ecomtoolshed.com is an independent editorial website that reviews software and services for online sellers. This policy explains what personal information we collect, why we collect it, who we share it with, and what rights you have over it.
Last updated: September 21, 2026
The short version
| Question | Answer |
|---|---|
| Do I need an account to read this site? | No. There is no login and no paywall. |
| Do you sell my personal information? | No. We have never sold personal information, and as of the date of this policy we do not share it for cross-context behavioural advertising. |
| Do you run advertising or analytics trackers? | Not at present. As of the date of this policy the site loads no third-party analytics or advertising scripts of any kind. Section 7 explains exactly what would change, and what we would do first, if we ever introduce third-party advertising. |
| What do you collect if I just read? | Standard server logs that every web host records, including IP address, user agent, and the page requested. |
| What do you collect if I contact you? | Whatever you type, including your email address and the content of your message. |
| Who do you share it with? | Our hosting provider and our email service provider, plus vendors you reach by clicking an outbound link. Details below. |
This summary is for convenience only. The sections below are the operative policy.
1. Who we are and what this policy covers
ecomtoolshed.com (“ecomtoolshed”, “we”, “us”) is an independently operated editorial website that publishes research, comparisons, and buying guidance about software used to run online stores — storefront and checkout platforms, email marketing, page builders, funnel tools, helpdesk, and the surrounding operations stack.
This policy covers personal information we process when you:
- visit or read any page on ecomtoolshed.com;
- contact us by email or through our contact page;
- subscribe to any email list we may offer;
- interact with an affiliate or outbound link on the site.
It does not cover what third-party websites and software vendors do with your information after you leave us. When you click through to a vendor, that vendor’s own privacy policy applies from the moment you arrive. We do not control it and we are not responsible for it.
2. Information we collect
2.1 Information you give us directly
We only receive personal information from you when you choose to send it.
| What you do | What we receive |
|---|---|
| Email us or use the contact form | Your email address, your name if you sign it, and the content of your message including any attachments |
| Subscribe to a newsletter | Your email address, and the date and IP address of your subscription |
| Post a comment, if comments are enabled | Your name or display name, email address, optional website URL, comment text, and IP address |
We do not ask for and do not want sensitive categories of information — financial account numbers, payment card data, tax identifiers, government identifiers, precise geolocation, or information about children. Please do not send those to us.
We never ask you for your login credentials to any third-party tool. If a message claiming to be from us asks for a password, an API key, or access to your store account, it is not from us.
2.2 Information collected automatically
Like virtually every website, our hosting infrastructure records standard technical data when a page is requested. This includes:
- IP address;
- date and time of the request;
- the page or file requested and the referring page;
- browser type, version, and language;
- operating system and device type;
- HTTP status codes and bytes transferred.
These logs are generated by our hosting provider for security, abuse prevention, and diagnosing faults. They are not used to build a profile of you and are not combined with any other data to identify you.
2.3 Information collected through cookies and similar technologies
We use a small number of cookies that are strictly necessary for the site to function. We currently do not set analytics cookies, advertising cookies, or cross-site tracking pixels. Vendors and affiliate networks may set their own cookies once you click an outbound link — see our Cookie Policy for the current, specific list and for how to control them.
3. How we use personal information
We use personal information only for the purposes below.
| Purpose | Data used | Why |
|---|---|---|
| Responding to your enquiry | Email address, message content | To answer you |
| Sending email you asked for | Email address | To deliver the newsletter or alerts you subscribed to |
| Operating and securing the site | Server logs, IP address | To keep the site online, block abuse, and diagnose errors |
| Publishing and moderating comments | Name, email, comment text, IP | To display comments and prevent spam |
| Understanding aggregate readership | Aggregated, de-identified page counts | To decide what to write next |
| Meeting legal obligations | Records as required | To comply with applicable law and lawful requests |
We do not sell personal information. We do not rent it, trade it, or share it for cross-context behavioural advertising. We do not use your personal information to train machine learning models.
