Privacy Policy
How we collect, use, store, and protect personal data, in line with EU and Romanian law.
Last updated 1 October 2026
This notice explains how Ecomello processes personal data when you visit ecomello.com, create an account, connect a store or social account, or otherwise use the Service. It is provided under Article 13 of Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018, and Law no. 506/2004 on the processing of personal data in the electronic communications sector.
1. Who is the controller
The controller of personal data processed for the operation of Ecomello (account, billing, website, support, and related administration) is the Romanian company that operates the Ecomello service ("Ecomello", "we", "us"). We are established in Romania, in the European Union.
Privacy: privacy@ecomello.com. Support: support@ecomello.com.
We will provide our registered company name, unique registration code (CUI), trade-register number, and registered office on request, and we will publish them in this notice as soon as they are available on this page. You do not need those details to exercise your rights; email is enough.
We have not appointed a data protection officer. We are not required to do so under GDPR Article 37 or Law no. 190/2018 for the processing described here (we do not process CNP on a legitimate-interest basis, and our core activity is not large-scale monitoring of individuals).
2. Our roles
Controller. We are the controller for data about you as a user of Ecomello: registration and login, subscription and invoices, support messages, website logs, security events, and referral tracking.
Processor. When you connect a store or social account, we process catalog data, tokens, posts, media, comments, and engagement metrics on your instructions, to provide the Service to your account. For that data we act as a processor under GDPR Article 28. You (or your business) remain the controller of that data, including any personal data of third parties that appears in comments, captions, or product images. Our processor terms are in the Terms of Service.
3. Personal data we collect
Account and billing
Name, email address, hashed password, account preferences, and Facebook Login profile details if you sign in with Facebook (name and email). For paid plans, Stripe collects payment method data. We receive subscription status, plan, invoices, and limited billing metadata. We do not store full card numbers.
Store and catalog
If you connect Shopify or WooCommerce, we read product titles, descriptions, prices, images, variants, inventory status, and store metadata so we can create product-aware posts. We do not collect your customers' names, emails, shipping addresses, or payment information from the store.
Content you create
Posts, captions, images, videos, schedules, drafts, prompts, brand settings, and other materials you upload or generate in the Service.
Usage and technical data
Pages viewed, features used, referral codes, browser and device type, operating system, IP address, and timestamps. We use this to operate, secure, and improve the Service, and to attribute affiliate referrals.
Support
Name, email, and message content if you contact us.
4. Connected social platforms
When you connect a social account, we access that platform only through its official APIs, with your authorization, and only to provide the Service to the account that connected it. We do not sell, rent, or license platform user data. We do not use it for advertising, to profile people who are not your account users, for competitive benchmarking, or to train general-purpose AI models.
Ecomello is an independent product. It is not endorsed, sponsored, or affiliated with Meta, TikTok, Pinterest, X, LinkedIn, Bluesky, Mastodon, or their affiliates, unless we say so expressly.
| Data we receive | Purpose |
|---|---|
| OAuth access and refresh tokens | Act on your behalf without storing your platform password |
| Account identifiers, display name, username or handle, avatar | Show the connected account in Ecomello and attribute posts to it |
| Public profile or page statistics (for example follower or post counts), where the platform provides them | Show audience context to the merchant who connected the account |
| Captions, images, and videos you choose to publish or schedule | Publish or send to the connected account at your direction |
| Post identifiers, permalinks, and publishing status | Confirm publication and link to the live post |
| Engagement metrics for posts we can read (for example likes, comments counts, replies), and comment or reply text where the platform exposes it to our app | Show performance in your dashboard and, where you use it, learn writing style from your own posts |
Supported platforms and typical access:
| Platform | What we use it for |
|---|---|
| TikTok | Identify the account, publish photos and videos you send, read your own video list and engagement for posts we manage |
| Facebook Pages | List Pages you administer, publish posts, read engagement and insights for those Pages |
| Instagram (professional accounts via Meta) | Publish content, read basic profile and media needed to operate posting and performance views |
| Threads | Publish posts and read insights and replies you authorize |
| Read your account and boards, create Pins on boards you select | |
| X | Read your profile, publish posts and media |
| Identify you and publish to your member profile | |
| Bluesky | Publish posts using the credentials you connect |
| Mastodon | Publish posts to the instance account you connect |
The exact fields depend on the permissions you grant on that platform's consent screen. You can disconnect any platform in Ecomello or revoke access in that platform's security settings. On disconnect we delete access tokens promptly and remove cached platform data within 30 days, unless a longer period is required by law or needed to resolve a dispute.
