Privacy Overview
Ecom Strategies LLC, operating as ESICU ("ESICU", "we", "us"), is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at esicu.com or engage our services.
We comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), PIPEDA (Canada), and the Information Technology Act (India). If you disagree with these terms, please do not use our services.
Data We Collect
Information You Provide
Name, email, phone number, company name, and any information submitted through contact forms, job applications, or service inquiries.
Automatically Collected Data
Standard server request data — IP address, browser type, and requested URL — logged by our hosting provider for delivery, security, and abuse prevention. We do not currently run any third-party analytics or advertising trackers on this site.
Cookies & Tracking
Strictly necessary cookies only — session authentication and your cookie preference. No analytics, advertising, or cross-site tracking cookies are set. If we introduce analytics in future, it will be opt-in and disclosed here first.
Candidate Data (ATS)
Resumes, cover letters, employment history, references, and assessment results for job applicants.
How We Use Your Data
- Respond to inquiries and provide requested services
- Process job applications and conduct recruitment
- Send service-related communications (never unsolicited marketing)
- Improve our website and service offerings
- Comply with legal obligations and regulatory requirements
- Detect and prevent fraud and security threats
We never sell your personal data to third parties. We never use your data for targeted advertising.
Your GDPR Rights (EU/EEA Residents)
Right to Access
Request a copy of all personal data we hold about you.
Right to Rectification
Request correction of inaccurate personal data.
Right to Erasure
"Right to be forgotten" — request deletion of your data. One narrow exception: if your address has bounced or reported one of our emails as spam, we keep that address on a do-not-contact list. Deleting it would let a later reminder reach you again, which is the outcome the request is meant to prevent.
Right to Portability
Receive your data in a machine-readable format.
Right to Object
Object to processing based on legitimate interests.
Right to Restrict
Request we limit how we process your data.
Exercise any right using the form below, or email dpo@esicu.com. We respond within 30 days.
California Privacy Rights (CCPA)
California residents have the right to know what personal information is collected, request deletion, opt out of sale (we do not sell data), and non-discrimination for exercising these rights.
Submit a CCPA request: privacy@esicu.com.
Sub-processors & AI Processing
We use a small number of vetted third parties to run our services. We do not sell personal data, and we do not permit any sub-processor to use your data to train their models.
Anthropic (Claude AI) — United States
Purpose: generating replies in our website chat assistant, and drafting payment-reminder wording in RevenuePulse.
Data sent: for chat — the messages you type. For RevenuePulse reminders — the client's name, invoice number, amount, due date, and a general indication of payment timeliness. We do not send client email addresses, phone numbers, or postal addresses.
Processing is via Anthropic's commercial API, which does not train models on customer data. RevenuePulse customers can switch AI drafting off entirely in Settings, in which case no data is sent to Anthropic.
Neon (database hosting) — United States (us-west-2)
Stores application data at rest, encrypted, for all services described in this policy.
Vercel (application hosting) — global edge network
Serves the website and application. Processes request metadata such as IP address for delivery and abuse prevention.
Resend (email delivery) — United States
Delivers RevenuePulse payment reminders. Receives the recipient's email address and the message itself, which contains the client's name, the invoice number, the amount, and the due date.
Bounce and spam-complaint results are retained so we do not email an address that has rejected us. Reminders are only delivered once a RevenuePulse customer chooses to send them.
Stripe (payment processing) — United States
Processes RevenuePulse subscription payments. Receives the billing email address of the subscribing business and handles card details directly.
Card numbers never reach ESICU systems. Payment is entered on Stripe-hosted pages; we store only Stripe's customer and subscription identifiers and the resulting plan status. This applies to the business subscribing to RevenuePulse — not to that business's own clients, whose invoices we never collect payment for.
RevenuePulse: who is responsible for what
If you are a RevenuePulse business customer, you are the data controller for your own clients' information that you enter into the product. ESICU acts as your processor, and the providers above act as sub-processors. We process that data only to deliver the service on your instructions. Requests from your clients to access or delete their data should be directed to you; we will assist you in responding.
International data transfers
ESICU operates from Bellevue (US), Toronto (Canada), and Hyderabad (India), and our infrastructure and sub-processors are located in the United States. If you are in the EU/EEA, the UK, Canada, or India, your data will be transferred to and processed in the United States. Where required, these transfers rely on Standard Contractual Clauses and equivalent safeguards under applicable law. Contact our DPO for a copy of the relevant transfer terms or our Data Processing Agreement.
Security Practices
ESICU maintains a security program whose controls are aligned to the SOC 2 Trust Services Criteria and ISO 27001. Our data protection measures include:
- AES-256 encryption at rest, TLS 1.3 in transit
- Multi-factor authentication on all systems
- Annual penetration testing by independent third parties
- Employee security training and background checks
- Data retention limited to legally required minimums
- Breach notification within 72 hours (GDPR) or 30 days (CCPA)
Terms of Service
By accessing esicu.com, you agree to these terms. Our services are provided "as is" for professional consultation. Engagement terms, deliverables, and SLAs are governed by individual service agreements signed between ESICU and each client.
Governing law: State of Washington, USA. Dispute resolution: binding arbitration under AAA Commercial Rules, except for injunctive relief.
Intellectual Property & Trademarks
ESICU™, the ESICU logo, the Ecom Strategies name and logo, and RevenuePulse™ are trademarks of Ecom Strategies LLC. Site content, copy, designs, and graphics are the property of Ecom Strategies LLC or its licensors; viewing this site grants no license to reproduce or redistribute them.
All other product and company names, logos, and marks referenced on this site — including those of cloud, ERP, and platform vendors we work with — are the property of their respective owners. Reference to them indicates our technical expertise and does not imply any affiliation with, sponsorship by, or endorsement from those companies.
To report misuse of our content or marks, contact legal@esicu.com.