Privacy Policy

1. Who this covers

Eekaam SMC (Pvt) Ltd ("Eekaam", "we") is the controller of personal data about visitors to eekaam.com, merchants and their staff who use the dashboard, mobile app and APIs, and partners and developers in our programs. This policy explains what we collect, why, who we share it with, how long we keep it, and your rights.

For shoppers on a merchant's store, the merchant is the controller and Eekaam processes data on the merchant's instructions under our Data Processing Addendum. Section 9 describes what that processing involves; for questions about a particular store, contact that store.

2. What we collect

Information you give us

• Account: name, email address, password (hashed), phone number, business name and address, tax numbers you enter.
• Billing: plan, invoices and payment status. Card details go directly to our payment processor, Lemon Squeezy; we never see or store card numbers.
• Store content: products, images, pages, themes, settings and the policies you write.
• Communications: support requests, contact-form messages, feedback, and the record of the terms version you accepted, when, and from which IP address.
• Partner and developer program details, including payout account identifiers held by Stripe.

Information collected automatically

• Device and browser type, operating system, app version.
• IP address and approximate location derived from it.
• Usage: pages and features used, sign-in events and devices, session length.
• Cookies and similar technologies — listed in our Cookie Policy.
• Error and performance data from our monitoring (Sentry), which can include the URL you were on and your user id.

3. Why we use it and our legal basis

• To provide the Platform (accounts, stores, orders, support) — performance of our contract with you.
• To bill you and keep accounting records — contract and legal obligation.
• To keep the Platform secure (fraud and abuse prevention, login alerts, rate limiting) — our legitimate interest in a safe service.
• To send service emails (receipts, trial and renewal reminders, security alerts) — contract. These are not marketing and cannot be opted out of while you have an account.
• To send marketing about Eekaam — only with your consent, and every such email has an unsubscribe link that takes effect immediately.
• To measure and improve eekaam.com with analytics — consent, where the law requires it (see Cookie Policy).
• To comply with the law and respond to lawful requests.

4. Who we share it with

We do not sell personal data. We share it only with:

• Sub-processors that host and run the Platform for us. The current list, with what each one does and where it processes data, is at eekaam.com/sub-processors. The main ones are Amazon Web Services (hosting, Mumbai region), Lemon Squeezy (subscription billing), Resend (email delivery), Cloudflare (DNS, CDN and bot protection), Sentry (error monitoring), Google (Analytics on eekaam.com; Firebase for mobile push) and Expo (mobile push).
• Services you connect yourself — payment gateways, shipping, advertising platforms (Meta, TikTok, Snapchat, Google), apps from our marketplace and AI assistants. Data goes to them only when you enable the integration, and their own privacy policies apply. Section 5 has details.
• Your team — staff you invite to your store see the data their role allows.
• Legal authorities when required by law, and a successor if Eekaam is sold or merged, under this policy.

5. Integrations, advertising pixels and AI

Advertising pixels on your store

If you enter a Meta, TikTok, Snapchat or Google pixel id in your store settings, the Platform loads that provider's script on your storefront and sends it page views, product views, add-to-cart and purchase events. For Meta, purchase events can also be sent server-side with SHA-256-hashed email and phone. For visitors from the EU, UK and Switzerland the Platform shows a consent banner and loads pixels only after consent; elsewhere it honours the Global Privacy Control signal. You are responsible for enabling pixels only where you have the consent your customers' law requires.

Meta catalog and shop

Connecting Meta Commerce shares your product catalog with Meta and stores an access token so we can manage your catalog and ads on your behalf. Disconnecting from the dashboard revokes it.

AI assistants and apps

Eekaam offers an MCP connector so AI assistants such as Claude and ChatGPT can work in your store. When you connect one, you approve a set of scopes; within those scopes the assistant can read and change your products, orders, customers (including names, emails and phone numbers) and settings, and that data is sent to the AI provider you chose under its terms. Nothing is shared until you connect, you can see and revoke every connection from Settings → AI apps, and Eekaam does not use your data to train models. Marketplace apps work the same way: each app's scopes are shown before you install it and its own privacy policy applies.

