Privacy Policy

This policy applies to eagleenforce.com, the EagleEnforce™ application (currently served at dev.eagleenforce.com) and any successor domain, and the EagleEnforce crawler.

1. Who we are

EagleEnforce™ is operated by LaFountain Design, doing business as EcommEagle^®, of 170 Highland Rd, Ste 1, Massena, NY 13662, United States. We are the "business" or controller for personal information about website visitors and about the people who hold accounts with us, and a "service provider" or processor for the data our customers upload or connect, which we handle on their instructions. Contact: support@ecommeagle.com.

2. What we collect

Visitors to this website

• Server logs. Our web server records requests with a truncated IP address, the page requested, the time and the browser type, for security and to keep the site running. Logs are deleted after 30 days.
• Your consent choice. One first-party cookie named ee_consent stores whether you allowed analytics. Storing a refusal is strictly necessary and does not require consent.
• Analytics, only if you allow it. With your permission we load Google Analytics 4 with IP anonymisation, Google signals off and advertising features off. Without permission the script is never requested.
• Email you send us. If you write to us we keep the correspondence to reply and for our records.

Account holders

• Account and organization data: name, email address, password (stored hashed), organization name, role, seat assignment and notification preferences.
• Authentication and security events: sign-in records, email verification, second-factor codes sent to your address, session and device information used to keep you signed in, and password-reset requests.
• Google Merchant Center, only if you connect it: if your brand sells on Google Shopping and you connect your Merchant Center account, we receive, under your authorization and for your workspace only, two of Google's reports about your own products: the price competitiveness report (your price and Google's benchmark price for each product) and the competitive visibility report (the domains that appear against your listings). We read these reports; we never write to your account, and we never read anyone else's. We use them only to alert you when a benchmark falls below your MAP and to suggest websites to review. The authorization and everything read under it are deleted when you disconnect, and benchmarks are kept at most 12 months. EagleEnforce's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Sign in with Google: if you choose Google to sign in or register, we receive your name, email address and Google account identifier, and nothing else. You can disconnect Google from your Account page once a password is set.
• Support tickets and any files you attach to them.
• Plan and usage: which plan your organization is on and counts of products, listings and users.
• Billing: billing address, the card brand and last four digits, subscription status and history, invoices, prepaid add-on purchases and their receipts, payment records and tax applied. Card numbers are entered in a form served by Square, our payment processor, and go directly to Square; we never receive or store them.
• Application and security logs: operational logs and an audit log of administrative and security-relevant actions, used to run the Service safely and investigate problems.

Customer content, processed on our customers' behalf

• Catalog data: products, SKUs, identifiers, MAP and MSRP prices, images and categories, imported from a CSV or read from the customer's own store.
• MAP policy data: policies, per-product MAP prices, effective dates, promotional windows and the enforcement rules the customer configures.
• Dealer and storefront records: business names, store domains, marketplace seller identifiers, business addresses, phone numbers, contact email addresses and notes the customer enters about the dealers it sells through.
• Listing and monitoring data: the listings being watched, publicly advertised prices observed, listing URLs and titles, read status and the reason a read failed.
• Evidence: on confirmation of a violation, a screenshot of the public page, the page content as served, the timestamp, the observed price and the verification history.
• Sellers, cases and enforcement history: seller records, cases opened against them, the ladder step reached, cure windows, and the history of what happened and when.
• Notices: the content of notices the customer approves and we send on their behalf, the recipients, and delivery records.
• Marketplace data: offer and seller data returned by a marketplace's official interface: from eBay's Browse API and Walmart's Affiliate API using our own developer keys, and from Amazon's Selling Partner API under the authorisation a customer grants from its own Amazon seller account. This includes seller identifiers, prices, shipping and fulfilment details. Amazon data obtained under one customer's authorisation is used only for that customer and is never combined with another customer's data, sold or used to train models.

3. How we use it

• To provide the Service: monitor listings, verify suspected violations, keep evidence, and run the enforcement workflow our customers configure.
• To operate accounts: sign-in, security, second-factor verification, notifications the account holder chooses, and support.
• To bill: process subscriptions, produce invoices, apply tax and handle billing questions.
• To keep the Service safe: rate limiting, abuse prevention, and audit logs of administrative actions.
• To understand how the website is used, only with your consent.
• To meet legal obligations and enforce our terms.

We do not use customer content to train models, to build profiles of dealers across customers, or for advertising.

Legal bases

For visitors and account holders in the European Economic Area, the United Kingdom and Switzerland, this is the legal basis we rely on for each purpose. Where we act as a processor for a customer, the customer decides its own basis, which for a MAP programme is normally its legitimate interest in enforcing its own policy.

Where we rely on legitimate interests we have balanced them against your rights and concluded that the processing is what you would reasonably expect and has minimal impact. You can object to processing based on legitimate interests; see section 10.