Your use of each network remains subject to that network's own terms and privacy policy, including:
- TikTok Terms and Privacy Policy
- Meta Terms (Facebook, Instagram, Threads)
- Pinterest Terms
- X Terms
- LinkedIn User Agreement
5. Why we process data and on what legal basis
Where we are the controller, we rely on GDPR Article 6 as follows:
| Purpose | Legal basis |
|---|---|
| Create and administer your account, authenticate you, provide the Service you requested | Contract (Art. 6(1)(b)) |
| Process subscriptions, invoices, and payments through Stripe | Contract (Art. 6(1)(b)); legal obligation for tax and accounting records (Art. 6(1)(c)) |
| Connect stores and social accounts, publish and schedule at your request | Contract (Art. 6(1)(b)); for the OAuth grant itself, your consent toward that platform |
| Customer support | Contract (Art. 6(1)(b)); legitimate interests in assisting users (Art. 6(1)(f)) |
| Security, fraud prevention, abuse detection, debugging | Legitimate interests in protecting the Service and other users (Art. 6(1)(f)) |
| Affiliate referral cookies and click records (including IP address) | Legitimate interests in attributing referrals fairly (Art. 6(1)(f)) |
| Google Analytics cookies and events measuring how visitors find and use the website and app, including signups and purchases | Consent (Art. 6(1)(a)) as required by Law 506/2004; you can withdraw it at any time |
| Marketing cookies and conversion events sent to Meta and TikTok to measure and improve our advertising | Consent (Art. 6(1)(a)) as required by Law 506/2004; you can withdraw it at any time |
| Essential cookies needed to sign you in and prevent CSRF | Legitimate interests / strictly necessary for the service you request; Law 506/2004 does not require consent for these |
| Comply with lawful requests and keep records required by Romanian law | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, those interests are operating a secure B2B service, preventing abuse, and running an affiliate program. You may object under Article 21 as described below. We do not use your data for automated decisions that produce legal or similarly significant effects (GDPR Article 22). AI suggestions are drafts; you decide what is published.
6. Artificial intelligence
We send prompts, product text, and reference images you provide to AI providers so we can generate captions and images for your account. Output is used only to provide that feature to you. We do not use your content to train public or cross-customer models. Providers may process data outside Romania; see international transfers below.
7. Who we share data with
We do not sell personal data. We disclose it only:
- To platforms and stores you connect, as needed to perform the actions you request
- To processors who host, bill, generate AI output, send email, or help us operate the Service, under Article 28 contracts
- If required by EU or Romanian law, a court, or a competent authority
- In a merger, acquisition, or asset sale, subject to this notice
Main processors and independent recipients:
| Party | Role |
|---|---|
| Stripe | Payment processing (independent controller for card data; processor for some subscription data) |
| Cloudflare | Hosting, CDN, and security for the website and application |
| Google (Google Analytics) | Website and app analytics, only if you accept analytics cookies |
| Meta Platforms Ireland (Meta Pixel and Conversions API) | Advertising measurement, only if you accept marketing cookies; joint controller with us for collecting this data |
| TikTok Technology Limited (TikTok Pixel and Events API) | Advertising measurement, only if you accept marketing cookies |
| Underlying model providers | AI caption and image generation |
| Meta, TikTok, Pinterest, X, LinkedIn, Bluesky, Mastodon, Shopify, WooCommerce | Connected services you authorize; they process data under their own policies |
8. Transfers outside the EEA
Some recipients are in the United States or other countries without an EU adequacy decision. Where we transfer personal data outside the EEA/UK, we use GDPR Chapter V safeguards, typically the European Commission's Standard Contractual Clauses, and supplementary measures where appropriate. A copy of the relevant safeguards can be requested at privacy@ecomello.com.
9. How long we keep data
To close your account and request deletion of your personal data, email privacy@ecomello.com or contact customer support at support@ecomello.com or through our contact form. Include the email address associated with your account. Account closure is handled by our team after verifying your request; it is not available as a self-service action in the app.
