Privacy Policy
Effective September 21, 2026. Ecom Pros LLC ("Ecom Pros", "we") operates Ecom Pros CRM, a workspace that connects to a merchant's Shopify store and other tools.
What we collect
When a merchant installs the app we receive, through the Shopify Admin API and only within the permissions the merchant approves: store details, orders, products, inventory, draft orders, fulfillments, discounts, shipping settings, analytics, and customer records (name, email, phone, addresses, order history). We also store the merchant's CRM account details (name, email, sign-in credentials) and anything the merchant's team types into the CRM.
Why
To run the CRM for that merchant: a shared inbox, quotes and draft orders, purchase orders, fulfillment tracking, follow-ups, reporting, and AI-assisted drafting of replies the merchant reviews before sending. We do not sell personal data and we do not use one merchant's data for another merchant.
Where it lives
Data is stored with Supabase (hosted PostgreSQL, encrypted at rest and in transit). Shopify access tokens and other secrets are stored in Supabase Vault. Traffic is served through Cloudflare. AI features send the minimum text needed for a draft to Anthropic's API under a no-training agreement.
How long
For as long as the merchant's CRM account is active. When the app is uninstalled or a store is removed from the CRM we stop syncing immediately, and store data is deleted within 30 days. Shopify customer data requests and redaction requests (GDPR / CCPA) are honored within 30 days of receipt.
Google user data
When a store connects Google, the CRM uses Gmail only to send messages the store owner writes or approves (and, if the store turns on its inbox, to show and file that store's own mail), Calendar for the store's events, Drive for files the CRM creates, and Analytics, Search Console, Merchant Center and Google Ads to read that store's own results. Ecom Pros CRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, use it to train AI models, or let people read it except with the store owner's permission, for security, or to comply with law. Google access tokens are stored encrypted in Supabase Vault, and a store can disconnect Google at any time under Connections or at myaccount.google.com/permissions.
Who can see it
Only the merchant's own team members inside their CRM account, and Ecom Pros staff when needed for support, under confidentiality. Subprocessors: Supabase, Cloudflare, Anthropic, Google (for Gmail, Calendar and Drive when the merchant connects them).
Your rights
Merchants and their customers can ask what we hold, ask for a copy, ask for corrections, or ask for deletion by emailing [email protected]. We answer within 30 days.
Security
TLS everywhere, HMAC-verified Shopify requests and webhooks, secrets in Vault, role-based access inside the CRM, optional two-step verification for every CRM login, and an audit log of sign-ins and connection changes.
Changes and contact
We will post updates here and note the effective date. Questions: [email protected].
Ecom Pros Site Chat (Shopify app)
Last updated 2026-09-25. This section covers Ecom Pros Site Chat ("Site Chat"), a live chat app for Shopify stores provided by Ecom Pros LLC, Georgia, USA. The merchant who installs Site Chat decides to use it on their store and controls their shoppers' data. Ecom Pros processes that data on the merchant's behalf, only to provide Site Chat.
What Site Chat collects from store visitors
Through the chat box on the merchant's store: the name and email address a visitor types in, an optional phone number and text message consent, the chat messages, the pages viewed on the store during the visit, cart contents and cart events (added to cart, removed, reached checkout), and approximate device and browser information (the browser's user agent). A random visitor ID is kept in the browser so the chat can continue on the next page.
What Site Chat receives from Shopify
Only within the permissions the merchant approves: store details (name, domain, contact email of the store, plan), products and variants, store policies, store pages, shipping settings, and the draft orders Site Chat itself creates when the merchant sends a quote. Site Chat does not read Shopify customer records and does not request customer names, email addresses, phone numbers or addresses from Shopify.
Why
To run live chat between the store and its visitors; to send quotes (Shopify draft orders with a checkout link); to write AI reply drafts that the merchant's staff review before sending; to email new chat alerts to the merchant and replies to a visitor who has left the site; and to show the merchant chat analytics (chats, carts, checkouts, orders from quotes). We do not sell or rent personal data, we do not use it for advertising, and we do not use one merchant's data for another merchant.
AI processing
When the merchant's staff ask for an AI draft, the conversation and the relevant store information are sent to Anthropic's API to write a suggested reply. Anthropic processes this as our subprocessor and, under its commercial API terms, does not use it to train models. Drafts are never sent to a visitor automatically.
Subprocessors
Supabase (hosting and database, encrypted at rest and in transit), Cloudflare (network and delivery), Anthropic (AI drafts), Google (delivery of alert and reply emails). Each is bound by data protection terms at least as protective as these.
How long we keep it
Chat messages and visitor records are deleted automatically 24 months after they were created or last active. When a merchant uninstalls Site Chat, all of that store's Site Chat data (conversations, visitors, the store knowledge base and the stored Shopify access token) is deleted within 48 hours of Shopify's shop redact request. Shopify customer redact requests are honored within 30 days.
Your rights
Visitors can ask for access to, a copy of, correction of, or deletion of their data, and California residents can exercise their CCPA rights, through the store they chatted with or by emailing [email protected]. We answer within 30 days. Requests Shopify forwards to us (customer data requests and redactions) are handled automatically.
Security
TLS for all traffic, encryption at rest, Shopify access tokens kept in an encrypted vault, HMAC-verified Shopify requests and webhooks, each store's data kept separate from every other store's, and access limited to the merchant's own staff and to Ecom Pros staff who need it to provide support, under confidentiality.
