Privacy policy

This policy explains how RivalSonar handles personal data when you use rivalsonar.com or our Chrome extension, buy a plan or credits, or contact us. It also explains what our store and ad data contains, what it does not contain, and how store owners can ask us to hide their store.

Who we are

RivalSonar is a competitor research service for ecommerce. It finds online stores, estimates their sales and traffic, and shows their products, ads, themes and apps. It is operated from India and serves customers worldwide. In this policy, "RivalSonar", "we" and "us" mean the operator of rivalsonar.com.

We decide why and how the personal data in this policy is used, so we are the controller under the EU and UK General Data Protection Regulation (GDPR) and the data fiduciary under India's Digital Personal Data Protection Act 2023 (DPDP Act).

Personal data we collect

Data you give us or create

• Account details. Your name, email address and password (stored only as a one-way hash). You can also add an avatar and set your timezone, theme and notification preferences.
• Workspace and team details. The workspaces you belong to, their members and roles, and the invites you send or receive.
• Billing details. Your plan, credit packs, invoices, billing name and address, an optional GST or VAT number and transaction references from our payment providers. We never see or store full card numbers or UPI PINs.
• Usage data. The pages and features you use, your searches and filters, the stores, products and ads you open, your collections and saved searches, the stores and advertisers you track, the exports you make and the credit and slot counters that track your plan.
• Chrome extension data. When you ask the extension to analyse a store, it sends us the address of that store page, linked to your account, so we can return the analysis and charge the credits for it.
• Technical logs. Your IP address, browser user agent and the time of each request, used for security, rate limits and abuse prevention.
• Support and contact messages. Your name, email address, company, topic and message, and the IP address it came from.
• Data removal requests. Which store you asked us to hide, how we verified the request and what we did.
• Emails we send. Which emails we sent you, such as verification, tracker report, saved search digest and billing emails, and whether they were delivered.

You need a name, email address and password, or Sign in with Google, to create an account. Everything else is optional or created as you use RivalSonar.

Data we receive from others

• Google. If you use Sign in with Google, Google shares your name, email address and profile picture. We never see your Google password, and we do not keep tokens that give access to your Google account.
• Payment providers. Razorpay and PayPal tell us whether a payment succeeded, failed, was refunded or was disputed.
• Cloudflare. Cloudflare tells us which country a request comes from and whether it passed bot checks.

Store and ad data

Most of RivalSonar is market data about online stores, which are businesses, not people. We collect it only from public sources:

• Public storefront pages, for a store's name, platform, theme, apps, tracking pixels, products and prices
• Public sitemaps and product feeds, for product lists and catalogue changes
• Public ad libraries, for ads, advertiser names, start dates and, where the platform publishes it, reach
• Public traffic rankings, from which we model estimated visits

From these we calculate estimates of a store's traffic, orders and revenue. These figures are modelled estimates, not data taken from the store.

We never log into stores, never access store admin areas, never bypass bot protection or other access controls, and never collect the personal data of a store's customers, such as names, addresses, emails or order details. RivalSonar holds no shopper personal data.

Some store or advertiser names can include a person's name, for example a sole trader who names the store after themselves. We show such names only as the store or ad library publishes them.

Why we use it. Our customers use store and ad data for business-to-business market and competitor research. We rely on legitimate interests, ours and our customers', in understanding the ecommerce market, and we have weighed them against the interests of store owners. We show nothing that the store or the ad platform does not already publish, apart from our own estimates.

Your choices. If you own a store, you can ask us to hide it on our data removal page. We hide it within 7 days. You can also object to this processing at any time, free of charge.

How we use personal data and why

Where we rely on legitimate interests, we have balanced them against your rights, and you can object at any time.

Under India's DPDP Act, we rely on the consent you give when you sign up or message us, on your having given us the data voluntarily for a specific purpose, or on legal requirements. You can withdraw consent at any time, although we may then be unable to keep providing the service.

You can turn off tracker report and digest emails in your notification settings or with the unsubscribe link in each email, but we still send emails needed to run your account, such as password resets and billing notices.

We do not make decisions with legal or similarly significant effects on you based only on automated processing.

Cookies and analytics

Essential cookies sign you in, remember your price region and keep the site secure. Analytics cookies from Google Analytics 4 and Microsoft Clarity, and Google Tag Manager, which loads our analytics tags, load only if analytics is switched on and you allow it in the cookie banner. Our cookie policy lists every cookie.

