Privacy Policy

1. Data Controller

Controller: EchoWebBot Studio

Product: Giftcards Maker for Shopify

Privacy contact: [email protected]

2. Information We Collect

2.1 Information you provide

• Account and contact data: name, email address, and account identifiers when you register, subscribe, or contact us.
• Billing records: transaction ID, plan, amount, currency, payment status, and billing contact details. Complete payment card data is handled by Waffo Pancake and its payment partners and is not stored on our servers.
• Support communications: messages, attachments, and other information you choose to send us.

2.2 Information collected automatically

• Device and network data: IP address, browser type, operating system, device type, language, and time zone.
• Usage data: pages viewed, referring page, feature interactions, session duration, approximate location derived from IP address, and diagnostic or error events.
• Cookie and similar-technology data: identifiers used to maintain website operation, measure traffic, and understand use of the Service.

The extension processes gift card details and Shopify administration data locally in your browser to perform actions you request. We do not intentionally store your Shopify password, complete payment card number, or generated gift card codes on our servers.

3. How and Why We Use Information

• Provide and maintain the Service — to perform our contract with you.
• Process subscriptions, payments, cancellations, and refunds — to perform our contract and meet legal accounting obligations.
• Respond to support requests and service messages — to perform our contract and pursue our legitimate interest in customer support.
• Secure the Service, prevent fraud, and diagnose errors — for our legitimate interests in protecting users and the Service and, where applicable, to comply with law.
• Measure and improve performance and usability — for our legitimate interest in improving the Service. Where required, we ask for consent before setting analytics cookies.
• Comply with legal obligations and enforce our terms — to comply with law and pursue our legitimate interests in protecting our rights.
• Send marketing communications — only with your consent where consent is required. You may opt out at any time.

We may aggregate or de-identify information so that it no longer reasonably identifies you and use it for analytics, security, and product improvement.

4. Cookies and Analytics

We use the following categories of cookies or similar technologies:

• Strictly necessary: website delivery, security, and essential preferences. These cannot be disabled through our Service.
• Analytics: Google Analytics and Microsoft Clarity help us understand website traffic, interactions, and performance. You can restrict these through browser controls, blocking tools, or any consent controls we make available.

Learn more from the Google Privacy Policy and Microsoft Privacy Statement. Blocking some technologies may affect website features.

5. Sharing and Disclosure

We do not sell your personal information. We share it only as needed with:

• Payment processors: Waffo Pancake and its payment partners process checkout, payment, fraud-prevention, cancellation, and refund information. Complete card data is processed by them and is not stored on our servers.
• Infrastructure and support providers: hosting, email, security, and customer-support suppliers that process data for us under appropriate confidentiality and data-protection obligations.
• Analytics providers: Google Analytics and Microsoft Clarity, subject to your choices and applicable consent requirements.
• Authorities and professional advisers: when reasonably necessary to comply with law, respond to valid legal process, prevent harm or fraud, or establish, exercise, or defend legal claims.
• Business transaction recipients: in connection with a merger, acquisition, financing, or sale of assets, subject to continued protection and notice where required.
• Others at your direction: when you ask us to share information or give prior consent.

6. Security

We use reasonable technical and organizational safeguards appropriate to the nature of the information, including HTTPS encryption in transit, access controls, restricted administrative access, and service monitoring. No system is completely secure, so we cannot guarantee absolute security. If a personal-data incident creates a material risk to you, we will notify affected users and regulators within the time required by applicable law.

7. Retention

• Account and subscription data: while the account is active and for 90 days after closure or cancellation, then deleted or anonymized unless a longer period is legally required.
• Transaction and tax records: 7 years from the transaction date where needed for accounting, tax, fraud prevention, or legal compliance.
• Support communications: 2 years after the support matter is closed.
• Security and diagnostic logs: up to 12 months.
• Analytics data: up to 14 months where configuration controls are available, after which it is deleted or aggregated.

We may retain information longer if required by law, a legal hold, or an active dispute. When retention ends, we delete or de-identify the information.

8. Your Privacy Rights

Depending on where you live, you may have the right to:

• know whether and how we process your personal information;
• access or receive a copy of it;
• correct inaccurate or incomplete information;
• request deletion;
• restrict or object to certain processing;
• receive portable data in a machine-readable format;
• withdraw consent at any time, without affecting earlier lawful processing; and
• complain to your local privacy or data-protection authority.

To exercise a right, email [email protected] from the address associated with your account and describe your request. We may need to verify your identity. We will respond within 30 calendar days, or within the period required by applicable law, and will explain any permitted extension or denial.

9. Marketing Choices

You can stop marketing emails at any time by using the unsubscribe link in the message or contacting us. Opting out of marketing does not stop necessary service communications such as receipts, billing notices, security alerts, or policy updates.

10. International Data Transfers

Our providers may process information in countries other than yours, including the United States and countries where our payment, hosting, and analytics providers operate. Where required, we use recognized safeguards such as adequacy decisions, contractual data-protection terms, or the European Commission’s Standard Contractual Clauses.

11. Children

The Service is intended for business users aged 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us and we will take appropriate steps to delete it.

12. Third-Party Services and Links

The Service may link to or interact with third-party services, including Shopify, browser extension stores, and payment providers. Their own privacy notices govern information they process independently. We encourage you to review those notices.

13. Changes to This Policy

We may update this Policy as our practices or legal requirements change. We will post the updated version and revise the date above. For material changes, we will provide at least 15 days’ advance notice by email, an in-product message, or a prominent website notice where practicable.

14. Contact Us

Controller: EchoWebBot Studio

Privacy and support email: [email protected]

Support hours: Monday–Friday, 09:00–18:00 (UTC+8), excluding public holidays.