6. Security

Data is encrypted in transit (TLS) and at rest, passwords are hashed with bcrypt, access is role-based and logged, sign-ins from new devices are alerted, and we rate-limit and monitor for abuse. Payment card processing is PCI DSS compliant through our processor. No system is perfectly secure; if we confirm a breach that affects your personal data we will notify you, and any regulator the law requires, without undue delay and within 72 hours of confirming it, telling you what happened, what data was involved and what we are doing.

7. Cookies

eekaam.com and the dashboard use strictly necessary cookies (sign-in, security, preferences) and, only with your consent where the law requires it, Google Analytics. The full list, with names, purposes and lifetimes, and how to change your choice, is in our Cookie Policy.

8. How long we keep it

• Account and store data: for as long as your account is open.
• After you close your account or your subscription ends: exportable for 30 days, then deleted from live systems; backups roll off within a further 30 days.
• Invoices and payment records: 7 years, as tax law requires.
• Support correspondence: 2 years after the last message.
• Security and access logs: 90 days.
• Analytics on eekaam.com: 14 months (Google Analytics default).
• Terms-acceptance records: for the life of the account plus 6 years, as evidence of the contract.

9. Shoppers on merchant stores

When you buy from a store on Eekaam, the merchant collects your name, contact details, address, order and payment status, and — if you tick the box — marketing consent, and Eekaam stores and processes it for that merchant. Storefronts set the cookies listed in the Cookie Policy (cart, session, currency, language, sign-in, and, where the merchant has enabled it and you have consented, analytics and advertising). To access, correct or delete your data, or to stop marketing, contact the store; every marketing email from a store has an unsubscribe link, and store account pages let you update your details. If a store does not respond, write to privacy@eekaam.com and we will help.

10. Your rights

Depending on where you live you may have the right to:

• Access the personal data we hold about you and get a copy in a portable format (from the dashboard you can export customers, orders, products and your theme at any time).
• Correct it (most details can be edited in Settings).
• Delete it (close your account from Settings → General; see section 8 for what we must keep).
• Object to or restrict processing based on legitimate interests.
• Withdraw consent at any time — unsubscribe links for marketing, the cookie banner for analytics.
• Complain to a supervisory authority. In the EU/UK that is your local data-protection authority; in Pakistan, the authority designated under the Personal Data Protection law once in force.

Email privacy@eekaam.com with your request; we verify your identity and respond within 30 days (45 days for California residents, extendable once as the law allows). We do not discriminate against you for exercising these rights. California residents: we do not sell or share personal information as defined by the CPRA, and we honour Global Privacy Control signals.

11. International transfers

We are based in Pakistan and host on Amazon Web Services in Mumbai, India; some sub-processors are in the United States and the EU. Where data about EU/UK residents leaves the EEA or UK we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, or an adequacy decision, with our sub-processors.

12. Children

The Platform is for people 18 and over. We do not knowingly collect data from children; if we learn we have, we delete it. Merchants who sell age-restricted goods must implement their own age checks.

13. Eekaam Merchant mobile app

• Signs you in through Eekaam's web sign-in and keeps a session token in the device's secure storage; it does not store your password.
• Registers a push-notification token (Expo, Google Firebase Cloud Messaging) and basic device details only to deliver alerts such as new orders. You can switch each alert type off in Settings → Notifications.
• Shows you your store's orders, products, inventory and sales; nothing else is collected. No location, contacts, photos or payment instruments.

14. Changes

We will post changes here with a new date and email you about material changes at least 14 days before they take effect. Where a change materially affects your rights we will ask for your acceptance again.

15. Contact

Privacy questions and rights requests: privacy@eekaam.com. Postal: Eekaam SMC (Pvt) Ltd, Karachi, Pakistan.