Privacy Policy

EcomShadow is an AI-powered seller productivity platform designed for Indian e-commerce sellers operating on marketplaces including Amazon India, Flipkart, Meesho, Myntra, Snapdeal, and others. The platform offers tools for keyword research, product research, listing building, listing analysis, inventory management, and AI-powered seller insights.

EcomShadow is owned and operated by Raoofa Innovation Pvt. Ltd., a company incorporated under the laws of India. We are committed to protecting the personal and business data of every seller who uses our platform, in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) and applicable Indian laws.

We collect only the data necessary to provide and improve our services. This includes:

We use the data we collect for the following purposes:

• Provide our services — Power all platform features including inventory management, listing builder, keyword research, product analytics, and AI-generated suggestions.
• Sync marketplace data — Connect to your authorized marketplace accounts to fetch and mirror inventory, orders, and listing data in real time.
• Generate AI insights — Process your product and listing data through AI models to generate SEO-optimized listings, keyword suggestions, and seller recommendations.
• Process orders and notifications — Track order status and trigger inventory updates through our processing pipeline.
• Improve our platform — Analyze aggregated, anonymized usage patterns to improve features, fix bugs, and enhance performance.
• Customer support — Respond to your queries, troubleshoot issues, and maintain your account.
• Billing and subscriptions — Manage your plan, process payments, and send invoices or renewal reminders.
• Legal compliance — Meet our obligations under applicable Indian laws, including the DPDPA 2023.
• Security — Detect and prevent fraud, unauthorized access, and abuse of our platform.

We share your data only in the following limited circumstances:

• Service Providers: We use trusted third-party infrastructure providers to operate EcomShadow. These include:
  • Amazon Web Services (AWS) — Cloud infrastructure and order processing queue (SQS)
  • Supabase — Database hosting and authentication
  • Anthropic (Claude AI) — AI-powered features including listing generation and seller suggestions. Data sent to Anthropic is governed by their privacy policy
  • Payment Gateway — For processing subscription payments securely
  • Vercel — Frontend hosting and delivery
  • Hostinger SMTP — Outbound transactional and digest email delivery
  • AiSensy (WhatsApp Business) — Approved-template WhatsApp messages for OTPs, receipts, low-stock alerts, and Premium-tier Competitor Intelligence notifications
  • Licensed competitor-data provider — For Premium-tier Competitor Intelligence only. Fetches publicly accessible product detail pages from Amazon India for the ASINs you choose to track. Returns metric-only snapshots (price, stock, BSR, rating, Buy Box seller, badges, variant counts). EcomShadow does not pass any of your personal data to this provider — only the ASINs you have selected to monitor.
• Marketplace APIs: When you connect your seller accounts, we interact with Amazon India, Flipkart, Meesho, Myntra, Snapdeal, and other marketplaces on your behalf. Data exchanged is limited to what is necessary to provide the service you requested.
• Legal Requirements: We may disclose your data if required by law, court order, or a competent government authority under applicable Indian law.
• Business Transfers: In the event of a merger, acquisition, or sale of Raoofa Innovation Pvt. Ltd., your data may be transferred to the successor entity. You will be notified of any such change.

All third-party service providers are bound by contractual obligations to protect your data and are prohibited from using it for any purpose other than providing services to us.

Your data is stored on secure cloud infrastructure (primarily AWS and Supabase) with servers located in data centers that comply with international security standards. We implement the following measures to protect your data:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Secure storage of API keys and marketplace credentials (encrypted at rest)
• Role-based access controls — only authorized personnel can access sensitive data
• Regular security reviews of our infrastructure and codebase
• Background job architecture that minimizes live API exposure to marketplace credentials

We retain your data for as long as your account is active or as needed to provide our services. Specifically:

• Account data — Retained for the duration of your account and for up to 90 days after deletion to allow account recovery.
• Marketplace and inventory data — Retained while your account is active. Upon account deletion, this data is purged within 30 days.
• Order and transaction history — Retained for up to 7 years for financial record-keeping as required under Indian law.
• Usage logs — Retained for up to 12 months for security and performance monitoring, then deleted.
• AI interaction inputs — Not stored permanently. Processed in real time and not used to train AI models.

You may request deletion of your data at any time by contacting us (see Section 12). We will process deletion requests within 30 days, subject to any legal retention requirements.

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and applicable Indian law, you have the following rights with respect to your personal data:

• Right to Access — Request a copy of the personal data we hold about you.
• Right to Correction — Request correction of inaccurate or incomplete personal data.
• Right to Erasure — Request deletion of your personal data, subject to legal retention requirements.
• Right to Withdraw Consent — Withdraw consent for data processing where consent is the legal basis, without affecting the lawfulness of prior processing.
• Right to Grievance Redressal — Raise a grievance with our Grievance Officer (see Section 11). You may also approach the Data Protection Board of India after exhausting internal remedies.
• Right to Nominate — Nominate another individual to exercise your rights on your behalf in case of death or incapacity.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

EcomShadow uses cookies and similar technologies to operate the platform effectively. We use:

• Essential Cookies — Required for login sessions and platform functionality. Cannot be disabled.
• Analytics Cookies — Used to understand how sellers use the platform so we can improve it. Aggregated and anonymized.
• Preference Cookies — Remember your settings and preferences within the platform.

We do not use third-party advertising cookies or sell cookie data to advertisers. You may manage cookie preferences through your browser settings, though disabling essential cookies will impact platform functionality.

