Privacy Policy

The short version

• Buyer details in your orders and messages are your business’s responsibility. ELMS handles them for you and does not use them for advertising.
• AI services help write listing text and message drafts. Buyer message text goes to an AI service only if you turn on reply drafts or automatic replies, or press Draft with AI in a conversation. Both reply modes are off until you turn them on.
• To see, correct or delete your data, write to support@elmstool.com with the subject “Privacy request”.

Who we are

ELMS helps sellers turn supplier product links into eBay listings and manage the orders and messages that follow. In this policy, “ELMS”, “we” and “us” mean the business that runs ELMS. “You” means anyone who visits our pages or uses ELMS.

We play two roles.

Your account data

Data about you as our customer: sign-in details, purchases, settings and security records. We decide why and how it is used, so we are the controller.

Buyer data in your store

Data about the people who buy from you. You decide why it is used and we handle it for you, so you are the controller and we are your processor. See buyer data in your store.

For anything in this policy, write to support@elmstool.com. Our other mailboxes are in the contact section.

What this policy covers

This policy applies to our website at elmstool.com, the ELMS app, the parcel-tracking page that your buyers can open from a link you send them, the ELMS Order Sync browser extension and the e-mails we send you.

It does not cover other companies. eBay, supplier platforms, sign-in providers and our payment partner run their own services under their own privacy terms.

What we collect

If you do not give us the details we need to run your account, such as an e-mail address, we cannot create the account.

Account and sign-in

When you create an account we collect your e-mail address, a username and a password, which we store only as a one-way hash. We also collect the phone number you enter and its country. We use it for account contact and security. Only our team can see the phone number, and it is not shown to other users. You can change it in Settings.

We also keep the date on which you confirmed the content-rights window, and the time of your last confirmation before removing brand words from a listing. We keep them to show what you agreed to and to enforce the Terms.

Until you confirm your e-mail address, we hold the details you typed, a protected copy of the confirmation code and your IP address. An unfinished sign-up is discarded automatically. We run basic checks on the address to stop junk sign-ups.

If you sign in with an account from another provider, such as your eBay account or a social account, the provider tells us who you are. For a social account we receive your e-mail address, name and profile picture. For an eBay sign-in we keep eBay’s identifier for you and do not use any e-mail address from eBay.

We also keep the settings you choose, such as your pricing rule, description template and brand-word list.

Your eBay store connection

When you connect an eBay store, you sign in on eBay’s own page. ELMS does not see your eBay password. eBay gives ELMS an access token, which we store encrypted. We also keep your eBay user name, the store name and logo if you have them, the eBay site you sell on, and your business policies and item location. After you connect, ELMS imports your recent orders and your message inbox.

Supplier connections and your extension key

If you connect a supplier account, we keep the key or access tokens it needs, stored encrypted, and the account name the supplier shows. ELMS also creates a personal key for the ELMS Order Sync browser extension. We store it in protected form. You can create a new key in Settings, which stops the old one.

Your content

This is what you create or import in ELMS: product details, drafts, listings, pictures, prices, notes, saved replies and files you upload, such as a CSV file.

Buyer data we receive from eBay

When eBay sends us your orders and messages, we receive buyer data: the buyer’s eBay user name, delivery name and address, phone number and e-mail address when eBay provides them, the checkout note, items bought, amounts, order and payment status, tracking details, messages with their attachments, and public profile details such as the feedback score and join date. We also keep the notes you write about orders and conversations. The section on buyer data in your store explains who decides what happens to this data.

Earnings and fees

For the profit view, ELMS reads earning and fee figures for your orders from eBay. It also stores the buying prices that you type in.

Purchases and invoices

When you buy a plan or another paid item, we keep the item, the amount, any discount or voucher used, the date, the type of payment method, a payment reference and your invoice number. Your invoice shows your name and e-mail address.

Payments are handled by our payment partner. ELMS never sees your card or wallet details.

