Privacy policy

Ecomations is a trade name of Rovito, a sole proprietorship registered in the Netherlands under Chamber of Commerce number 89939131, at Blauwe Hof 7415, 6602 XT Wijchen, Netherlands. Rovito is the data controller for the processing described here.

You can reach us about anything in this policy at info@ecomations.io.

This website sets no cookies, runs no analytics, uses no tracking pixels or advertising trackers, and has no user accounts. Fonts and images are served from our own domain, so simply visiting a page sends no request to any third party. There are two forms on the site, described below, and neither sends anything anywhere unless you choose to submit it.

The site is hosted by Vercel Inc. Like any web host, Vercel records technical request data: your IP address, the page requested, the time of the request, and your browser’s user-agent string. This is used only to serve the site and to keep it secure and available, and it is not combined with anything else or used to build a profile of you. The legal basis is our legitimate interest in operating a secure, functioning website (Article 6(1)(f) GDPR).

If you email us, we process your email address, your name if you give it, and whatever you choose to write, for the purpose of answering you. The legal basis is our legitimate interest in responding to enquiries, or the steps taken at your request before entering into a contract (Article 6(1)(b) and (f) GDPR).

Our mailbox runs on Google Workspace, so Google Ireland Limited processes that correspondence on our behalf, as our processor. We keep it as long as we need it to deal with your request and to meet our legal and tax obligations, and we do not use it for marketing unless you ask us to.

There are two forms on this site. The free introductory call form asks for your name, email address and WhatsApp number, plus context about your store: the stage you are at, your niche, where you advertise, how many products you test per month, your average daily revenue, what takes most of your time, and anything you want out of the call.

The sign-up form asks for the same contact details plus your company name, an optional VAT number and an optional store URL, your niche, where you advertise, and which package you choose. Company name and VAT number are used for invoicing and onboarding; the VAT number is what makes a 0% VAT invoice possible outside the Netherlands.

Both forms ask how you heard about us. If you answer that a friend or a coach referred you, we ask for their name. We use it to understand where our customers come from and, where a referral arrangement exists, to calculate commission. That name is someone else’s personal data: we do not contact them on the basis of your answer, and if they ask us to remove it, we will.

The purpose of all of it is to contact you about Ecomations and to prepare properly before we speak. The legal basis is your consent (Article 6(1)(a) GDPR), which you give by submitting the form, and for the sign-up form also the steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). You can withdraw consent at any time by emailing info@ecomations.io, and we will delete your entry.

We use your WhatsApp number to reach you about the call or your onboarding, and for nothing else. Submitting a form also triggers one confirmation email to the address you gave, sent through Google Workspace, the same mailbox provider named below.

Entries are stored in a database run by Supabase, Inc., hosted in the European Union (Frankfurt, Germany). We keep them until the early-access phase is finished, and in any case no longer than 12 months, after which they are deleted. We do not sell or rent them, and nothing about your submission is decided automatically.

To keep automated submissions out, both forms include a hidden field that people never see and limit how often they can be submitted. Neither stores any additional data about you.

Ecomations Ads is a business application registered with Meta. It exists to create and manage advertising campaigns on behalf of our business customers, on the customer’s own Meta advertising account. It is not used by, and is not intended for, members of the public.

How access is granted. A customer grants us access themselves, inside Meta Business Manager, by sharing specific assets with our business portfolio as a partner. We ask only for what the work requires: the ability to manage campaigns on their advertising account, the ability to run ads in the name of their Facebook Page, and access to their advertising dataset where conversion optimisation is used. We do not ask for full control of an advertising account, its finances, or its permissions.

What we do with it. We use that access solely to create and manage advertising campaigns, ad sets, creatives and ads on the customer’s instruction, and to read back the resulting performance figures so the customer can see how their campaigns are doing. The legal basis is performance of our contract with the customer (Article 6(1)(b) GDPR).

What we do not do. We do not download, store, or otherwise process the personal data of a customer’s own website visitors or buyers held in their Meta datasets. We do not sell or rent any data, we do not use it to advertise anything of our own, and we do not share it with anyone beyond the processors named below.

Withdrawing access, and deletion. A customer can remove our access at any time, without asking us, in Meta Business Manager under Business settings → Partners, by removing Ecomations as a partner. Access ends immediately when they do. To have any data we hold about a customer deleted, email info@ecomations.io and we will delete it within 30 days, except where we are legally required to keep records. Dutch tax law obliges us to retain invoices and related administration for seven years.

We use a small number of service providers who process data on our instructions:

• Vercel Inc.: hosting of this website, and the request logs described above.
• Google Ireland Limited: Google Workspace, which hosts the mailbox behind info@ecomations.io and therefore any correspondence you send us.
• Supabase, Inc.: the database behind both forms. Entries are stored in the European Union (Frankfurt, Germany).
• Meta Platforms Ireland Ltd.: the advertising platform itself. When we manage a customer’s campaigns, the processing happens on Meta’s systems and Meta’s own terms and privacy policy apply to it alongside this one.

Some of these providers are based outside the European Economic Area, or use infrastructure that is. Where personal data is transferred outside the EEA, it is done on the basis of the safeguards required by Chapter V of the GDPR: an adequacy decision of the European Commission, or the European Commission’s standard contractual clauses.

Specifically: form entries are stored on servers in the European Union, but Supabase, Inc. is a company based in the United States and its staff may access the database in order to support it. That access is covered by our data processing agreement with Supabase and by the European Commission’s standard contractual clauses.

Under the GDPR you have the right to ask us for a copy of the personal data we hold about you, to have it corrected or deleted, to have its processing restricted, to object to processing based on our legitimate interests, and to receive it in a portable form. Email info@ecomations.io and we will respond within one month.

If you are not satisfied with how we handle it, you have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

If we change what we do with personal data, we change this page and update the date at the top. We do not run a newsletter. Our contact list is for early access, not a mailing list, so this page is where changes are announced.