EcomShadow is a business productivity tool intended for use by adults (18 years of age or older) who are registered sellers on e-commerce marketplaces. We do not knowingly collect personal data from individuals under the age of 18.

If you believe a minor has provided us with personal data, please contact us at [email protected] and we will promptly delete such information.

We may update this Privacy Policy from time to time as our platform evolves or as required by law. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify you via email or an in-platform notification at least 14 days before the changes take effect
• For significant changes, request fresh consent where required under the DPDPA

Continued use of EcomShadow after the effective date of updated terms constitutes your acceptance of the changes.

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer to address any concerns regarding your personal data:

If you have any questions, concerns, or requests related to this Privacy Policy or how we handle your data, please reach out to us:

This Privacy Policy is governed by the laws of India. Any disputes arising in connection with this policy shall be subject to the exclusive jurisdiction of competent courts in India.

This section provides Amazon-specific disclosures required for our use of the Amazon Selling Partner API (SP-API). It supplements (and where applicable, takes precedence over) the general data-handling sections above when the data in question originates from Amazon's SP-API.

13.1 Data we receive from Amazon SP-API

When you authorize EcomShadow against your Amazon Seller Central account, we receive the following categories of data:

• Listing data — ASIN, SKU, title, brand, price, list price, BSR rank, ratings, review counts, product images, fulfillment status
• Order data (non-PII only) — order ID, status, marketplace, purchase date, total, currency, item-level ASIN/SKU/title/quantity/price, and only the city, state, postal code, and country of the shipping address (Amazon classifies these four fields as non-restricted)
• Returns data — return reason, quantity, reference order ID
• Inventory data — FBA warehouse stock levels per SKU, fulfillment state, condition
• Pricing & fees — FBA fees, referral fees, competitive prices

13.2 Data we do NOT collect from Amazon SP-API

We have explicitly designed EcomShadow to avoid collecting Personally Identifiable Information (PII) classified as restricted by Amazon. We do not collect, request, or store:

• Buyer names
• Buyer email addresses
• Buyer phone numbers
• Buyer street/full shipping addresses (only city/state/postal/country)
• Buyer billing addresses
• Buyer tax information
• Any data accessed via Restricted Data Tokens (RDT)
• Any restricted Amazon report types (e.g. GET_FLAT_FILE_ALL_ORDERS_DATA_BY_LAST_UPDATE_GENERAL)

13.3 Encryption of Amazon credentials & data

• In transit — All connections to Amazon SP-API and to EcomShadow use TLS 1.2 or higher. Non-TLS connections are rejected at the edge.
• Refresh tokens — Amazon LWA refresh tokens are encrypted with AES-256-GCM at the application layer before being persisted, in addition to Supabase's native AES-256 at-rest encryption. Encryption keys are stored in environment variables on Vercel/Railway, never in source code or the database.
• At rest — All Amazon-derived data is stored in Supabase Postgres with AES-256 encryption at rest.

13.4 Retention & deletion of Amazon data

• While connected — Amazon data is retained for as long as you maintain an active EcomShadow subscription with the Amazon connection enabled.
• On disconnection — Within 24 hours of you disconnecting Amazon (via EcomShadow's Platform Connector or via Seller Central → Apps → Manage Apps → Disable Authorisation), we revoke the refresh token. Within 30 days, all seller-specific Amazon-derived data (orders cache, listings cache, FBA inventory cache, returns) is deleted.
• On account deletion — Full purge of all Amazon-derived data within 30 days of your written request to [email protected].
• Backups — Aged out per Supabase's standard retention (point-in-time recovery 7 days, daily backups 30 days, weekly 90 days). All backups encrypted with the same AES-256 standard.

13.5 Subprocessors that touch Amazon data

Only the following subprocessors handle Amazon SP-API data (each bound by a Data Processing Agreement; see Section 4 for the full subprocessor list including non-SP-API services):

• Supabase — Postgres database hosting (Amazon data at rest, encrypted)
• Vercel — Serverless compute that processes API requests (ephemeral, no persistence)
• Railway — Background worker that calls Amazon SP-API on your behalf
• Anthropic (Claude) — Receives anonymized aggregated competitor metrics only; never receives seller IDs, order data, or PII
• AiSensy — WhatsApp delivery for alerts; receives recipient phone + message content only (no Amazon data)
• Hostinger SMTP — Transactional email; receives recipient email + message content only (no Amazon data)

We do not share Amazon data with advertisers, data brokers, or any party outside this list.

13.6 Your rights regarding Amazon data

• Disconnect at any time — Click Disconnect inside EcomShadow's Platform Connector, or revoke the app from Seller Central → Apps → Manage Apps → Disable Authorisation
• Request a data export — Email [email protected]; delivered as a JSON archive within 7 business days
• Request deletion — Email [email protected]; full purge within 30 days
• Report a concern — Contact our Grievance Officer at [email protected] (see Section 11)

13.7 Security incident response

In the event of a confirmed data breach involving Amazon SP-API data:

• Within 24 hours: notify Amazon Selling Partner Support and any affected sellers
• Within 72 hours: file an initial breach report with India CERT-In
• Investigation, remediation, and post-mortem are documented and shared with affected sellers on request

13.8 Compliance attestations

EcomShadow complies with:

• Amazon's Acceptable Use Policy for Selling Partner API applications
• Amazon's Data Protection Policy for Selling Partner API applications
• India's Digital Personal Data Protection Act (DPDPA) 2023
• EU GDPR for European users where applicable