Referral and affiliate data

If you use a referral code or an affiliate link, we record which code was used and which purchases it relates to. If you join the affiliate programme, we also keep your application, commission records and payout details.

The person who referred you can see a partly hidden version of your e-mail address, your join date and whether you have bought. An affiliate who brought you to ELMS can see a partly hidden version of your e-mail address and the amounts of your payments. The Affiliate Terms explain both programmes.

Support and our notes

When you write to support, in the app or by e-mail, we keep your messages, our replies, your name and your e-mail address. Mail sent to our support address, including legal notices and privacy requests, can become a support ticket. Our team also keeps private notes and tags on accounts, for example about a refund request. You do not see these notes.

Copyright and content complaints

If a rights owner or anyone else sends us a notice about material in ELMS, or a user sends a counter-notice, we keep it with the contact details in it, such as a name, organisation, e-mail address, postal address and telephone number, the material it points to, the statements and signature it contains, and our answer. You do not need an ELMS account to send a notice. A notice or counter-notice can be passed on to the other side. See who receives your data. The copyright and content complaints page describes the process.

Security and device data

To protect accounts we record your IP address, an approximate place worked out from it, your browser, operating system and device type, a random device identifier kept in your browser, the time and method of each sign-in, failed password attempts and open sessions. We also note when you were last active while ELMS is open, so that you can see which devices are signed in and our team can see whether an account is online.

If we suspend an account or block a network address or browser, we keep a record of the decision, the reason we gave and any appeal.

Usage records

We record what happens when you use ELMS: your imports, your publish runs and their results, and your credit balance. For each AI action we record its type, whether it worked, the credits charged and the size of the request, but not the text. We use them to run the service, answer questions about your credits and find faults.

Technical logs and visitors

Our systems keep technical logs of requests and errors, which can include your IP address and browser details. If you only visit our public pages, this is the data we receive. When a buyer opens a parcel-tracking page, we also receive the tracking code in the page address.

Browser extension

The order helper extension shows the delivery details of one of your orders on an Amazon page, so that you can copy them yourself. It does not read the content of the Amazon page (it only looks at the web address of the page, to know the tab was opened from your order). It has a window of its own in which you can mark the order as ordered: the delivery date and the buying price that you type there are saved on the ELMS order when you press the button, just as when you mark the order in ELMS. Older versions of the extension that tried to save an order total from the page are refused by ELMS. It does not click or type for you on Amazon.

The extension keeps its settings, including your extension key, in the browser’s extension storage. Uninstalling the extension removes that storage.

What the eBay permissions let ELMS do

When you connect an eBay store, eBay shows its own consent screen with the exact permissions. We ask only for what the features need. In plain language, you allow ELMS to:

• read public eBay information, such as categories and item details, to help you list;
• create, read, change and end your listings and offers, and create an item location from the postal code you choose;
• access your business policies, item locations and selling settings, which ELMS reads so that you can choose them when you list;
• read your orders and add shipping and tracking details to them;
• read the payout, fee and earning records of your orders, for the profit view;
• read basic information about your eBay account, such as your user name;
• read your buyer messages and send replies;
• receive notices from eBay about activity on your store.

ELMS uses these permissions only for the features described in this policy. You can withdraw them at any time through your eBay account. If you disconnect a store in ELMS, ELMS stops using it. See how long we keep data for when its saved data is deleted.

Why we use your data

These bases come from the data protection laws of the EEA and the UK. If you live elsewhere, we use your data for the same purposes. Service e-mails are part of running your account, so unsubscribing from product news does not stop them.

Our team can open an account to give support, to check for abuse, or to carry out a service you asked for. Only members of our team with an admin role can do this, and only for those purposes.

Buyer data in your store

Who decides

You are the controller of the buyer data in your store, and ELMS is your processor. You decide which buyers you sell to and what you do with their data. We handle it on your instructions, which you give by using ELMS and changing its settings. A data processing addendum is available on request. Write to support@elmstool.com.

