

Personal Information

When you register for EagleLytics®, we collect:

• Account Information: Full name, email address, password (encrypted)
• OAuth Data: Name and email from Google OAuth (if using Google sign-in)
• Contact Information: Any information you provide when contacting support

Billing Information

When you subscribe to a paid plan on eaglelytics.com, we collect:

• Billing address and the name on the card, used to calculate sales tax and to identify your invoices
• Card reference: the card brand, the last four digits and the expiry month and year, so you can recognise the card on file
• Subscription and invoice history: plan, billing cycle, charges, payment status and refunds or credits

Full card numbers never touch our servers. Card details are entered directly into Square's payment form and are stored by Square (Block, Inc.). If you subscribe through the Shopify App Store or the BigCommerce App Marketplace, that platform bills you and we receive only the plan, status and charge reference for your subscription — no payment details.

Supplier Credentials

To provide scanning services, we collect and store:

• Supplier platform credentials (API keys, authentication tokens, login credentials)
• Supplier store URLs and platform identifiers
• Supplier names and configuration details

All credentials are encrypted at rest using industry-standard encryption.

Usage Data

• Scan history and results
• Scheduled sync configurations
• Platform connection information
• Application logs and error reports
• IP addresses and browser information (automatically collected)

Cookies and Tracking

We use cookies and similar technologies for:

• Authentication and session management
• Remembering user preferences
• Analytics and performance monitoring, where you have allowed it
• Advertising measurement, where you have allowed it

Only the first of these runs without your permission. See Cookies and Tracking below for the full breakdown of each category and who receives the data.

How We Use Your Information

We use collected information to:

• Provide Services: Process scans, monitor inventory, generate reports
• Account Management: Create and maintain your account, process authentication
• Billing: Charge subscriptions, calculate sales tax from your billing address, issue invoices and receipts, and keep the tax and accounting records the law requires
• Communication: Send service updates, respond to inquiries, provide support
• Improvement: Analyze usage patterns, improve features, optimize performance
• Security: Detect and prevent fraud, abuse, and security incidents
• Compliance: Meet legal obligations and enforce our agreements

Legal Bases for Processing

If you are in the European Economic Area or the United Kingdom, the law requires us to tell you the legal basis on which we process each kind of information. These are ours.

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms and concluded they do not override them. You can object to that processing — see Your Rights and Choices below — and we will stop unless we can show compelling grounds that override your objection, or we need the information to establish, exercise or defend a legal claim. Where we rely on consent, you can withdraw it at any time, and doing so does not affect anything we did lawfully before you withdrew.

Information Sharing and Disclosure

We do not sell your personal information. We may share information in these limited circumstances:

• Service Providers: Third-party services that help us operate (hosting, email, payment processing, analytics) under strict confidentiality agreements — see Third-Party Services for what each receives
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In connection with a merger, acquisition, or sale of assets (you will be notified)
• Protection of Rights: To protect our rights, property, or safety, or that of our users

Data Security

We implement comprehensive security measures to protect your information:

• Encryption: SSL/HTTPS for all data transmission, encryption at rest for sensitive data
• Access Controls: Restricted access to personal information on a need-to-know basis
• Infrastructure: Secure servers, regular security updates, and monitoring
• Authentication: Secure password hashing, OAuth implementation, session management

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Data Retention

We retain your information for as long as necessary to provide services and fulfill the purposes outlined in this policy:

• Account Data: Retained while your account is active
• Scan results: the five most recent completed scans per supplier. When a new scan completes, older ones beyond that limit are deleted automatically, including their product data. A scan attached to an active sync schedule is kept until that schedule is changed or removed.
• Sync reports: the ten most recent per connected store, then deleted automatically
• Consent records: 2 years, so we can show what you were asked and what you answered
• Security and audit logs: 1 year
• Deleted Accounts: Data retained for 30 days for recovery, then permanently deleted
• Billing, invoice and tax records: 7 years, as required for tax and accounting purposes, even after the account is closed
• System logs: 90 days for troubleshooting and security

Your Rights and Choices

You have the following rights regarding your personal information:

• Access: request a copy of your personal data and of the information in this policy as it applies to you
• Correction: update or correct inaccurate information
• Deletion: request deletion of your account and data, subject to records we are required to keep, such as invoices held for tax purposes
• Portability: receive the personal data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where that is technically feasible
• Restriction: ask us to stop processing while a dispute about accuracy or about our legitimate interests is resolved — we keep the data but stop using it
• Objection: object to processing we base on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. You can object to direct marketing at any time and we will stop, with no balancing test.
• Withdraw consent: where we rely on your consent, withdraw it at any time and as easily as you gave it, from Cookie Preferences in the footer. Withdrawing switches the relevant tags off and deletes the cookies they set. It does not affect processing carried out lawfully before you withdrew.
• Complain: lodge a complaint with a supervisory authority, in particular in the country where you live, where you work, or where you think the problem happened. In the UK that is the Information Commissioner's Office; in the EEA it is your national data protection authority. You do not have to come to us first, though we would like the chance to put it right.
• Opt-Out: unsubscribe from marketing communications
• Cookie Control: Choose which cookie categories run from Cookie Preferences, or opt out of sale and sharing at Your Privacy Choices

To exercise these rights, contact us through the Contact page or email support@eaglelytics.com.

Cookies and Tracking

Nothing but strictly necessary cookies runs until you tell us it may. On your first visit you are asked, and no analytics or advertising tag loads before you answer. You can change your answer whenever you like from the Cookie Preferences link in the footer.

The cookies themselves

The named cookies below are the ones this site sets or allows. Analytics and marketing tags are configured by us in the admin panel, so the exact set in the last two rows depends on which are switched on; every one of them is off until you allow its category, and withdrawing consent deletes them.