4. Legal bases for processing (EEA, UK, and Switzerland)
Where the EU or UK GDPR applies, we rely on the following legal bases:
| Processing activity | Legal basis |
|---|---|
| Responding to enquiries you send us | Legitimate interests — answering people who write to us, or steps taken at your request |
| Sending a newsletter you subscribed to | Consent, withdrawable at any time using the unsubscribe link in every email |
| Server logs and site security | Legitimate interests — keeping the service available and secure |
| Comment publication and spam prevention | Legitimate interests, and consent where required |
| Legal compliance | Legal obligation |
Where we rely on legitimate interests, we have weighed those interests against your rights and consider the processing minimal and non-intrusive. You may object at any time using the contact details below.
5. Who we share personal information with
We do not sell or rent personal information. We share it only with service providers who help us run the site, and only as much as they need.
| Recipient type | What they receive | Why |
|---|---|---|
| Web hosting provider | All server log data, and any data submitted through the site | To host and serve the site |
| Email service provider | Email address and message content, if you subscribe or email us | To deliver and store email |
| Email delivery and security providers | Metadata needed to route and filter mail | To deliver our email without it being marked as spam |
| Affiliate networks and vendors | A click identifier when you follow an outbound link, then whatever their own policies cover | To attribute a signup or purchase to us so we are paid a commission |
| Professional advisers and authorities | Only what is strictly required | Where legally compelled or necessary to establish or defend legal claims |
Some of these providers are located in the United States and other countries outside the EEA or UK. Section 8 explains the safeguards.
We will also disclose personal information where we are legally required to, for example in response to a valid subpoena or court order, or where disclosure is necessary to protect the rights, property, or safety of any person.
6. Affiliate links and third parties
ecomtoolshed earns revenue through affiliate commissions. When you click a link to a vendor, the vendor or its affiliate network may record that you arrived from ecomtoolshed and may set cookies on your device in order to attribute a later signup or purchase to us. That processing is carried out by the vendor under its own privacy policy, not by us, and we do not receive your name, payment details, store data, or account contents as a result. We may receive aggregate reporting such as the number of clicks and, where a program provides it, confirmation that a commission was earned.
We never receive access to your account with any vendor, and we never ask for it. See section 2.1.
We also link to external sources we cite. Following any of those links takes you to a site we do not control.
7. Advertising: our current position, and what would change
Current position. As of the date of this policy, ecomtoolshed displays no third-party advertising of any kind. No advertising network, ad server, or demand-side platform receives visitor data from this site, and no advertising or remarketing cookie is set.
If we introduce advertising. Advertising is a possible future funding route for this site, alongside affiliate commissions. If and when we introduce a third-party advertising network, the following will be true before a single ad is served, and this section will be rewritten with each vendor named:
| What changes | What we will do first |
|---|---|
| Advertising cookies appear | Rewrite this policy and the Cookie Policy to name every vendor, its cookies, and their durations |
| Information may be shared for cross-context behavioural advertising under the CPRA | Publish a working “Do Not Sell or Share My Personal Information” opt-out that works immediately and needs no account |
| Readers in the EEA, UK, and Switzerland may be tracked | Deploy a consent management platform that blocks non-essential cookies until consent is given, as the ePrivacy Directive and the GDPR require |
| Vendors require specific disclosures | Publish the disclosures each network requires before serving ads, including, where the vendor is Google, the statements Google requires about its use of advertising cookies and how readers can opt out of personalised advertising |
This site is a commercial publisher. Any third-party advertising we add is therefore likely to involve cookies set by the ad network, and would be treated as a sale or sharing under California law and as requiring consent under EU law. We do not treat either obligation as optional.
Two editorial commitments hold whether or not advertising is ever present: no advertiser buys a ranking, a score, or a recommendation, and no advertiser reviews an article before publication. Both are stated in our Editorial Policy.
8. International transfers
Our hosting and email providers may store and process data in the United States and other countries. Where personal data protected by the GDPR is transferred out of the EEA or UK, we rely on appropriate safeguards, which may include the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision such as the EU-US Data Privacy Framework where the recipient is certified. You may ask us for details of the safeguard relied on for a specific transfer.
9. How long we keep information
| Data | Retention period |
|---|---|
| Contact and editorial enquiries | Up to 24 months after the last exchange, then deleted |
| Newsletter subscription records | Until you unsubscribe, plus a short suppression record so we do not contact you again |
| Server logs | Typically 30 to 90 days, as configured by the hosting provider; shorter where practical |
| Comments, if enabled | Until the post is removed or you ask us to delete your comment |
| Records needed for tax, accounting, or legal claims | As long as the law requires |
When a retention period ends we delete or irreversibly anonymise the data.
