Marketplace votes
If you vote for the next marketplace, we store your work email, company and answers to follow up about eComm Pipes. Results only ever show totals. One vote per email. Ask us through the contact form to delete your vote.
Your data and access
Privacy and retained data.
What eComm Pipes receives, what it keeps, and how you can remove access.
Connector requests, not your full conversation
eComm Pipes receives connector requests and returns results. It does not receive your full Claude or Codex conversation. Redacted request and result details support restricted operator inspection.
API keys stay in Google Secret Manager. Credentials, customer contact information, payment details, and signed download links are excluded from inspection records.
Sign-in information
Google sign-in requests identity and email information only. It does not request access to Gmail or Google Drive. eComm Pipes stores your verified email and Google’s stable account identifier to match later sign-ins to your account. Account deletion removes this Google sign-in link.
Google access and refresh tokens are not retained. Signing in does not expand Walmart permissions or authorize a client to use seller data.
Goals and history
Saved goals and decisions
eComm Pipes stores the notes you ask your client to save for the selected account and connection. Other authorized clients of that account and connection can read them. Notes are planning information, not verified Walmart facts or approvals.
Ask your client to clear the notes when you no longer need them. Disconnect and account deletion also erase saved context. Do not include customer personal data or secrets.
Captured Walmart data
Configured pilot capture can store seller data for history and derived views. Connecting keys does not start capture or backfill earlier data. Stored results identify their freshness and coverage; missing history is not zero activity.
Captured history uses a rolling three-year retention window with scheduled cleanup. Disconnect and account deletion schedule removal of the connection’s captured data. Cleanup status can remain pending.
Operational retention
- Redacted request and result details
- Up to 7 days, for restricted operator support.
- Private downloads
- Expire within 7 days. Access requires the owning account.
- Scalar activity events
- Up to 90 days.
- Daily usage aggregates
- Up to 180 days.
- Change records
- At least 90 days. Unresolved operations remain until reconciled or their records are explicitly closed through account deletion. Closing a record does not establish a business outcome.
Product analytics
eComm Pipes uses PostHog (US Cloud) to understand how people find and use the product. On our pages, a first-party script sends page views, page exits, clicks and a sample of session replays (about 1 in 4 browser sessions). Replays and click records mask all text, inputs and attributes. Sign-in codes, Walmart API key forms, consent details, deletion forms and seller data are excluded from replays and click records.
Our server also sends product events: sign-in steps, connection status, client authorization, change milestones and connector tool calls. Tool call events contain the tool name, outcome, timing and error code only, never the request arguments or results. Votes send the chosen marketplace and the advertising answer, never your email or company. Contact messages send the topic only.
Events use a random identifier and, after sign-in, your internal account ID. We do not send your email address, your IP address or location to PostHog. Web addresses are sent without query strings, except campaign tags (utm) and ad click IDs.
- ep_aid
- Random visitor identifier. First-party, HttpOnly, 1 year.
- ep_ft and ep_lt
- First and most recent campaign tags and ad click IDs. First-party, HttpOnly, 90 days.
- PostHog browser storage
- The PostHog script keeps its visitor and session identifiers in a first-party cookie and local storage.
If your browser sends Do Not Track or Global Privacy Control, eComm Pipes loads no analytics script, sets none of these cookies and sends no analytics events for your requests. To delete your analytics data, use the contact form; we delete the PostHog person and its events.
Control access and deletion
From your account, revoke a client, disconnect a Walmart Marketplace account, or review account deletion. Disconnect stops client access and schedules key deletion after active requests end.
Account deletion removes retained details and aggregates after required operation reconciliation. The deletion review identifies unresolved changes and required audit retention. The status page reports pending cleanup instead of claiming deletion is complete.