What withdrawal actually does. Turning a category off does not only record a preference. We tell Google to stop measuring for the affected property, we revoke consent on the Meta pixel where one is present, and we delete the cookies in that category from your browser — on this site and on every parent domain they could have been scoped to. The same clean-up runs when you next load a page, so a cookie left behind from an earlier visit does not survive.

Embedded video. Our marketing pages embed videos hosted by YouTube. They load from youtube-nocookie.com, and until you allow marketing cookies they are not loaded at all — you see a still image and press play if you want the video, which is the point at which YouTube first learns of your visit.

Global Privacy Control. We honour the GPC signal. If your browser sends it we treat it as a valid request to opt out of the sale and sharing of your personal information, we apply it immediately without asking you anything, and we will not prompt you to reverse it while the signal is on. Browsers that send GPC include Brave, DuckDuckGo and Firefox, and several extensions add it to others.

California Privacy Rights (CCPA / CPRA)

This section applies to California residents and is provided under the California Consumer Privacy Act as amended by the California Privacy Rights Act. Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comparable laws have substantially the same rights, and we handle those requests the same way.

What we collect, why, and who receives it

We collect these categories from you directly, from your use of the service, and from the platforms you connect. We do not buy personal information from data brokers, and we do not knowingly collect or sell the personal information of anyone under 16.

Your rights

• Opt out of sale and sharing — stop the disclosure of your identifiers and browsing activity to advertising partners. Use Your Privacy Choices, turn off Marketing in cookie preferences, or send a Global Privacy Control signal. No account and no identity verification is needed.
• Know and access — the specific pieces of personal information we hold, the categories, their sources, our purposes, and the categories of third party we disclosed them to.
• Delete — subject to the exceptions the statute allows, such as records we must keep for tax or fraud purposes.
• Correct — inaccurate personal information.
• Portability — a copy in a portable, machine-readable format.
• Limit the use of sensitive personal information — we already confine it to providing the service, so there is nothing further to limit.
• Appeal — ask us to reconsider a decision, which we will answer in writing.
• Non-discrimination — we will not deny you service, charge you a different price, or give you a lesser quality of service for exercising any of these rights. We operate no financial-incentive programme.

How to make a request

Email support@eaglelytics.com or use our contact form. We confirm receipt within 10 business days and respond within 45 days, telling you if we need the further 45 days the statute permits. For access, deletion and correction we must verify your identity — usually by asking you to send the request from the email address on the account — so that we do not hand your information to someone else. Opting out of sale or sharing requires no verification at all.

An authorised agent may submit a request on your behalf with written permission signed by you; we may still contact you to confirm it.

Requests we received

Where the CCPA metrics obligation applies to us, we publish the number of requests received, complied with and denied, and our median response time, in this policy each year. Ask us at support@eaglelytics.com for the current figures at any time.

Third-Party Services

EagleLytics® integrates with third-party services:

• Google sign-in: For authentication (subject to Google's Privacy Policy). Receives: the fact that you signed in to EagleLytics®. We receive from Google your name, email address and account identifier.
• E-commerce Platforms: Shopify, BigCommerce, WooCommerce, Magento, Squarespace (for scanning purposes)
• Hosting Provider: DigitalOcean (infrastructure hosting)
• Square (Block, Inc.): Payment processor for subscriptions bought on eaglelytics.com. Receives: your name, email address, billing address, the card you enter into Square's payment form, and your payment history. Square stores the card; we never see the full card number.
• Shopify Billing: Bills subscriptions started from the Shopify App Store, under Shopify's terms. Receives: the plan name and price you approve. We receive from Shopify the subscription status and charge reference only.
• BigCommerce Billing: Bills subscriptions started from the BigCommerce App Marketplace, under BigCommerce's terms. Receives: the plan name and price you approve. We receive from BigCommerce the subscription status and checkout reference only.
• Email: SendGrid (transactional email delivery)
• Analytics: Google Analytics and Google Tag Manager — only with your analytics consent
• Advertising: Google Ads, Meta and LinkedIn where configured — only with your marketing consent
• Embedded video: YouTube (youtube-nocookie.com), loaded only when you press play

These services have their own privacy policies, and we encourage you to review them.

Children's Privacy

EagleLytics® is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we discover that a child has provided us with personal information, we will delete it immediately.

Automated Decision-Making

We do not make decisions about you by automated means that produce legal effects concerning you or similarly significantly affect you. There is no automated profiling of people, no automated scoring of individuals, and no automated approval or refusal of accounts.

The Service does assess things automatically, but they are not people. A supplier website is checked against our compatibility rules — platform, robots.txt, location and blocklist — and suppliers carry an accuracy score derived from their recent scan history. Those assessments are about websites and catalogues, not about you. Where one blocks a supplier you can ask us to review it and a person will.

International Data Transfers

We are based in the United States and our service providers process information there, so information about visitors and customers in the EEA or the UK is transferred out of those regions.

We do not rely on your consent for those transfers. Consent is a derogation the law reserves for occasional cases, and routine hosting is not one of them. Each transfer is made under one of the following instead:

• The EU-US Data Privacy Framework and its UK extension, where the provider receiving the data is certified under it.
• Standard contractual clauses adopted by the European Commission, with the UK International Data Transfer Addendum where the UK GDPR applies, for every provider that is not certified.

The providers we use are named in Third-Party Services above. Write to support@eaglelytics.com and we will tell you which mechanism covers a particular provider and give you a copy of the relevant clauses.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification. The "Last Updated" date at the top indicates when the policy was last revised. Your continued use after changes take effect constitutes acceptance of the revised policy.