Contact
Ecom Pros LLC, Georgia, USA. [email protected]
Ecom Pros Mega Menu (Shopify app)
Last updated 2026-10-18. This section covers Ecom Pros Mega Menu ("Mega Menu"), a navigation app for Shopify stores provided by Ecom Pros LLC, Georgia, USA.
What Mega Menu collects
Nothing about shoppers. Mega Menu draws the store's header and dropdown menus. It does not set cookies, does not track visitors, and does not collect names, emails, phone numbers, addresses or orders.
What Mega Menu reads from Shopify
Only within the permissions the merchant approves, and only inside the merchant's own Shopify admin: products and collections (to pick best sellers and show the live preview), the store's menus, images in the store's Files (to pick a card picture), and the live theme's settings (to show whether the menu is turned on). Mega Menu has no access to customer records.
Where settings live
The merchant's menu settings are saved in the merchant's own Shopify store, as data attached to the app installation. Ecom Pros does not keep a copy on its own servers. The settings page runs in the merchant's browser inside Shopify admin and talks to Shopify directly.
Webhooks
Shopify sends us notices when the app is uninstalled, when the merchant's plan changes, and privacy requests (customer data requests, customer redaction, shop redaction). We verify each one, keep a short log of the notice (topic, store domain and IDs only), and because Mega Menu holds no shopper data there is nothing further to delete. Settings stored in the merchant's store are removed by Shopify when the app is uninstalled.
Subprocessors
Shopify (hosting of the app, billing and settings), Cloudflare (serves the settings page), Supabase (receives and logs Shopify webhooks).
Your rights and contact
Questions or requests: [email protected]. We answer within 30 days.
Ecom Pros Add-Ons (Shopify app)
Last updated 2026-10-19. This section covers Ecom Pros Add-Ons ("Add-Ons"), a product add-ons app for Shopify stores provided by Ecom Pros LLC, Georgia, USA.
What Add-Ons collects
Nothing about shoppers. Add-Ons shows matching add-on products on a product page and adds the shopper's picks to the store's own Shopify cart. It does not set cookies, does not track visitors, and does not collect names, emails, phone numbers, addresses or orders.
What stays in the shopper's browser
When a shopper opens an add-on's page from the panel, the product page they came from is remembered in their browser's session storage for that visit only, so a bar can take them back to it. It never leaves their browser and is cleared when the tab closes. Items added together carry a hidden cart note that links the add-ons to their product so they can be kept in step in the cart.
What Add-Ons reads and writes in Shopify
Only within the permissions the merchant approves, and only inside the merchant's own Shopify admin: products and their variants (to pick the main product and its add-ons and to show which add-on variant each option gets), product data the app adds (the add-on list, matching rules and short descriptions), and the live theme's settings (to show whether the app is turned on). Add-Ons has no access to customer records or orders.
Where settings live
Settings are saved in the merchant's own Shopify store, on the products and on the app installation. Ecom Pros does not keep a copy on its own servers. The settings page runs in the merchant's browser inside Shopify admin and talks to Shopify directly.
Webhooks
Shopify sends us notices when the app is uninstalled, when the merchant's plan changes, and privacy requests (customer data requests, customer redaction, shop redaction). We verify each one, keep a short log of the notice (topic, store domain and IDs only), and because Add-Ons holds no shopper data there is nothing further to delete.
Subprocessors
Shopify (hosting of the app, billing and settings), Cloudflare (serves the settings page), Supabase (receives and logs Shopify webhooks).
Your rights and contact
Questions or requests: [email protected]. We answer within 30 days.
Ecom Pros Cart Drawer (Shopify app)
Last updated 2026-10-19. This section covers Ecom Pros Cart Drawer ("Cart Drawer"), a slide-out cart app for Shopify stores provided by Ecom Pros LLC, Georgia, USA.
What Cart Drawer collects
Nothing about shoppers. Cart Drawer shows the store's own Shopify cart in a slide-out panel and changes it through Shopify's cart (quantities, removals, discount codes, add-ons the shopper chooses). It does not set cookies of its own, does not track visitors, does not use browser storage, and does not collect names, emails, phone numbers, addresses or orders. Express checkout buttons are Shopify's own and are handled by Shopify.
What the shopper's browser asks Shopify for
To show add-ons, the shopper's browser asks the store's public Shopify product data for the products in the cart (which collections they are in) and the add-on products (title, image, price, stock). This is the same public information any visitor to the store can see.
What Cart Drawer reads and writes in Shopify
Only within the permissions the merchant approves, and only inside the merchant's own Shopify admin: products and collections (to pick the add-on rules) and the live theme's settings (to show whether the app is turned on). The add-on rules are saved on the app installation in the merchant's store. Cart Drawer has no access to customer records or orders.
Where settings live
Settings are saved in the merchant's own Shopify store: the look in the theme's app embed settings, the add-on rules on the app installation. Ecom Pros does not keep a copy on its own servers. The settings page runs in the merchant's browser inside Shopify admin and talks to Shopify directly.
Webhooks
Shopify sends us notices when the app is uninstalled, when the merchant's plan changes, and privacy requests (customer data requests, customer redaction, shop redaction). We verify each one, keep a short log of the notice (topic, store domain and IDs only), and because Cart Drawer holds no shopper data there is nothing further to delete.
Subprocessors
Shopify (hosting of the app, billing and settings), Cloudflare (serves the settings page), Supabase (receives and logs Shopify webhooks).
Your rights and contact
Questions or requests: [email protected]. We answer within 30 days.