Privacy Policy

• For your customers' data, you (the merchant) are the controller and Outis acts as your processor. We process that data only to run Ecto for your store and on your documented instructions, which are our terms and your settings in the App. Section 10 sets out our processor commitments.
• For your own data as a merchant (account and contact details, billing status, support exchanges), Outis is the controller.

About you, the merchant:

• Store details received from Shopify when you install the App: store name, store domain, store email, owner or staff name and email, Shopify plan, country, currency and language.
• Subscription and billing status provided by Shopify (plan, trial dates, charges). We never receive your card or bank details.
• The messages and emails you send to our support, and your settings in the App.

About your customers. Ecto only processes data about customers who are logged in to their customer account on your store:

• Shopify customer ID, used to link a cart to a customer account.
• Cart contents and history: products, variants, SKUs, quantities, prices, the cart token and the changes made to the cart.
• Order references linked to a synced cart (order ID, amount, date), used to empty the cart after purchase and to show you statistics.
• Technical data: IP address, browser and device information (user agent, device type) and timestamps, used to sync the cart between devices, secure the service and show from which device a cart was used or an order was placed.

Ecto does not need, and does not store, your customers' payment details or postal addresses. It does not build advertising profiles and does not sell personal data.

• Through the Shopify APIs and webhooks, within the access scopes you approve at installation.
• Through the App's script on your store, which reads the Shopify cart of a logged-in customer and sends it to our servers.
• Directly from you, when you configure the App or contact us.

• Saving, syncing and restoring carts; emptying them after an order; creating draft orders at your request: performance of our contract with you (GDPR Art. 6(1)(b)). For customer data, we act on your instructions as processor.
• Showing you saved carts, cart history and statistics in the App: performance of the contract.
• Managing your subscription, trial and invoices through Shopify: performance of the contract; legal obligations (accounting).
• Answering support requests and sending service messages (changes, incidents, new versions): performance of the contract; our legitimate interest in keeping you informed.
• Securing the App, preventing abuse, fixing bugs: our legitimate interest in running a safe and reliable service.
• Measuring visits to our App Store listing and website: your consent where required (cookies), otherwise our legitimate interest.
• Answering lawful requests from authorities and defending our rights: legal obligations; our legitimate interest.

We may occasionally email you about Ecto features that relate to the App you use. You can opt out at any time by replying to the email or writing to our contact address.

On your store, Ecto does not place advertising or analytics cookies. It relies on Shopify's cart and on technical browser storage that is strictly necessary to keep the cart of a logged-in customer in sync. These technologies are needed for the service your customers use and do not require consent under French and EU rules. You should still mention cart saving in your own privacy policy.

Our Shopify App Store listing and our website use Google Analytics to measure audience. On our website, analytics cookies are only placed after consent, where the law requires it.

We do not sell or rent personal data. We share it only with the service providers below, who act on our instructions, and with Shopify, which runs the platform the App works on.

• Shopify: e-commerce platform, app billing, source of store and customer data. Located in Canada, the United States and other countries; Shopify's own terms apply.
• fortrabbit GmbH (on Amazon Web Services): hosting of the App, its database and its servers. Located in the European Union.
• Crisp IM SAS: support chat inside the App and support emails. Located in France (European Union).
• Google (Google Analytics): audience measurement of our listing and website. Does not receive your customers' cart data. Located in the European Union and the United States.

We may also disclose data when the law requires it, to answer a valid request from an authority, or to protect our rights. If Outis or Ecto is sold or merged, the data may be transferred to the new owner, who will remain bound by this policy.

• Saved cart of a customer: 90 days after the last change to the cart.
• Detailed cart history (movements): 7 days.
• Orders linked to synced carts: 30 days.
• Technical logs: only as long as needed for security and debugging.
• Customer data, after a deletion request sent by Shopify (customers/redact): deleted within 30 days.
• All store and customer data, after you uninstall the App: deleted when Shopify sends the shop/redact request, 48 hours after uninstall.
• Support conversations: as long as you are a client, then up to 3 years after our last exchange.
• Billing records: 10 years, as required by French accounting law.

Outis is based in France, and Ecto's servers are hosted in the European Union. Some providers, such as Shopify and Google, may process data outside the European Union, including in Canada and the United States. In that case, transfers rely on an adequacy decision of the European Commission (such as the decision on Canada or the EU-US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.

We protect data with measures suited to the risk: encrypted connections (HTTPS) between your store, Shopify and our servers, verification of Shopify webhook signatures, access to production data restricted to the people who need it, a hosting provider in the European Union, and limited retention periods. Ecto follows Shopify's requirements for apps that access protected customer data. If a data breach affects your store's data, we will inform you without undue delay, and at the latest within 72 hours of becoming aware of it, so you can meet your own obligations.

When we process your customers' data on your behalf, Outis commits to:

• process the data only to provide Ecto and on your documented instructions, and inform you if an instruction appears to break the law;
• ensure that anyone authorised to access the data is bound by confidentiality;
• apply the security measures described in section 9;
• use only the sub-processors listed in section 6, bound by equivalent data protection obligations, and inform you before adding or replacing one, so you can object by uninstalling the App;
• help you answer your customers' requests to exercise their rights, in particular through Shopify's customers/data_request and customers/redact webhooks;
• help you meet your obligations on security, breach notification and data protection impact assessments, as far as Ecto is concerned;
• delete all your data at the end of the service, as described in section 7;
• make available the information needed to demonstrate compliance with these commitments, and answer reasonable audit questions in writing.

You, as controller, commit to have a lawful basis for the processing, to inform your customers, and to give us only lawful instructions.

Under the GDPR and similar laws, including the California Consumer Privacy Act where it applies, individuals can request access to their data, correction, deletion, restriction, portability, and can object to processing based on legitimate interest. Where processing relies on consent, it can be withdrawn at any time.

• Merchants can exercise these rights by writing to our contact address. We answer within one month.
• Customers of a store should contact the store directly, since the merchant is the controller of their data. When a customer asks a store for their data or for its deletion, Shopify forwards the request to Ecto and we handle it within 30 days. If a customer contacts us directly, we will forward the request to the merchant concerned.

If you believe your rights have not been respected, you can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of your country of residence.

Ecto is a business tool for merchants and is not intended for children. We do not knowingly collect data about children beyond what a store may hold about its own customers.

We may update this policy to reflect changes in the App, in our providers or in the law. The date at the top shows the latest version. We will inform you of significant changes through the App or by email.

For any question about these terms, about privacy, or to exercise your rights, write to ecto@outis.dev or by post to OUTIS, 109 Rue du Creux, 39570 Messia-sur-Sorne, France.