Privacy Policy

TEEINBLUE PTE. LTD. (UEN 202447602Z), registered in Singapore at 3 Coleman Street, #03-24, Peninsula Shopping Complex, Singapore 179804 and trading as Ecvision by Teeinblue, is the data controller for the personal data described here. It is also the address for our data protection enquiries. Write to thomas@ecvision.ai about anything on this page.

Three things, and they are all small:

• Account: your email address, your name if you give one, a hash of your password (never the password itself), and the time you last signed in.
• Workspace: the store domains you ask us to track, your workspace name, your role in it, and your settings.
• Technical: server logs of requests to the application — IP address, browser user-agent, timestamp and path — kept so we can debug failures and detect abuse.

We do not ask for your date of birth, your phone number, your address, or anything about your customers. We never ask for and cannot access your Shopify admin account.

Your card details. Payment is handled entirely by Polar as Merchant of Record. Card numbers are entered on Polar’s own checkout and never reach our servers.

What we keep from a payment is the minimum needed to know what you are entitled to: the subscription identifier, its status, which plan it is for, and when the current period ends.

Most of what ecvision holds is not personal data at all: it is public information about the businesses you ask us to track — their catalogue and prices, the ads their brand pages publish in public ad libraries, their public social accounts, and third-party traffic estimates.

We collect it from public sources and from data providers we pay. Where a public post or advertisement contains a name or an image of a person who published it publicly, we hold it as it was published and do not attempt to identify anyone, build profiles of individuals, or link accounts across platforms.

We set one kind of cookie: the session cookie that keeps you signed in. It is strictly necessary — without it the application cannot tell one request from another — and it is removed when you sign out.

We use PostHog to understand how the site and the application are used. It stores a random identifier in your browser (a cookie and local storage) so we can recognise a returning visit. It records the pages you open (the address without any query string, and the page you came from), your browser, device and approximate country. When you are signed in it links those visits to an opaque account number and workspace number — never your email address or name — so we can count how many people use a feature, not who they are.

We do not record sessions or screens, capture what you click or type, load advertising pixels, or track you across other websites. Pages whose address is itself a secret — shared links, email verification and password reset — are never reported. To stop it, block the cookie and local storage for this site, or enable your browser’s Do Not Track or tracking-protection setting; the site works the same without it.

Inside the signed-in application there is also a support chat, provided by Crisp (clause 6). It sets its own cookies and browser storage so that your conversation with us is still there when you come back, and we remove them when you sign out. It is never loaded on the public site — the home page, the blog, the documentation and these legal pages.

• Polar Software Inc. — payments, invoicing and tax, as Merchant of Record. They receive your email address and hold your payment details under their own privacy policy.
• Cloudflare — DNS, CDN and protection in front of the site. Processes request metadata including your IP address.
• DigitalOcean — the servers the application and its database run on.
• PostHog — product analytics (clause 5). Receives page views, the account and workspace numbers, and request metadata including your IP address, which is used to infer a country.
• Functional Software, Inc. (Sentry) — error reports from our servers. When something fails it receives what failed, where in our code, and the address of the page or task it failed on. It does not receive your IP address, passwords, cookies or the content of the requests you send, though an error's message can occasionally quote a value you entered, such as an email address or a store you track.
• Crisp IM SAS (France) — the in-app support chat. While you use the application it receives your IP address, browser and the page you are on; if you open it, it also receives your email address, name, workspace name and plan, and the messages you send.
• Data providers we query about the stores you track. They receive the domains you asked about; they receive nothing about you.

We do not sell personal data, and we do not share it for anyone else’s marketing.

To perform the contract you entered into when you subscribed (your account and workspace data), to comply with tax and accounting law (payment records), and for our legitimate interest in keeping the service secure and working (server logs).

• Account and workspace data: while your account is open, and for 30 days after you close it, so an account closed by mistake can be restored.
• Server logs: 90 days.
• Records of payments: as long as Singapore tax and accounting law requires, which is longer than either of the above.
• Collected data about the stores you tracked: deleted with the workspace.

You can ask us for a copy of what we hold about you, to correct it, to delete it, or to stop processing it. One email is enough — we do not require a form — and we answer within 30 days.

Deleting your account deletes your personal data and your workspace’s collected data. It does not delete payment records we are required to keep, and it does not affect public information about stores, which remains public at its source.

We are established in Singapore, so the Personal Data Protection Act applies to us and you may complain to the Personal Data Protection Commission. If you are in the UK, the EEA or a jurisdiction with its own regime, the authority there is open to you as well. We would rather you told us first.

Passwords are stored only as hashes. Traffic to the site and the API is encrypted in transit. Access to the production database is limited to the people who operate the service. No system is perfect; if we ever suffer a breach affecting your data, we will tell you and the relevant authority as the law requires.

The application and its database run on the hosting provider named in clause 6. The processors listed there operate internationally and may process data — request metadata in Cloudflare’s case, your email address in Polar’s — outside the country you are in. Crisp keeps support conversations in the European Union. Where data leaves the country you are in, we rely on those providers’ standard contractual clauses.

ecvision is a business tool and is not directed at anyone under 16. We do not knowingly collect their data.

If we change this policy in a way that affects you, we will tell you by email before it takes effect. The date at the top always reflects the current version.