✦ Join the Next Month Waitlist. · Book a FREE Discovery Call. · Claim your spot →

Last updated: 13 August 2026 · Replaces the version dated 20 May 2026

This Privacy Policy explains how Ecom Luxx LLC ("Ecom Luxx", "we", "us", "our") collects, uses, shares and protects personal information when you visit ecomluxx.com, use StoreSignal or any of our free tools, book a call with us, or work with us as a client. It also explains the choices and rights you have over your information.

1. Who we are

Ecom Luxx LLC is a limited liability company registered in Wyoming, USA, with its registered address at 30 N Gould St, Sheridan, WY 82801, USA. For the purposes of the EU General Data Protection Regulation (GDPR) and UK GDPR, Ecom Luxx LLC is the data controller of personal information collected through ecomluxx.com and StoreSignal.

You can contact us about anything in this policy at hello@ecomluxx.com.

2. Information we collect

Information you give us directly

  • Contact and booking details when you book a strategy call (via Calendly), join a waitlist, or contact us — such as your name, email address, company name, website URL and anything you include in booking questions or messages.
  • Information you provide when you use StoreSignal or our other free tools, such as your store URL and email address.
  • Information you provide during client onboarding and throughout an engagement.

Information collected automatically

  • Device and usage data: IP address, browser type, device type, operating system, pages viewed, referring pages, and interactions with the site.
  • Analytics and session data collected by Google Analytics 4, Google Tag Manager and Microsoft Clarity, including heatmaps and session replays of how you interact with our pages.
  • Visitor identification data. For visitors located in the United States, our identity-resolution partner RB2B may match your visit against its identity graph and provide us with person-level business contact information — such as your name, business email address, job title, company and LinkedIn profile URL. For visitors outside the United States, RB2B provides company-level information only (such as the company associated with your network), not person-level identification. See section 4 for details and opt-outs.

Information from other sources

  • Business contact information from publicly available sources (such as company websites and LinkedIn) and from data partners, used for B2B outreach.
  • Information from service providers such as Calendly (scheduling) and Stripe (billing for clients).

3. How we use your information

  • To provide our services — CRO audits, conversion-focused design and development, and GrowthOps™ engagements
  • To schedule and run calls you book with us.
  • To generate AI-assisted audits through StoreSignal (processed with our provider Anthropic PBC).
  • To respond to enquiries and provide support.
  • To identify and contact business visitors and prospects we believe are a good fit for our services, including by email. Every marketing email we send includes a way to opt out, and you can opt out at any time by replying to any email from us.
  • To operate, analyse and improve our website and marketing, including understanding which pages convert and where visitors struggle.
  • To bill clients, keep business records, and comply with legal obligations.

4. Website visitor identification and B2B marketing

We use RB2B, an identity-resolution service, to help us understand which businesses and (for US visitors) which individual business professionals visit our website, so that we can follow up with relevant, non-intrusive B2B outreach. The following disclosure is provided in the form required by our vendor:

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

You also have the option to opt out of the collection of your personal data in compliance with GDPR by visiting https://www.rb2b.com/rb2b-gdpr-opt-out.

Person-level identification is restricted to visitors located in the United States. If you are visiting from the EU, UK or elsewhere outside the US, this technology operates at company level only and does not identify you personally. We do not ask for your consent before this technology runs. We rely on legitimate interests, explained in section 6, and you have an unqualified right to stop it — use either opt-out link above, enable Global Privacy Control in your browser, or email us. See section 11.

5. Analytics, session replay and heatmaps

We use Google Analytics 4 and Google Tag Manager to measure how our website is used, and Microsoft Clarity to understand how visitors interact with individual pages.

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

We do not ask for your consent before these tools run. You can opt out of Google Analytics across all websites using the Google Analytics opt-out browser add-on. To stop Microsoft Clarity, block cookies for this site in your browser settings, or enable Global Privacy Control — where your browser sends a GPC signal we suppress analytics and session replay for that browser automatically.

6. Legal bases for processing (EU and UK visitors)

Where GDPR or UK GDPR applies, we rely on the following legal bases:

  • Performance of a contract — to deliver services to clients and take steps you request before entering an engagement.
  • Legitimate interests — to operate and secure our website, keep business records, and conduct proportionate B2B outreach to business contacts, balanced against your rights and expectations.
  • Consent — where we ask for it directly, such as when you submit a form or subscribe to something we send. We do not operate a cookie consent banner on this website, so the technologies described in sections 4 and 5 do not run on consent.
  • Legal obligation — where we must retain or disclose information to comply with the law.

The analytics and visitor-identification technologies in sections 4 and 5 run on the basis of legitimate interests. Because that processing supports direct marketing, your right to object to it is unqualified: if you object, we stop, and we do not ask you to justify the request. Section 11 sets out how, and enabling Global Privacy Control counts as an objection without you having to write to us at all.

