Privacy policy

The data controller is SCALORO LLC, 8206 Louisiana Blvd Ne, Ste A #9394, Albuquerque, NM 87111, United States, which operates the Ecom Autopilot service.

Contact: contact@ecomautopilot.app.

Depending on how you use the service, we process the following categories.

Account. Email address, password stored as a hash, and, if you choose that sign-in method, the identifier and email address provided by Discord (OAuth). We never receive your Discord password.

Billing. Payment details are sent to Stripe. We do not store your full card number. We keep what is needed for the invoice: the plan, the amount, the status, and the last four digits and brand of the card when Stripe returns them.

Extension. The data required to automate your eBay activity:

• public content of product pages viewed on Amazon, AliExpress, or eBay (identifier, title, price, specifics, images);
• generation settings (target eBay site, margins, templates);
• data needed to process orders when you start that action;
• an extension authentication token, stored as a hash so we can recognize your requests.

Technical. IP address, user-agent, security logs, and aggregated browsing data.

This data is used to:

• create and manage your account, subscription, and invoices;
• provide the extension: product research, listing generation, publishing, price and stock tracking, orders, and tracking numbers;
• manage the generation credits included in your plan and those you buy;
• keep the service secure, prevent fraud, and answer technical support requests;
• measure site traffic so we can improve it.

Processing is based on performance of the contract (account, subscription, extension), compliance with legal obligations (invoicing), and the publisher’s legitimate interests (security, fraud prevention, audience measurement). Where the law requires it, non-essential cookies are based on your consent.

Data is shared only with the providers we need:

• Stripe, for payment;
• Railway Corporation, for hosting;
• Discord, if you use that sign-in method;
• DeepSeek, to generate listing content;
• Google (Analytics), for audience measurement.

Generated listings describe products, not your buyers. We do not sell your data and we do not share it for our own advertising. Order details read in your browser to prefill a supplier purchase stay on your device: they are not sent to our servers.

Account and billing data are kept for the life of the contract, then archived for as long as legal and evidentiary duties require, in practice two years after the relationship ends for purchase records, unless a longer period is required by law.

Product pages sent for generation may be cached temporarily, on the order of 24 hours, to avoid repeating the same work. The extension token is kept as a hash until you revoke it (sign-out). Uninstalling the extension deletes the data stored in the browser.

Purchased generation credits and the related history are kept for as long as they are needed to provide the service and meet invoicing duties.

We take reasonable technical and organizational measures: restricted access, encrypted traffic (HTTPS), hashed passwords, and extension tokens stored as hashes. No internet transmission is completely secure, and absolute security cannot be guaranteed.

The extension relies on sessions already open in your browser. We do not collect or store the usernames or passwords of your eBay, Amazon, AliExpress, or Google accounts.

You may request access, rectification, erasure, restriction, objection, and portability, and you may withdraw consent, by writing to contact@ecomautopilot.app. You may also contact the data protection authority of the country where you live (for example the CNIL in France or the AEPD in Spain).

The site uses:

• strictly necessary cookies: session, authentication, and remembering your language and theme;
• audience-measurement cookies (Google Analytics), which collect information about pages viewed, duration, and traffic source. Google processes them under its privacy policy.

Blocking necessary cookies prevents sign-in. You can limit analytics cookies in your browser settings.

The extension processes only what it needs to work.

Sent to our servers: the authentication token (this is not your password) and the public content of product pages when you start a generation.

Processed only in the browser: order details read on the page you are viewing (for example a buyer’s name and address when you place the supplier order), and your local settings (eBay site, margins, image templates, publishing queue). These are not sent to our servers.

The extension does not run remote code: its code is the code shipped with the package. You can revoke the token by signing out, and delete everything by uninstalling the extension.

This policy may be updated. The applicable version is the one published on this page, with its update date.