Privacy Policy

Effective Date: October 5, 2026

Ecordio (“we,” “our,” or “us”) is an order management platform for online sellers (“merchants”). This Privacy Policy explains what personal data we process, why, where it is stored, how long we keep it, and the choices available to you.

1. Our Role

We handle personal data in two different roles:

As a controller for merchant account data (the people who sign up for and use Ecordio) and for visitors to this website.
As a processor for the data of a merchant's own customers, which we receive from the merchant's connected stores and process only on the merchant's instructions, under our Data Processing Agreement. If you bought from a store that uses Ecordio, that store is responsible for your data; please contact them first.

2. Information We Collect

Merchant account information

Name and email address
Password (stored only as a salted one-way hash, never in readable form)
Workspace or business name
Roles and permissions of workspace members you invite

Data from connected stores

When you connect a store (currently Shopify or WooCommerce), you authorize access through that platform. We then sync:

Store name, domain and identifiers
Orders: order number, status, dates, totals, taxes, shipping charges, discounts and discount codes, refunds, sales channel, tags and order notes
Line items: product title, variant, SKU, quantity, price, image
Fulfillments: carrier, tracking number and tracking link
The customer's name and email address on each order, so merchants can identify and manage the order

We do not collect customers' phone numbers, shipping or billing addresses, or any payment card details.

Technical information

To serve requests and protect the service against abuse, we briefly process IP addresses. Our service logs are kept to what we need to run and secure the service, and do not record customer details.

Website analytics

With your consent, this marketing website (ecordio.com) uses Google Analytics to understand how visitors use it. Google Analytics then sets cookies and receives your IP address, browser and device information. If you decline, Google Analytics is not loaded at all. The Ecordio app itself does not use analytics or advertising cookies.

3. How We Use Information

We use personal data only to:

Provide the service: sync, display and manage your orders
Create and secure your account, and send account emails such as invitations and password resets
Respond to support requests
Protect the service against fraud, abuse and security threats
Comply with legal obligations

We do not sell personal data, share it for advertising, or use it to build profiles. We do not use personal data for automated decisions that have legal or similarly significant effects on anyone.

4. Service Providers

We use a small number of service providers to run Ecordio, such as cloud hosting and email delivery. They process data only on our instructions. The categories are described on our Sub-processors page, where merchants can also request the full list.

We may also disclose information when required by law, or to a successor in a merger or acquisition, under equivalent protections.

5. Where Data Is Stored

Ecordio's application and database are hosted with a cloud infrastructure provider in Singapore. If you are located elsewhere, your data is transferred to and processed in Singapore. Where the law requires it, we rely on appropriate safeguards for these transfers.

6. Security

All traffic is encrypted in transit with HTTPS
Store access credentials, order notes and backups are encrypted at rest with industry-standard (AES-256) encryption
Passwords are stored only as salted one-way hashes, never in readable form
Access within a workspace is controlled by roles and permissions
Administrative access by our staff is restricted and audit-logged

See our Security page for more detail, including how we respond to incidents. No system is perfectly secure, but we work to protect your data and will notify affected merchants of a personal-data breach within 48 hours of confirming it.

7. Data Retention

Connected store data is kept while the store is connected. When a store is disconnected or the Ecordio app is uninstalled, its access credentials are erased immediately and all of its synced data (orders, customers' names and emails, products) is permanently deleted within 30 days. For Shopify stores this usually happens 48 hours after uninstalling, when Shopify sends its deletion request.
Customer deletion requests received through Shopify are applied immediately: the customer's name, email and order notes are removed from their orders and are not re-imported.
Deleted records and webhook logs are permanently removed after 30 days.
Account data is kept while your account is active and deleted when you ask us to close it.
Backups are encrypted and kept for 7 days, so deleted data may remain in an encrypted backup for up to 7 days before the backup expires.

8. Your Rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to withdraw consent. Merchants can exercise these rights by contacting us. If you are a customer of a merchant, please contact that merchant; we will help them respond. We honour customer data and deletion requests that merchants send us through Shopify.

9. Cookies

The Ecordio app uses only the storage it needs to keep you signed in. This website asks before setting any analytics cookies, and remembers your choice in your browser. You can change it at any time with the “Cookie settings” link at the bottom of every page.

10. Children's Privacy

Ecordio is intended for businesses and is not directed to anyone under the age of 18.

11. Changes

We may update this Privacy Policy from time to time. The current version is always published on this page with its effective date. If we make material changes, we will notify merchants by email.

12. Contact

For privacy questions or requests, email support@ecordio.com.