- Account profile: for as long as the account is open, then deleted or anonymized within 30 days of closure, except records we must keep
- Connected-account tokens: deleted promptly on disconnect; cached platform data within 30 days
- Billing and invoices: as required by Romanian accounting and tax rules, typically up to 10 years
- Support correspondence: up to 3 years after the last message, unless a dispute requires longer
- Security logs and referral click records (including IP): up to 12 months, unless needed longer to investigate abuse
- Google Analytics event data: up to 14 months
- Advertising events sent to Meta and TikTok: kept by those platforms under their own retention policies
10. Cookies (Law no. 506/2004)
Romania implements the ePrivacy rules in Law no. 506/2004. We use cookies and similar storage only as follows. Strictly necessary cookies do not require prior consent. Analytics and marketing cookies are optional and chosen separately in the cookie banner; on ecomello.com and app.ecomello.com they are set, and their scripts are loaded, only after you accept them. Analytics events never include your name, email address, or payment details.
If you accept marketing cookies, the website loads the Meta and TikTok pixels, and when you sign up, start checkout, or pay for a subscription our servers tell Meta and TikTok about that event. These server events include a one-way hash (SHA-256) of your email address and account ID, your IP address and browser user agent, the pixel cookies below, and for payments the amount and currency. Meta and TikTok use them to match the event to their users and measure our ads. We never send your name or payment details.
| Name / type | Purpose | Duration |
|---|---|---|
| Session / CSRF cookies | Keep you signed in and protect forms against cross-site request forgery | Session or as required for security |
| ref (first-party) | Remember an affiliate code after you open a referral link, so signup can be attributed | Up to 30 days |
| analytics_consent, marketing_consent (first-party) | Remember your cookie choices on ecomello.com and app.ecomello.com | 6 months |
| _ga, _ga_<ID> (Google Analytics) | Only if you accept analytics: distinguish visitors and sessions to measure traffic, signups, and purchases | Up to 2 years |
| _fbp, _fbc (Meta Pixel) | Only if you accept marketing: identify the browser and the Meta ad click that brought you | Up to 90 days |
| _ttp, ttcsid (TikTok Pixel) | Only if you accept marketing: identify the browser and the TikTok ad that brought you | Up to 13 months |
| Appearance preference | Stored in localStorage (not a cookie) to remember light or dark mode | Until you clear it |
You can block cookies in your browser. Essential cookies are required for login and checkout. The referral cookie is set only if you arrive with a referral parameter.
You can withdraw or change your choices at any time; withdrawing deletes the related cookies and stops further analytics or marketing events.
11. Security
We apply technical and organizational measures under GDPR Article 32, including HTTPS, hashed passwords, access control for tokens, and least-privilege access for staff. No method of transmission or storage is completely secure. Personal-data breaches will be handled under Articles 33 and 34, including notification to ANSPDCP within 72 hours where required.
12. Your rights
If GDPR applies to you, you may request access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing. You can update much of your account in the app and disconnect stores or social accounts yourself.
To request a copy of your account data, including your profile, posts and saved images, contact us using the email addresses below or our contact form. Include the email address associated with your account. Our support team will verify your request and provide your data. Account data downloads are handled by our team and are not available as a self-service action in the app.
Send requests to privacy@ecomello.com or contact customer support at support@ecomello.com. We may need to verify your identity. We will respond within one month of receiving your request, extendable by two months for complex requests as allowed by Article 12.
You may lodge a complaint with the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul Gheorghe Magheru 28-30, Sector 1, București, www.dataprotection.ro. If you live in another EU Member State, you may also contact your local authority.
13. Children
The Service is for businesses and adults. It is not directed at children. In Romania the age for consent to information-society services is 16 (GDPR Article 8 as implemented by Law no. 190/2018). We do not knowingly collect personal data from children under 16. If you believe we have, contact us and we will delete it.
14. Changes
We will update the date at the top when this notice changes. Material changes will be announced in the Service or by email where appropriate. Continued use after the update means the revised notice applies to later processing.
15. Contact
Privacy: privacy@ecomello.com. Support: support@ecomello.com.