Privacy Policy

Version 2026-11-11.

1. Who we are

The service ecomlune (the "Service") is provided by Anna Shulim (ecomlune), a sole trader registered in Spain, NIF Z0093196M, Zona Franca 27, 08038 Barcelona, Spain. Contact for privacy questions: info@ecomlune.com. We decide why and how your data is processed (we are the "controller").

2. What data we process

  • Account: email, name, language, and a one-way fingerprint of your password (never the password itself). If you turn on two-factor sign-in, an encrypted secret for it.
  • Store data you give us: the link or file of your product feed (titles, prices, photos, links), brand settings (logo, colors), groups, designs and the reports you upload.
  • Activity: a log of important actions in your account (sign-in changes, store changes) and technical server logs.
  • Assistant chats: the messages you send to the in-product assistant and its replies.
  • Payments: Paddle processes your payment. We receive your subscription status, plan, billing country and Paddle customer ID. We never see your card number.

We do not use advertising or analytics trackers on the website or in the dashboard.

3. Why we process it and on what basis

  • To provide the Service you asked for, including the free trial and your subscription (performance of a contract).
  • To keep the Service secure and prevent abuse (our legitimate interest).
  • To send service emails: confirmation, password reset, security notices and the end of the trial (performance of a contract).
  • To meet tax and accounting duties (legal obligation).

4. Who receives data

  • Railway: hosting and storage in the EU (Amsterdam region).
  • Paddle (Paddle.com Market Ltd): our reseller and Merchant of Record. Paddle processes payment and billing data as an independent controller under its own privacy policy.
  • Email delivery provider: sends our service emails to your address.
  • Meta: receives the images and links of your feed when you connect it to your catalog.
  • AI providers (Google, OpenAI, Anthropic): only when AI features are used. They receive the text of your request needed to draw a background or a design, and the text and screenshots you send to the assistant. Product photos are not sent for background drawing.
  • Have I Been Pwned: receives the first 5 characters of a one-way fingerprint of a new password to check if it leaked. The password itself never leaves our server.

Where a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission or on the Standard Contractual Clauses.

5. How long we keep data

  • Account and store data: until you delete them. Deleting a store removes its feed, images and designs.
  • Assistant chats: 90 days, then deleted automatically.
  • Payment and invoice records: as long as tax law requires (in Spain, usually 6 years).
  • Backups: encrypted copies are kept for up to 12 months and then overwritten.
  • Activity log: until the account is deleted, then the entries are made anonymous.

6. Your rights

You can ask for access to your data, correction, deletion, a portable copy, and you can object to or restrict processing. In the dashboard under Account you can download all your data and delete your account yourself. For anything else write to info@ecomlune.com. You can also complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or the authority of your own country.

7. Security

Passwords are stored as one-way fingerprints with a secret key outside the database. Sessions, access between stores, uploads and public links are protected, and data is stored in the EU. No system is perfectly secure; if a breach affects you we will notify you and the authorities as the law requires.

8. Children

The Service is for businesses and for people aged 18 and over.

9. Changes

When we change this policy we change the version above and, for important changes, tell you in the dashboard.