App Privacy Policy
This policy covers the Eebz app, our digital shelf analytics platform at app.eebz.com, together with the Eebz API, Ada, and the emails and reports the app sends. It is provided by Eebz Ltd. Our website privacy policy covers the Eebz website, and the Eebz extension for Google Chrome has its own Chrome extension privacy policy.
Last updated: 3 November 2026
Who we are
Eebz Ltd is a company registered in England and Wales, company number 11871138.
For any question about this policy or your data, email [email protected] or contact us.
Our role
Eebz handles personal data in the app in two ways.
- As a controller, for the data we need to run your account: your account details, sign-in and security records, usage of the app, support conversations and billing. This policy explains how we handle that data.
- As a processor, for personal data that our customers add to the app themselves, such as retailer contacts and the people they choose to send reports to. We handle that data only on our customer's instructions, under our agreement with them. Our customer is the controller of that data, so questions about it should go to the organisation that added it.
The product, price, availability, ranking and review data the app collects from public retailer websites is about products, not people. It does not include reviewers' names or other details about them.
What we collect
Account details
- Your name, email address, organisation and role in the app.
- Your password, which we store only as a one-way hash and can never read.
- Your two-factor sign-in settings, such as whether you use an authenticator app or email codes.
Sign-in and security records
- A record of sign-ins and other key account actions, with the IP address and type of device used.
- When you last signed in and were last active.
- Failed sign-in attempts, which we use to block access temporarily after repeated failures.
- Requests made to the Eebz API with your organisation's API tokens.
Your settings and work
- Your dashboards, table and view settings, saved and shared views, custom reports and product lists.
- Tasks you create or are assigned, and their status.
- Your email notification preferences, and a record of the notifications and reports we send you.
- Searches you run in the app, including searches answered by Ada.
Support conversations
When you use the support chat in the app, we keep the conversation so that our team can pick it up and so we can send you a transcript if you ask for one.
Usage analytics
To understand how the app is used and to improve it, we use Microsoft Clarity and Google Analytics. Clarity records how you use the app, such as the pages you view, clicks, scrolling and mouse movement. Both services receive your email address, name and organisation so we can link usage to your account. We do not use these services for advertising.
Billing
For customers we invoice, we keep the billing contact's name, email address and the details needed to raise and send invoices.
Data our customers add
Customers can add personal data about other people to the app. We process this data as a processor, on our customer's behalf. It includes:
- Retailer contacts: name, email address, phone number, job title, LinkedIn profile, photo and notes.
- The email addresses of people a customer chooses to send notifications and reports to.
Customers are responsible for having a lawful basis to add this data and for telling the people concerned. If your details have been added by an Eebz customer, contact that organisation first. We will help them answer your request.
How we use it
| Purpose | Lawful basis |
|---|---|
| Providing the app: your account, dashboards, reports, alerts, Ada and the API | Performance of our contract with you or your organisation |
| Keeping accounts secure: sign-in records, two-factor sign-in, blocking repeated failed sign-ins | Legitimate interests in protecting the app and our customers' data |
| Answering support requests | Performance of our contract, and legitimate interests in helping you use the app |
| Understanding how the app is used and improving it | Legitimate interests in understanding how the app is used and improving it |
| Managing our relationship with your organisation, including account management and telling you about changes to the app | Legitimate interests in running and growing our customer relationships |
| Invoicing and keeping financial records | Performance of our contract, and legal obligation |
We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
Who we share it with
We use the service providers below to run the app. Each one handles personal data only to provide its service to us, under a contract with data protection terms.
| Provider | What it does for us | Where |
|---|---|---|
| Microsoft Azure | Hosts the app, its databases and its files | European Union |
| Anthropic | Powers Ada search and the support chat, which means the text you type is sent to Anthropic to generate an answer | United States |
| Mailchimp Transactional (Mandrill) | Sends app emails, notifications and reports | United States |
| Microsoft Clarity | Usage analytics and session recording | United States |
| Google Analytics | Usage analytics | United States |
| HubSpot | Our customer relationship records, including when users at customer organisations were last active | European Union |
| Xero | Invoicing and accounts | United States |
We may also share personal data with professional advisers, with a buyer if Eebz or its business is sold, or where the law requires it.
International transfers
The app is hosted in the European Union. Where a provider above handles personal data outside the UK and European Economic Area, we protect it with the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, or, where the provider is certified, the EU-US Data Privacy Framework and its UK Extension.
Cookies in the app
- A sign-in cookie that keeps you signed in. The app cannot work without it.
- Cookies set by Microsoft Clarity and Google Analytics for usage analytics.
How long we keep it
- Account details, settings and work: for as long as your account is active, then deleted within 90 days of your user being removed or your organisation's contract ending.
- Data our customers add: deleted within 90 days of the customer's contract ending, or sooner if they ask.
- Sign-in and security records: 365 days.
- Support conversations: 2 years.
- Invoices and financial records: six years, as UK law requires.
- Backups: 180 days, after which deleted data is removed from backups too.
How we protect it
- All traffic to the app and API is encrypted.
- Passwords are stored only as one-way hashes.
- Two-factor sign-in is available, by authenticator app or email code.
- Accounts are blocked temporarily after repeated failed sign-ins.
- Each organisation's data is separated, and users only see the data their role allows.
Your rights
Under UK and EU data protection law you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data erased, in some circumstances.
- Restrict or object to our use of your data, in some circumstances.
- Receive your data in a portable format, in some circumstances.
To use any of these rights, email [email protected]. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office, or to the data protection authority where you live.
Changes to this policy
We will update this page when the way we handle personal data changes, and tell account holders by email about any significant change.