4. Cookies and consent

This website sets one strictly necessary cookie (ee_consent) and, with your permission, Google Analytics cookies. The application additionally sets session and security cookies needed to keep you signed in and to protect against cross-site request forgery. There are no advertising or cross-site tracking cookies.

The cookies themselves

Google Maps Platform, loaded in the application only with Preferences consent, may set cookies on Google's own domains under Google's privacy policy; it sets none on ours.

Withdrawing consent takes effect immediately. If you decline analytics after having allowed it, the analytics script is switched off for the rest of your visit, it is not loaded again, and the Google Analytics cookies are deleted. Withdrawal does not affect the lawfulness of processing that happened before it.

On the public website, analytics is not loaded until you allow it. In the application, analytics and map services follow the applicable consent setting. Services needed to deliver the Service you have asked for, such as authentication, hosting, email delivery and payment processing, operate on the basis of providing the Service rather than consent.

You can change your choice at any time with the Privacy choices link in the footer of every page. If your browser sends a Global Privacy Control signal we treat it as a valid opt-out of any sale or sharing of personal information, apply it immediately, and do not ask you to reconsider it. After you decline analytics we will not ask again for at least twelve months.

5. Service providers

We share data only with providers who process it for us under contract, and only what each one needs:

We may also disclose information when the law requires it, to protect our rights or the safety of others, or as part of a merger or acquisition, in which case this policy continues to apply to the transferred data.

6. We do not sell or share personal information

We have not sold or shared personal information as those terms are defined in the California Consumer Privacy Act, and we do not intend to. We do not use sensitive personal information for anything other than providing the Service.

7. If you are a dealer or seller

Our customers are brands. If a brand uses EagleEnforce to monitor prices, it may enter your business's name, store domain, marketplace seller identifier, business address and business contact details, and EagleEnforce reads the prices you advertise publicly. We process that on the brand's instructions as its service provider.

Requests about that data are best directed to the brand, which decides what it collects and why; if you contact us instead we will forward your request and help the brand respond. Our crawler identifies itself and honours robots.txt. See the crawler page and the page for dealers for what it reads and how to limit or block it.

8. Retention

Evidence and monitoring data are kept for a rolling window of at most 12 months. Each plan sets the window: currently 180 days on the Trial and Launch plans and 12 months on every other plan. Every night, evidence (screenshots, saved page content and marketplace interface responses), price observations, violations whose last activity is older than the window, and cases closed before the window are deleted automatically and cannot be recovered. A case that is still open is kept until it is closed and then ages out the same way. If you need material kept longer, download it before it ages out.

We may keep information for longer where the law requires it or where it is needed to resolve a dispute or enforce our agreements. We do not keep customer content indefinitely.

9. Security

Data is encrypted in transit, and stored encrypted at rest by our hosting provider, including nightly backups held in encrypted object storage. Credentials for connected stores are additionally encrypted by us with keys held outside the database. Access to production systems is restricted and administrative actions are logged. Sign-in supports a second factor by email, and staff access to administrative tools requires a second factor. No method is perfect; if we learn of a breach affecting you we will notify you as the law requires. More detail is on the security page.

10. Your rights

If you are a California resident you have the right to know what personal information we collect and how we use it, to access it, to correct it, to delete it, to opt out of sale or sharing (which we do not do), to limit use of sensitive personal information, and not to be discriminated against for exercising these rights. Residents of other US states with privacy laws, and visitors from the European Economic Area, the United Kingdom and Switzerland, have similar rights including access, correction, deletion, portability, restriction and objection, and the right to complain to a supervisory authority.

Where processing is based on consent, you may withdraw it at any time, on this website through the Privacy choices link and in the application through the same control, without affecting the lawfulness of processing before withdrawal. Where processing is based on legitimate interests, you may object, and we will stop unless we can show compelling grounds that override your interests.

Automated scoring

The application calculates an attention score for each seller a brand monitors, from that seller's own monitoring history: listings currently below MAP, confirmed violations in the last 180 days, the authorization status the brand assigned, and the number of storefronts and listings. Every component of the score is shown next to it. The score sorts and prioritises a brand's own review queue; it does not on its own open a case, send a notice or produce any legal or similarly significant effect, because the first notice in every case requires approval by a person at the brand. If you are a seller and you believe a score about you is based on inaccurate data, contact the brand or us and we will help have it reviewed.

To exercise a right, email support@ecommeagle.com with "Privacy request" in the subject. We will verify the request using the email address on your account or, for non-account holders, by confirming details only you would know. An authorised agent may act for you with written permission. We respond within 45 days and do not charge for reasonable requests.

11. International visitors

Our servers are in the United States. If you use the Service from outside the United States your information is transferred to and processed there. For data from the European Economic Area, the United Kingdom and Switzerland we rely on the EU-US Data Privacy Framework and its UK and Swiss extensions where a provider is certified under it, and otherwise on standard contractual clauses with that provider. You can ask us which applies to a given provider.

12. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children.

13. Changes

When we change this policy we update the date at the top and, for material changes, notify account holders by email or in the application before the change takes effect.

14. Contact