How ELMS uses buyer data

• To show your orders and messages in the app.
• To send the updates you ask for to eBay, such as shipping details, tracking numbers and order notes.
• To send messages to your buyers through eBay, when you write them or switch on automatic buyer messages or AI replies.
• To work out profit, keep the service secure and meet legal duties.

We do not use buyer data for advertising or profiling, and we do not sell it. We do not contact your buyers for ELMS’s own purposes.

Where buyer data goes

Besides the providers listed under who receives your data, buyer data goes to:

• eBay. Messages, tracking details and notes that you send travel to eBay under your connected account.
• AI services. Only for reply drafts, as described in the section on AI services.
• A parcel-tracking service. When you save a tracking number on an order, ELMS registers it with a tracking service so that the parcel can be followed. The page your buyer can open shows only a general status.
• Supplier platforms. ELMS does not place Amazon orders. A supplier platform you connect receives only what an import or an action you start needs.

Your duties

You need a lawful basis to use your buyers’ data, and you need to tell your buyers how you use it. Share only what an order needs, and take care with delivery details that you copy to other websites. Our Terms of Service set out your responsibilities as a seller.

Removing buyer data

When a store’s data is deleted, its buyer data goes with it. If eBay tells us that a person has deleted their eBay account, we erase that person’s name, address, phone number, e-mail address and checkout note from orders in every store, and we delete their messages. The order itself stays in the seller’s records.

If you are a buyer

The seller you bought from decides how your data is used, so write to the seller first. You can also write to us at support@elmstool.com with the subject “Privacy request”, and we will help the seller to answer you.

AI services

ELMS uses AI services to help write and improve titles, descriptions, item details and message drafts. You decide what is published or sent: you review drafts before they go live, bulk actions ask you to confirm first, and automatic replies stay off until you turn them on.

In the listing editor, AI text goes into your draft and you read it before you publish. Some steps apply AI output without a separate review:

• an AI tool that you start on live listings saves its result to eBay when you confirm it, so check your selection before you confirm;
• when you publish a draft that has no eBay category, ELMS can pick one for it with the help of AI;
• automatic replies send a drafted reply on their own. They stay off until you turn them on.

What is sent to an AI service

Listing text

When you use an AI helper on listing text, ELMS sends the product text it needs: title, description, bullet points and item details.

Message drafts

If you turn on reply drafts, or press Draft with AI in a conversation, ELMS sends the recent messages of that conversation, the item title and your store name. An AI service writes a draft reply from them. Reply drafting is off until you turn it on.

Automatic replies

If you choose automatic sending, ELMS replies on its own and tries to hold back messages that look sensitive, such as messages about refunds, returns, damage, disputes or legal matters. You stay responsible for what is sent.

Support

When you write to support, an automated assistant can answer first. It receives your message, earlier messages in the ticket, your name and your credit balance. Messages that look like they are about payments, refunds, account access, security, privacy or legal matters are passed to a person, and appeals are read only by people.

ELMS does not add passwords, access tokens or payment details to what it sends to an AI service. Text that you or a buyer type into a message or ticket is sent as written, so do not put secrets in it. We do not use AI to decide whether to suspend or ban an account. AI can make mistakes, so check what it writes. You remain responsible for your listings and messages.

Who receives your data

We share data to run ELMS, to keep it safe and to meet legal duties. We name categories of recipients here. A list of the recipients is available on request. Write to support@elmstool.com.

Marketplaces you connect

eBay receives the listings you publish, the messages you send, tracking details and order notes. ELMS receives your orders, buyer details, messages, fees and policies from eBay.

Payment partners

They run the checkout and receive your e-mail address, the plan you chose and the amount. They handle your card or wallet details. We receive the result of the payment and the type of payment method used. If a payment is disputed or reversed, we may also give them the records they need to answer, such as your purchases and your use of credits.

E-mail delivery providers

They carry our e-mails, so they receive your address and the content of each e-mail.

Product-information services

They receive the product links and identifiers that you import or watch, and return public product details. They do not receive your account details.

AI services

They receive the text described in the section on AI services.

