Legal

Privacy Policy

We built Eco to help brands sell more sustainably — and we treat your data with the same care. This policy explains what we collect, why, and the choices you have.

Last updated: —

Short version: We collect only what we need to run your store and serve your customers, we never sell your data, and you can ask us to export or delete it at any time.

1. Overview

This Privacy Policy describes how the Eco e-commerce platform (“Eco”, “we”, “us”) handles personal information when you visit our website, create an account, or use our services as a merchant or shopper. It applies to ecommerce-promo and the broader Eco platform.

By using Eco, you agree to the practices described here. If you are a merchant, you are also responsible for the privacy notices you provide to your own customers whose data you process through Eco.

2. Who we are

Eco is operated by the Eco E-commerce Platform team. For privacy questions, you can reach our data protection contact at the details in Section 13.

If you are in the European Union or United Kingdom, the controller of your personal data is Eco E-commerce Platform, and we act as a processor when handling end-customer data on behalf of a merchant.

3. What we collect

We collect information in three ways: information you give us, data generated by your use of Eco, and data from third parties.

Information you provide

Account data: name, email, password (hashed) and business details when you sign up via Firebase authentication.
Company configuration: brand name, company name, address, phone, email, website, tax ID and registration number you configure for invoices.
Store content: products, categories, brands, promo codes, loyalty rules and reviews you create.
Customer data you enter: shopper names, emails, phone numbers and shipping addresses used for orders and invoices.
Communications: messages you send us, support requests and email newsletter preferences.

Information collected automatically

Usage & device data: IP address, browser type, pages viewed, referral source and interaction events.
Order & loyalty data: order history, invoice records, and earned/redeemed purchase points.
Cookies & similar tech: see Section 5.

4. How we use your information

Provide, operate and secure the Eco platform and your storefront.
Process orders, generate branded PDF invoices and send invoice emails.
Calculate and manage promo-code discounts and loyalty points.
Authenticate users and prevent fraud or abuse.
Send transactional messages (order updates, account security) and, where permitted, marketing you can opt out of.
Analyze usage to improve performance, reliability and new features.
Comply with legal obligations (tax, accounting, lawful requests).

We rely on contract, legitimate interests, consent (for marketing/cookies) and legal obligation as lawful bases under applicable data-protection law.

5. Cookies & tracking

We use cookies and similar technologies to keep you signed in, remember preferences, measure performance and tailor content. Categories include:

Strictly necessary: authentication, security and load balancing (always on).
Functional: language, region and UI preferences.
Analytics: aggregated usage metrics to improve Eco.
Marketing: only with your consent, used to measure campaigns.

You can manage non-essential cookies through our cookie banner and your browser settings. Disabling some cookies may affect functionality.

7. Data retention

We keep personal data only as long as necessary for the purposes above:

Account and company data: for the life of your account, deleted within 30 days of closure.
Order, invoice and loyalty records: retained for the period required by tax/accounting law (commonly 5–7 years), then removed or anonymized.
Usage analytics: aggregated or deleted within 14 months.
Marketing data: until you withdraw consent or unsubscribe.

8. How we protect your data

Security is built in, not bolted on. Eco uses Firebase authentication, encrypted configuration, role-aware admin access, encrypted connections (TLS) in transit, and access controls on our databases. We monitor for threats and limit internal access to what is strictly required.

No method of transmission or storage is 100% secure, but we work continuously to protect your information and notify affected users where the law requires.

9. Your rights

Depending on your location, you may have the right to:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Request deletion (“right to be forgotten”) or restriction of processing.
Object to processing based on legitimate interests or direct marketing.
Data portability — receive your data in a structured format.
Withdraw consent at any time (without affecting prior lawful processing).
Lodge a complaint with your local supervisory authority.

To exercise any right, email our privacy team. We respond within statutory timeframes (generally 30 days) and may verify your identity first.

10. Children’s privacy

Eco is intended for businesses and users aged 16 or older (or the minimum age in your country). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

11. International data transfers

Eco operates globally, so your information may be processed outside your home country, including in the United States. Where we transfer data across borders, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy mechanism.

12. Changes to this policy

We may update this Privacy Policy as Eco evolves. Material changes will be announced via the website or email. The “Last updated” date reflects the latest revision, and continued use after changes means you accept the updated policy.

13. Contact us

Questions, requests or concerns about privacy? Reach us:

Email: query@ecosoft.lk
Mail: Eco E-commerce Platform — Kokkuvil, Jaffna
Through the site: start a conversation