10. Your rights in the EEA, UK, and Switzerland
Subject to conditions and exemptions in the law, you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate or incomplete data;
- erase data where there is no continuing lawful reason for us to keep it;
- restrict processing while a dispute about accuracy or lawfulness is resolved;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability, receiving data you provided in a structured, machine-readable format;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
- lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner’s Office; in the EU it is the authority in your country of residence, place of work, or where the alleged breach occurred.
To exercise any right, email privacy@ecomtoolshed.com. We will respond within one month, extendable by two further months for complex requests, and we will tell you if we need that extension. Exercising your rights is free.
11. Your rights in California (CCPA and CPRA)
If you are a California resident, you have the right to:
- know the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it;
- delete personal information we collected from you, subject to statutory exceptions;
- correct inaccurate personal information;
- opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information;
- not be discriminated against for exercising any of these rights. We do not offer financial incentives and we will not degrade the site or our service because you exercised a right.
As of the date of this policy we do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are defined by the CPRA. On that basis there is currently no sale or sharing for you to opt out of, and we honour Global Privacy Control signals as a valid opt-out request where applicable. See our Do Not Sell or Share My Personal Information page.
If we ever introduce third-party advertising, that may result in information being shared for cross-context behavioural advertising within the meaning of the CPRA. Should that happen, this section and our Do Not Sell or Share page will be updated before the advertising goes live, a working opt-out will be published that takes effect immediately and requires no account, and Global Privacy Control signals will be honoured as binding opt-out requests rather than as best-effort requests.
In the preceding twelve months we have collected the categories of information described in section 2 — identifiers such as IP address and email address, internet or network activity such as pages requested, and the contents of messages you send us — for the purposes listed in section 3, and disclosed them only to the service provider categories listed in section 5.
To make a request, email privacy@ecomtoolshed.com. We will verify your request by asking you to confirm control of the email address associated with the data. An authorised agent may submit a request on your behalf with written permission; we may still ask you to verify your own identity directly. We will respond within 45 days, extendable once by a further 45 days with notice.
12. Your rights in other US states
Residents of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Hampshire, New Jersey, Kentucky, Maryland, Minnesota, Nebraska, and Rhode Island, may have rights to access, correct, delete, obtain a portable copy of, or opt out of targeted advertising, sale, or profiling. We extend the processes in section 11 to those residents. Email privacy@ecomtoolshed.com and tell us which state you reside in. Where a state provides an appeal process, and you are unhappy with our decision, you may appeal by replying to our decision email with the word “Appeal”; we will review it and respond in writing.
13. Children’s privacy
ecomtoolshed is a general-audience site intended for adults running or working in a business. It is not directed to children, and we do not knowingly collect personal information from anyone under 13, or under 16 where a jurisdiction applies that threshold. We do not knowingly sell or share the personal information of minors. If you believe a child has provided personal information to us, email privacy@ecomtoolshed.com and we will delete it promptly.
14. Security
We take reasonable technical and organisational measures to protect personal information, including encrypted transport (HTTPS) across the site, access controls on administrative systems, and limiting the data we collect in the first place. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affecting your rights occurs, we will notify you and any relevant authority as required by law.
15. Third-party links and embedded content
Our articles link to vendors, pricing pages, documentation, help centres, forums, and publications. If we embed content from another site, such as video, that provider may collect data about your visit and set cookies under its own policy. We do not control third-party sites and their practices are outside the scope of this policy. We encourage you to read the privacy policy of any site you visit from a link here — especially before you create an account or hand over payment details to a vendor we review.
16. Changes to this policy
We may update this policy to reflect changes in our practices or in the law. The “last updated” date at the top always shows the current version. If a change is material, we will make it prominent on the site. Continued use of the site after a change means you accept the updated policy.
17. How to contact us
For any question or request about this policy or your personal information:
- General and privacy requests: privacy@ecomtoolshed.com
- Editorial corrections: editor@ecomtoolshed.com
We aim to acknowledge requests within a few business days and to resolve them within the statutory deadlines described above.
If you are not satisfied with our response, you may complain to your local data protection authority.