EcomSapio is a Chrome extension that saves e-commerce research explicitly selected by the user and organizes it in Google Sheets and Drive owned by that user. This policy explains exactly what we collect, where it is stored, who processes it, how long we keep it, and how to delete it.
EcomSapio is operated by Must GoWith Ltd, a company registered in England and Wales (company no. 14838950), registered office: c/o Sync Accountants Limited, The Media Centre, 7 Northumberland Street, Huddersfield, United Kingdom, HD1 1RL. Must GoWith Ltd is the data controller for the personal data described in this policy. Contact for privacy matters: use our contact form, or write by post to the registered office address above.
Stored in your own Google account (you own it):
Stored in our database: EcomSapio's database is a PostgreSQL database hosted in the United States on Neon (our database provider) via Replit (our application host). Both are SOC 2-compliant cloud services. Data in transit is encrypted with TLS; data at rest is encrypted by the storage provider.
Voice notes (paid plans) are transcribed in your browser using your browser's built-in speech recognition (which may send audio to your browser vendor's speech service, per your browser's own policy). Our servers never receive audio — only the resulting text, which is filed like any other clip. Screenshots and uploaded images are processed to extract their text; the image itself is stored only in your own Google Drive, not in our database.
If you turn on the radar in Settings (it is off by default), the extension sends the URL of the page you are currently viewing to our servers to check whether you already saved it, and lights a badge if so. The URL is used only to answer that check — it is not stored and no browsing history is built. Turn the radar off anytime to stop these checks entirely.
To organize your saves, the relevant content is sent to our AI provider, OpenAI, via API: text you save (summarization and category filing), images and documents you upload (text extraction), the text of voice notes (your browser produces the transcript — audio may be processed by your browser vendor's speech-recognition service, but EcomSapio never receives or sends it), and your questions in "Ask EcomSapio" (answering from your own saved research). Under OpenAI's API terms this data is not used to train their models. While the AI call itself is transient, the results — summaries, extracted text, and embeddings — are stored in our database as described above. EcomSapio's AI only organizes your content; it never rates, scores, or judges it.
EcomSapio requests these Google scopes: openid, email,
profile (to sign you in), and drive.file (to create and
write your EcomSapio spreadsheets, the EcomSapio Drive folder, and the files
EcomSapio itself uploads there).
drive.file only grants access to files created by EcomSapio — we
cannot see, read, or touch any other file in your Drive, including spreadsheets
you did not create with EcomSapio. EcomSapio's use of
information received from Google APIs adheres to the
Google API
Services User Data Policy, including the Limited Use requirements.
If you share a journey, the people you invite (and who accept) can see the clips saved in that journey — including their summaries and source links — and your name/email as the journey owner. Don't share a journey containing content you want to keep private. You can remove collaborators at any time.
We do not sell your data, and we do not share it with advertisers or data brokers. Data is shared only with the processors required to run the service:
Where UK or EU data protection law applies, we process your data on these bases: performance of a contract (providing the service you signed up for — capturing, filing, storing, and searching your saves; managing your account and plan); legitimate interests (service security, abuse and fraud prevention, plan-limit enforcement, and short-lived diagnostic logs); and legal obligation (billing and tax records). We do not use your data for advertising or profiling, and we do not make automated decisions with legal or similarly significant effects.
If you are in the UK or EU, you have the right to access the personal data we hold about you, to correct it, to delete it (account deletion in Settings does this self-serve), to export it in a portable format (your research already lives in your own Google Sheet, which you can export at any time), to restrict or object to processing based on legitimate interests, and to withdraw consent where processing is based on consent. To exercise any of these rights, use our contact form or write by post to the registered office address above — we respond within one month. You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in France, the CNIL (cnil.fr); or your local EU authority.
Our subprocessors listed above store and process data in the United States. Where UK/EU data protection law applies, these transfers are safeguarded by the providers' standard contractual clauses (SCCs, with the UK Addendum or International Data Transfer Agreement where applicable) and, for providers certified under it, the EU–US / UK–US Data Privacy Framework.
All data is transmitted over TLS. Passwords are salted and hashed with scrypt. Sign-in handoffs use short-lived, single-use codes — durable credentials are never placed in URLs. Server-side quotas, permissions, and plan limits are enforced on our servers, never trusted to the extension.
Stored content, extracted text, and embeddings are kept for as long as your account exists, or until you delete the individual clip (deleting a clip or a category removes its database records too). Diagnostic logs are retained for a short operational window. You can delete your account at any time from the extension's Settings: this permanently removes — within 30 days, typically immediately — your account, stored content copies, extracted text, embeddings, sessions, device records, invitations, and journey memberships, and cancels any active subscription. We may retain limited information where required for legal, security, or billing purposes (for example, billing records kept by Stripe). Your spreadsheets and uploaded files remain in your own Google Drive under your control; delete them there if you wish, or revoke EcomSapio's access at myaccount.google.com/permissions.
Questions? Use our contact form, or write by post: Must GoWith Ltd, c/o Sync Accountants Limited, The Media Centre, 7 Northumberland Street, Huddersfield, United Kingdom, HD1 1RL.