Who we share personal data with

We share personal data only with the people and companies below, and only as much as they need. We do not sell your personal data.

Service providers

These providers process personal data for us under contracts that limit how they may use it.

Razorpay and PayPal also act as independent controllers for some payment data, for example to meet banking and anti-fraud rules, under their own privacy policies.

Others

• Your workspace. Members can see each other's names, email addresses and roles, and owners and admins manage invites, credits and billing.
• Legal and safety reasons. We may disclose personal data when the law requires it, such as for a valid court order, or to protect the rights, property or safety of RivalSonar, our users or others. Where the law allows, we will tell you first.
• Business changes. If RivalSonar is sold or merged, personal data may pass to the new owner, who must keep protecting it as this policy describes, and we will tell you.

International transfers

RivalSonar is operated from India, and our main servers and databases are hosted by Hetzner in Germany. Some service providers, such as Cloudflare, Google, Microsoft and PayPal, may process data in the United States and other countries. Razorpay processes payments in India.

When personal data from the European Economic Area or the United Kingdom goes to a country without an adequacy decision, we rely on the European Commission's standard contractual clauses, the UK addendum to them, or an equivalent safeguard such as a provider's certification under the EU-US Data Privacy Framework. You can ask us for details of the safeguard that applies.

How long we keep personal data

Backups are kept for 14 days, so deleted data leaves our backups within a further 14 days. We may keep data longer when the law requires it or to deal with a dispute, and we may keep statistics that no longer identify anyone.

How we protect personal data

• All traffic to and from RivalSonar is encrypted with TLS.
• Passwords are stored only as hashes, and secrets are encrypted at rest with AES-256-GCM.
• Staff reach account data only when their role needs it, for example to answer a support request, and admin actions are recorded in audit logs.
• Admin staff must use two-factor authentication.
• We take regular backups so we can recover from failures.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will tell you and the relevant authorities as the law requires.

Your rights

Wherever you live, you can ask what personal data we hold about you, ask us to correct it and ask us to delete your account. Your account settings include a data export and account deletion.

In the EEA and the UK

Under the GDPR and the UK GDPR you have the right to:

• access your personal data and get a copy of it
• have inaccurate or incomplete data rectified
• have your data erased
• restrict how we use your data
• receive your data in a portable format
• object to processing based on legitimate interests, including the store and ad data we show
• withdraw consent at any time, without affecting processing that happened before
• complain to a supervisory authority, such as the data protection authority where you live or work, or the Information Commissioner's Office in the UK

In India

Under the DPDP Act you have the right to:

• get a summary of the personal data we process about you, how we process it and who we have shared it with
• have your data corrected, completed, updated or erased, unless the law requires us to keep it
• have your grievances handled by us
• nominate another person to exercise your rights if you die or are unable to act

If you are not satisfied with how we handle your grievance, you can approach the Data Protection Board of India after you have used our grievance process.

In California and other US states

Depending on where you live, you may have the right to know, access, correct and delete the personal information we hold about you and to get a portable copy. We will not treat you differently for using these rights. You can use an authorised agent, and we will ask for proof of their authority. If we decline your request, you can appeal by replying to our decision.

In the last 12 months we collected identifiers (such as name, email and IP address), commercial information (such as plans, credit packs and invoices), internet activity (such as usage data and logs) and professional information (such as company names), as described above, and disclosed them to the service providers listed above for business purposes. We use sensitive personal information, such as your password, only to provide the service.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

How to make a request

Email [email protected] with the subject line "Privacy", from your account email if you have an account, and tell us what you would like us to do. If we cannot confirm who you are, we may ask for more information. Requests are free, although where the law allows we may refuse requests that are clearly unfounded or excessive. We answer within 30 days. If a complex request needs more time and the law allows it, we will tell you within those 30 days and explain why.

Children

RivalSonar is a business service and is not meant for anyone under 18. We do not knowingly collect their personal data, and if you believe a child has given us any, contact us and we will delete it.

Changes to this policy

We update this policy when our practices or the law change, and the date at the top shows the latest version. If a change materially affects how we use your personal data, we will tell you by email or in the product before it takes effect.

Contact and grievances

For questions, requests or complaints about privacy, email [email protected] with the subject line "Privacy". This address is also our grievance contact under India's DPDP Act, and we answer every grievance within 30 days. RivalSonar is operated from India.