Shopify app privacy policy

EC Flows is a service of Agentic Flows, based in the Netherlands. EC Flows helps brands create, launch and manage ads on Meta and Google. The EC Flows Shopify app connects your store's product catalog to your EC Flows account. For the store data described below, you are the controller and we process it on your behalf.

The app requests read-only access to products and inventory. We store:

• Store details. Your store name and myshopify.com domain.
• Product catalog. Product titles, descriptions, vendor, product type, tags, status, product page URL, variants with prices, SKUs and inventory quantities, and product images.
• Access token. The token Shopify issues to the app, stored encrypted.
• Webhook notifications. Shopify notifies us when products or inventory change. We keep these notifications for up to 30 days to process them.

The app does not read or store customer data, orders or payment information from Shopify.

• To show your products in EC Flows and keep them in sync with your store.
• To create ads for a specific product, using its images, title, description and price, and link the ad to the product page.
• To recommend pausing ads for a product that is sold out, archived or no longer active, and resuming them when it is available again. These are recommendations: nothing changes in your ad accounts until you approve it.

The app never changes anything in your Shopify store. We do not sell your data, and we do not use one customer's data to run another customer's campaigns.

We use service providers to run EC Flows. They process data only on our instructions, under a data processing agreement.

• Hosting and storage. Our servers and file storage are located in the European Union.
• AI model providers. When you create an ad for a product, the product details needed for that request are sent to the provider of the language or image model. These providers do not use your data to train their models. Some are based in the United States; transfers are covered by the European Commission's standard contractual clauses.
• Meta and Google. Ads you approve, including product images and links, are published to the ad accounts you connected.

We keep store data for as long as the app is installed. When you uninstall the app, the access token stops working immediately and we delete it. Shopify sends us a request to erase the store's data 48 hours later. We then delete the connection, the products and the product images. If you reinstall within those 48 hours, your catalog is still there.

Because we do not store customer data from Shopify, customer data and erasure requests have no data to return or delete. We still acknowledge every request.

All traffic to and from EC Flows is encrypted with TLS. Access tokens are stored encrypted, and access to production systems is limited to the people who need it. If you notice a security issue, please email [email protected].

Under the GDPR you can ask us for access to your data, correction, deletion, restriction of processing and a copy in a common format. Send your request to [email protected]; we respond within one month. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Our general privacy policy, in Dutch, is at ecflows.com/privacy.

• Agentic Flows
• [email protected]