Shipment-tracking services

They receive the tracking numbers of the parcels you ship, so that they can report the status.

Location lookup from your IP address

This service receives your IP address at sign-in and returns an approximate city and country, which we show in your login activity and new-device alerts.

Postal-code lookups

A postal-code lookup receives the postal code or city you enter for an item location.

Hosting, storage and network-security providers

They store and process the data we hold, and protect our systems, under contract with us.

Sign-in providers you choose

They share the details described above and learn that you signed in to ELMS.

Supplier platforms you connect

We exchange only the data that an import or an action you start needs.

Other ELMS users

Content you add to ELMS (never your account details, orders, messages or buyer data) may be made available to them as part of the service.

People who referred you, and affiliates

They see the limited details described under referral and affiliate data.

Our team and advisers

Members of our team with an admin role can open accounts for the purposes above. Advisers, such as lawyers and accountants, may see data when they help us. Our team receives alerts about support tickets, which can contain the start of your message.

The person a notice concerns

Where a notice has to be passed on, a copy of it, with the sender’s contact details, can go to the person it concerns, so that they can answer it. A counter-notice, with its contact details, can go to the person who sent the notice. The copyright and content complaints page explains when this happens.

Authorities and other parties

We disclose data when the law requires it, or to protect the rights, safety and security of our users and of ELMS. If we sell or reorganise the business, data may pass to the new owner, and we would tell you.

International transfers

ELMS, the marketplaces you connect and our providers may process data in countries other than yours, including countries that do not have the same data protection law as the EEA or the UK.

Where the law requires a safeguard for such a transfer, we rely on one, such as an adequacy decision or standard contractual clauses. To ask about the safeguards that apply, write to support@elmstool.com.

How long we keep data

Deleting your account

To delete your account, write to us as described under rights below. We confirm by e-mail and give you a short notice period before we delete the account. If you sign in during that time, the deletion is cancelled. A suspended or banned account cannot be deleted while the decision stands.

When the deletion goes ahead, we delete your stores and their saved eBay access, drafts, listings, imports, orders, tracking pages, messages, notes, notifications, support tickets, vouchers, sign-in history, import and publish history, and every file you uploaded or imported. Tracking links you sent to buyers stop working.

We keep:

• purchase and invoice records, with the name and e-mail address on them;
• referral and affiliate records that payouts depend on;
• counts of AI actions, without any content, for as long as we need them for our business records;
• a record of an earlier suspension or ban, including a block on a network address or browser, for as long as the retention table above says;
• a log entry that records the deletion. It holds no name or address, but it holds the former account ID, a private note about the deletion request and a one-way code derived from the account, kept to prevent abuse of promotional credits. We keep it as long as needed for that and to answer questions about the deletion.

Listings that are live on eBay stay there. ELMS does not change eBay when it deletes an account.

Your rights and how to use them

What you can do yourself

• Change your phone number, store names, pricing rule, description template and brand-word list.
• See your signed-in devices and recent sign-in activity, log devices out, and switch new-device e-mails on or off, all in Settings.
• Switch off AI replies and automatic buyer messages.
• Unsubscribe from product news with the link in those e-mails.
• Disconnect a store, and delete drafts and listings.

For everything else, including a copy of your data, write to us.

If you are in the EEA or the UK

You have the right to access your data and get a copy, to have wrong data corrected, to have your data erased in the cases the law lists, to have its use restricted, and to receive the data you gave us in a common format where this right applies. You can object to processing that is based on legitimate interests, and to product news at any time. You can withdraw consent where we rely on it. You can complain to your data protection authority.

Account suspensions and bans are decided by people. A few checks run automatically and can stop an action: the sign-up address check, the checks for repeated sign-ups and the prohibited-items stop before publishing. If you think one of them is wrong, write to us and a person will look at it.

If you are in California or another US state

You may have the right to know what personal information we collect, use and disclose, to access, correct and delete it, to opt out of its sale or sharing, and not to be treated worse for using these rights.

