Start for freeDE

Privacy policy

Last updated: November 2026

This is an English translation provided for convenience. The German version is legally binding.

1. Controller

The controller for the processing of personal data on this website and in the ecomando application is:
Codemerk GmbH i. G., represented by the managing directors Neda Mahrokh and Caglar Imrek
Wachtstraße 17–24, 28195 Bremen, Germany
Email: info@ecomando.de

We have not appointed a data protection officer because we are not required to. Please send data protection questions to the address above.

2. What ecomando does

ecomando is an analytics tool for online shops. At the user’s request it connects data sources (Shopify, Shopware, Lightspeed, Google Analytics, Google Search Console, Google Ads, Google Merchant Center, Meta Ads, TikTok Ads, Pinterest Ads) and presents their metrics in a dashboard. Changes to shop content are written only after the user’s explicit approval. Our offer is aimed at businesses.

3. Visiting this website

When you open the website our hosting provider processes technically necessary data: IP address, date and time, requested address, browser and operating system. These server logs serve secure operation and error analysis and are deleted after a few days. The legal basis is our legitimate interest in a stable and secure service (Art. 6 (1) (f) GDPR).

We use no analytics or advertising services and embed no third-party content. Fonts and images are served from our own server; opening a page creates no connection to Google Fonts or other third-party servers.

4. Cookies

We only use cookies that are strictly necessary:

  • Sign-in: session and security cookies (session, protection against forged requests, return address after signing in).
  • active_org: remembers which shop you currently have open in the application.
  • locale: remembers the language of the application when you change it.

The legal basis is § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act); no consent is required. Subsequent processing is based on Art. 6 (1) (b) GDPR. There are no tracking or advertising cookies.

5. Account and use of the application

When you register we store your name, email address and a password (as a hash only) or, when signing in with Google, the email address, name and profile ID transmitted by Google. In addition we store details about your shop (name, country, language, industry) and your settings. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR). Without this data we cannot create an account.

In the setup assistant we store which steps were shown, completed or skipped in order to improve the assistant (Art. 6 (1) (f) GDPR).

6. Data from connected Google services

When you connect Google services you grant ecomando access to the following data via Google OAuth. We use it solely to display it in your dashboard, compute recommendations and send reports to you. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).

  • Google Analytics (read-only): sessions, users, channels, page views, events and revenue of your GA4 property.
  • Google Search Console (read-only): queries, clicks, impressions and positions of your website.
  • Google Ads: campaigns, costs, clicks, conversions, search terms, keywords, ads and settings of your ad account. No changes are made to the account.
  • Google Merchant Center: product status, issues, clicks and market data of your Merchant Center account.

Data received from Google is not sold to third parties, not used for advertising and not used to train AI models. Access and refresh tokens are stored encrypted. You can disconnect any integration at any time under “Integrations”; the stored tokens are deleted when you do. You can also revoke access in your Google account at myaccount.google.com/permissions; after that we can no longer retrieve data. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Data from shop systems and ad platforms

When Shopify, Shopware or Lightspeed is connected we read orders (date, amount, quantity, traffic source), products and product content. We do not store names, email or shipping addresses of your customers. For Meta, TikTok and Pinterest Ads we read campaign metrics. Write access to product content (Shopify, Lightspeed) is used only when you explicitly approve a change. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR). Credentials are stored encrypted and deleted when you disconnect.

8. AI features

On your click, the AI Product Optimizer sends product content (title, description, images) and search data to Anthropic to obtain copy suggestions. Anthropic processes this data as a processor and does not use it for training. Without your click no data is sent to Anthropic. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR). Suggestions are drafts; you decide what gets published.

9. Emails and push notifications

We send you emails that belong to the contract: welcome email, notices about the trial and your plan, alerts about unusual metrics or failed connections, and reports. You choose which alerts and reports you receive in the settings (Art. 6 (1) (b) GDPR). We do not send newsletters or advertising.

You only receive push notifications if you allow them in your browser or in the app (Art. 6 (1) (a) GDPR). For this we store an endpoint of your browser’s push service or a device token, and the browser identifier. Delivery runs through the respective provider’s push service (e.g. Google, Mozilla, Apple; in the app Google Firebase Cloud Messaging or Apple Push Notification Service). You can withdraw permission at any time in the settings of ecomando, your browser or your device; the endpoint is then deleted.

10. Contact

When you email us we process your details to answer the request (Art. 6 (1) (b) GDPR for questions about the contract, otherwise (f)). We delete the messages once they are resolved and no retention obligation applies.

11. Service providers

  • Hosting: Vercel Inc. (USA), Frankfurt data centre, for website and application.
  • Database: Neon, Frankfurt data centre.
  • Email delivery: Resend (USA).
  • AI: Anthropic PBC (USA), only for the AI Product Optimizer.
  • Payments: Stripe Payments Europe Ltd. (Ireland) for subscriptions and invoices. Payment data is stored with Stripe, not with us.
  • Web data: DataForSEO and Google PageSpeed Insights for ranking, backlink, visibility and page speed checks. Only public addresses, domains and search terms are transmitted.

We have concluded data processing agreements under Art. 28 GDPR with the providers that process personal data on our behalf.

12. Transfers to third countries

Some providers are based in the USA or belong to companies there (Vercel, Resend, Anthropic, Stripe, Google). Data may therefore be transferred to the USA. Transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR).

13. Retention

We keep account and shop data and metrics as long as the account exists so that comparisons over time are possible. Credentials for connected services are deleted when you disconnect. If you want your account deleted, write to info@ecomando.de; we then remove all data within 30 days. Invoices and accounting records are kept for up to ten years due to commercial and tax law obligations (§ 257 HGB, § 147 AO).

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7 (3) GDPR).

Right to object: Where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Send requests by email to info@ecomando.de. You can also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us, the State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen.

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.