7. Sharing your information

We do not sell your personal information for money. Some US state laws define "sale" or "sharing" broadly to include disclosures of identifiers to advertising and identity-resolution partners; where that definition applies, our use of RB2B and similar technologies may qualify, and you can opt out as described in sections 4 and 11. We share personal information with:

  • Service providers acting on our instructions: Google LLC (analytics, tag management), Microsoft Corporation (Clarity), RB2B, Inc. / Retention.com (visitor identification), Calendly LLC (scheduling), Stripe, Inc. (payments), and Anthropic PBC (AI processing for StoreSignal).
  • Professional advisors such as lawyers and accountants where reasonably necessary.
  • Authorities where required by law, court order or to protect our legal rights.
  • A successor business in the event of a merger, acquisition or sale of assets, subject to this policy.

8. International data transfers

We are based in the United States, so information collected from visitors in the EU, UK, Switzerland and elsewhere is transferred to and processed in the US and other countries. Where required, we rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful transfer mechanisms, and we work with providers that offer equivalent safeguards (including, where applicable, certification under the EU–US Data Privacy Framework).

9. Cookies and similar technologies

We use cookies, local storage and similar technologies in three categories:

  • Strictly necessary — required for the site to function and stay secure; always active.
  • Statistics — Google Analytics 4 and Microsoft Clarity, which measure how the site is used.
  • Marketing — tags managed via Google Tag Manager, including RB2B visitor identification and Calendly embed cookies.

We do not display a cookie consent banner. The technologies above run when you visit the site. We tell you about them here and in our Cookie Policy rather than asking you to clear a pop-up, and we make the opt-outs work rather than making the notice louder.

Two things follow from that, and both are commitments rather than descriptions. If your browser sends a Global Privacy Control signal we suppress every Statistics and Marketing technology for that browser, automatically and regardless of where you are. And if you ask us to stop by any other route, we act on it without asking why. Every route is on our Your Privacy Choices page. Full details of each cookie, how long it lasts and who sets it are in our Cookie Policy.

10. How long we keep your information

  • Client records — for the duration of the engagement plus seven years, for tax, accounting and legal purposes.
  • Prospect and outreach data — up to 24 months from your last interaction with us.
  • Analytics data — Google Analytics user-level data is retained for up to 26 months; Microsoft Clarity session recordings are retained per Microsoft's standard retention (currently up to 30 days for recordings, longer for aggregated data).
  • Visitor identification data (RB2B) — profiles of identified visitors are retained in our CRM and outreach tools for up to 24 months from your last interaction, unless you opt out sooner.
  • Booking records (Calendly) — retained in line with the booking and our client-record schedule.

11. Your rights and choices

If you are in the EU, UK or Switzerland

You have the right to access, correct, delete, restrict or object to our processing of your personal information, and the right to data portability. Where we rely on consent you may withdraw it at any time, without affecting processing carried out beforehand. Because our analytics and visitor-identification technologies support direct marketing, your right to object to those is unqualified — we stop on request, with no balancing test and no questions asked. You also have the right to lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office (ICO).

If you are in the United States

Depending on your state of residence (including California, Colorado, Connecticut, Texas, Virginia and a growing number of other states with comprehensive privacy laws), you may have the right to know what personal information we hold about you, correct it, delete it, obtain a copy, and opt out of targeted advertising, profiling, and the "sale" or "sharing" of personal information as defined by your state's law. We do not discriminate against you for exercising any of these rights.

How to exercise your rights

  • Email us at hello@ecomluxx.com with your request. We may need to verify your identity before acting on it, and we will respond within the timeframe required by applicable law.
  • Opt out of RB2B-powered advertising at app.retention.com/optout, and of RB2B data collection under GDPR at rb2b.com/rb2b-gdpr-opt-out.
  • Opt out of marketing emails by clicking unsubscribe in any email or simply replying to tell us.
  • Stop all non-essential cookies by enabling Global Privacy Control in your browser, which we honour automatically, or by blocking cookies for ecomluxx.com in your browser settings.

Global Privacy Control

We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale or sharing of your personal information, of targeted advertising, and of the analytics and visitor-identification technologies described in sections 4 and 5. We act on it for every visitor, not only where a law obliges us to, and you do not need to contact us. Because the signal is stored per browser, enable it on each browser and device you use.

12. Children's privacy

Our website and services are directed at businesses and adults. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, please contact us at hello@ecomluxx.com and we will delete it.

13. Security

We use reasonable technical and organisational measures to protect personal information, including access controls, encryption in transit and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

14. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and update the "Last updated" date. Where a change is material and the law requires it, we will take additional steps to notify you.

15. Contact

Ecom Luxx LLC,
30 N Gould St, Sheridan, WY 82801, USA
Email: hello@ecomluxx.com