We do not sell personal information and do not share it for cross-context behavioural advertising. In the last twelve months we collected identifiers such as name, e-mail address and IP address, commercial information such as purchases, internet and device activity, approximate location, and the content you provide. We disclose them for business purposes to the recipient categories listed above.

An authorised agent can write for you with your written permission. We may ask you to confirm your identity. If we decline a request, tell us why you disagree and we will review the decision.

If you are in Canada

You can ask to see and correct the personal information we hold about you, and withdraw your consent, subject to legal and contractual limits. You can complain to the privacy commissioner of Canada or of your province.

If you live somewhere else

Your law may give you similar rights. Write to us and we will deal with your request under the law that applies to you.

How to make a request

1. Write to support@elmstool.com from the e-mail address of your account. Or sign in and open Support in the app.
2. Use the subject “Privacy request” and say what you want: for example access, correction, deletion or an objection.
3. We may ask you to confirm who you are. We do this only to protect your account.
4. We reply by e-mail within the time your law sets. There is no charge, unless requests are clearly unfounded or excessive.

Some data we must or may keep even after a request, such as purchase records and ban records. We tell you what we cannot delete and why. You can complain to a data protection authority at any time, but we would like the chance to put things right first.

Cookies and browser storage

ELMS keeps a few items in your browser’s local storage and session storage. Most are needed to run ELMS. We do not show a cookie banner. Where we need your consent, we ask for it first.

Providers that you choose to use can set their own cookies. This applies to sign-in and payment pages and to the code those providers supply. Their cookies follow their own policies, and we do not control them. When you use sign-in or checkout inside the app, the app can load code from these providers, and they receive your IP address and browser details.

ELMS loads nothing from social platforms. The Follow ELMS links open the platform’s own site in a new tab, and the platform learns about you only if you click one. You can delete stored items in your browser settings.

ELMS does not track you across other websites, so a Do Not Track signal from your browser changes nothing.

Security

We protect personal data with measures that match the risk. Passwords are stored as one-way hashes, eBay and supplier access tokens are stored encrypted, and data is encrypted in transit. No system is completely secure.

• You can see the devices that are signed in, log them out, and ask for an e-mail when a new device signs in.
• Only members of our team with an admin role can open accounts, and only for the purposes described above.

You can help too. Use a strong password that you use nowhere else, do not send it to anyone, and log out on shared computers. If you think someone else knows your password, use Forgot password on the sign-in page to set a new one (this signs every device out), regenerate your extension key if you use an extension, and write to support@elmstool.com.

If something goes wrong

If a security incident affects personal data, we tell the people affected, and the authorities where the law requires it, without undue delay. If it affects buyer data in your store, we tell you promptly so that you can meet your own duties. To report a security problem, write to support@elmstool.com.

We do not sell personal data

We do not sell personal data. We do not share it for cross-context behavioural advertising. We do not use buyer data for advertising or profiling. ELMS adds no advertising or analytics trackers of its own to its pages or the app. Sign-in and payment providers can set their own cookies, as described under cookies and browser storage.

Children

ELMS is for businesses and adults. You must be at least 18 to use it. We do not knowingly collect data from anyone under 18. If you think a child has given us data, write to us and we will delete it.

Changes to this policy

We update this policy when our practices or the law change. The date and version at the top show the latest update. For material changes we tell you by e-mail or in the app before they apply, except where the law or a marketplace requires a change to apply at once. If you do not agree with a change, you can stop using ELMS and ask us to delete your account.

Contact

Use the mailbox that fits your question, or sign in and open Support in the app. The contact page says what to include. Mail from noreply@elmstool.com is automatic. Please do not reply to it; write to one of the addresses below.

Privacy requests and questions

support@elmstool.com, with the subject “Privacy request”.

Legal notices

support@elmstool.com, with the subject “Legal notice”. See copyright and content complaints.

Billing, invoices, refunds and security reports

support@elmstool.com. See the Refund Policy.

General questions

hello@elmstool.com