Privacy Policy

Information you give us

• Account details: your name, business name, email address, phone number and password (stored only as a one-way scrypt hash — we cannot read it).
• Product photographs you upload for a shoot, and any instructions or notes you add to them.
• Branding you choose to overlay: your brand name and size/price chart.
• Payment references: the amount, the UPI or transaction reference you send us, and any screenshot you provide so we can verify a manual payment.
• Anything you write to us in support messages.

Information collected automatically

• Login records: date, time, IP address and browser/device description, kept so you and we can spot unauthorised access.
• Usage records: which shoots you ran, when, and how many credits they cost.
• A single essential cookie that keeps you signed in.

What we never collect. We do not receive, see or store your card number, CVV, UPI PIN, net-banking password or wallet credentials. Those are entered directly with the payment provider and never reach our servers.

• To create your account and sign you in.
• To generate the images you ask for — this requires sending your uploaded photograph to our AI provider (see section 4).
• To take payment, add credits, issue refunds and keep the tax records Indian law requires of us.
• To answer your support messages and resolve complaints.
• To keep the service secure: rate limiting, fraud checks and abuse investigation.
• To meet a legal obligation, or to respond to a lawful order from a court or authority.

We do not sell your personal data, and we do not share it with anyone for their own marketing.

This is the part sellers care about most, so we will be exact:

• Your uploaded photographs are used to generate your images, and for nothing else.
• They are not used to train any AI model, ours or a provider's.
• They are not shown to other users, and are not published anywhere.
• Generated images are visible only inside your own account, and through a share link only if you create one yourself.
• Older shoots are deleted automatically once your account exceeds its retention limit, and everything is deleted when your account is closed.

Only these, and only for the purpose named:

• AI image providers (OpenAI, Google) — receive the photograph and prompt needed to generate your images. They process it to return the result and are contractually barred from using it to train their models.
• Payment aggregators — receive the amount and the details needed to process and reconcile your payment.
• Cloud storage and hosting — hold your images and account data on our behalf under confidentiality obligations.
• Your reseller, if one introduced you — sees your name, business name, contact details and plan status so they can collect payment and activate your plan. They never see your photographs or generated images.
• Authorities — where we are legally required to disclose.

• Account details: for as long as your account is open, and up to 90 days after closure so a deletion can be reversed if it was a mistake.
• Photographs and generated images: until superseded by our retention limit, or until your account is closed — whichever comes first.
• Payment and tax records: eight years, as required by Indian tax law. These are kept even after your account is closed and are the one category deletion does not cover.
• Login and security logs: up to 12 months.

• All traffic to and from this site is encrypted with HTTPS.
• Passwords are stored only as salted scrypt hashes and are never recoverable, by us or by anyone reading the database.
• API keys and other secrets are encrypted at rest.
• Sessions are server-side and can be revoked instantly.
• Access to production data is limited to the proprietor.

No system is perfectly secure. If a breach affects your personal data we will notify you and the Data Protection Board of India as the DPDP Act requires.

Under the DPDP Act, 2023 you may ask us to:

• Tell you what personal data of yours we hold and who we have shared it with.
• Correct anything inaccurate or incomplete.
• Delete your data and close your account, except records we must keep by law.
• Withdraw consent — noting that we cannot provide the service without the data needed to run it.
• Nominate someone to exercise these rights if you die or become incapacitated.

Write to support@ecomshoot.in from your registered email address. We respond within 48 hours and complete verified requests within 30 days, free of charge.

We use one essential cookie, which holds an opaque session token so you stay signed in. It is not used for advertising or cross-site tracking. Blocking it will stop you being able to log in. We do not run third-party advertising trackers on this site.

EcomShoot is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.

We may update this policy. The revision date at the top shows when it last changed, and material changes are notified by email or in your account.

Data protection questions and grievances go to Sk Saddam Hossain, Proprietor, at support@ecomshoot.in or +91 80135 08258, or by post to Bankra 82-86, Howrah Bankra, Bankra Munshidanga Mullick Para, Howrah, West Bengal 711403, India. Escalation details are on our Contact page.