Privacy Policy

Last updated: [date you publish]

This policy explains what personal data Ecom Tornado collects when you visit our Ecom Incubator page and apply for the programme. It covers why we collect it, who sees it, how long we keep it, and how you can control it. We have kept it short and in plain English.

You can ask for this policy in Hindi or in any other language listed in the Eighth Schedule to the Constitution of India. [Choose: A. "Email us and we will send you a translation within (N) days." / B. Add links here to the translated versions you publish]

The short version

• We collect what you type into the application form, plus a few details sent automatically with it. Everything is listed in section 3.
• We use it to review your application and contact you about it on WhatsApp, phone or email. We send WhatsApp tips and updates only if you tick that separate, optional box.
• Applying does not commit you to join or to pay anything.
• Your application is saved to a Google Sheet in our Google account, and an alert goes to our team on Slack. Google and Slack may store data outside India.
• Our system gives each application an automatic priority score. The score only sets the order in which we follow up. People on our team make the decisions.
• The Ecom Incubator page sets no cookies and runs no analytics or advertising pixels today.
• You can see, correct or delete your data, withdraw consent or complain at any time. To withdraw consent, email us.
• You must be 18 or older to apply.

1. Who we are

[Legal business name], trading as "Ecom Tornado" ("we", "us", "our"), runs ecomtornado.com and the Ecom Incubator, a 12-month 1-on-1 ecommerce mentorship with Nick Arora and his team.

We decide why and how your personal data is used. Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), that makes us the "Data Fiduciary". You are the "Data Principal". Other privacy laws call our role the "controller".

• Registered address: [Registered address]
• GSTIN: [GSTIN]
• Website: ecomtornado.com
• Email: nick@ecomtornado.com
• Grievance officer: [Grievance officer name], [grievance email] (see section 12)

2. What this policy covers

This policy covers:

• visiting our Ecom Incubator page (ecomtornado.com) and its Privacy Policy, Terms and Refund Policy pages;
• applying through the form on that page;
• our WhatsApp messages, calls and emails with you about your application.

Other parts of ecomtornado.com (our main website) are separate and are not covered by this policy. They use Google Tag Manager, which can load analytics or advertising tools. [Add the link to the main website's own privacy notice once it has one, or delete this marker]

Applying does not commit you to join or to pay anything. If your application looks like a fit, Nick or our team will contact you to set up a call. If you then decide to join, we confirm the enrolment and payment terms in writing before you pay.

If you enrol in the programme: [Choose: A. this policy also covers the data we handle for clients, such as invoices, payment records and call notes (add those items to section 3) / B. we give you a separate privacy notice for client data when you enrol]. The programme rules are in our Terms. Payments, cancellations and refunds are covered in our Refund Policy.

Links on our page to other services, such as YouTube or Instagram, take you to sites with their own privacy policies.

3. What we collect

What you type into the application form

• Your full name
• Your email address
• Your WhatsApp number, with country code
• Your tick in the required box: "I'm 18 or older, and Ecom Tornado can call, WhatsApp or email me about this application. I can withdraw this anytime..."
• The track you choose: Indian Ecom or US Ecom
• Your store stage and your monthly revenue band
• Your biggest problem right now
• Whether you are ready to invest, and your timeline
• How confident you feel
• Whether you have bought courses or coaching before
• Your answer to "What made you apply?" (optional)
• Whether you want WhatsApp tips and updates (optional, a separate tick box)

Details sent automatically with the form

• An application ID: a reference number for your application
• How long you took to fill in the form
• Link tags from the web address you arrived on, if there are any: utm_source, utm_medium, utm_campaign and utm_content. These tell us which video, post or ad sent you to us.
• The address of the page you applied on
• The website you came from, but only its domain (for example, instagram.com), not the full link
• The version of this privacy notice that was in force when you applied
• A hidden anti-spam field. People never see it, so they leave it empty. Spam bots often fill it in.
• The date and time your application reached us (added by our system, not your browser)

Your IP address is not one of these fields, and we do not save it with your application. But when your browser sends the form, Google's servers receive your IP address and basic browser details, as any web service does.

What we add afterwards

• A priority score and tier worked out from your answers (see section 6)
• A "likely spam" flag, if a submission looks automated or fake
• Follow-up records: when our team messaged or called you, and where your application stands
• Anything you tell us later on WhatsApp, on a call or by email, and our notes from calls with you. [Choose: A. "We do not record calls." / B. "We record calls only after telling you at the start of the call, and keep recordings for (period)."]

When you only browse

While you only read the page, we do not ask for or save anything about you, apart from any server logs described below. The page sets no cookies and runs no analytics or advertising pixels. Some technical data, such as your IP address, still reaches the services that deliver the page (see section 7). [Confirm what your hosting server logs. Choose: A. "Our server keeps basic access logs (IP address, browser type, page requested, time) for N days, for security and fixing faults." / B. "Our server keeps no access logs."]

What we do not ask for

The form does not ask for passwords, bank or card details, health or medical information, sexual orientation or biometric data. The SPDI Rules, 2011 call these "sensitive personal data". The form also does not ask for ID numbers such as Aadhaar or PAN. Please do not type any of these into the free-text box.

4. How we collect it

We collect it directly from you, through the application form on our Ecom Incubator page. When you press submit, your browser sends your answers and the automatic details above to a Google Apps Script web app (a Google service). It saves them to a Google Sheet in Ecom Tornado's Google account, in a "Website responses" tab and a "Lead Manager" tab.

After that, we collect what you tell us in WhatsApp chats, calls and emails about your application.

5. Why we use it

We use your data only for these purposes:

• Reviewing your application. We read your track, store stage, revenue band, biggest problem, investment readiness, timeline, confidence, past courses and free-text answer to understand your situation and see whether the programme is a fit.
• Contacting you about your application. We use your name, email and WhatsApp number to message, call or email you, set up a call and answer your questions. If you decide to join, we also use them to confirm the enrolment and payment terms in writing before you pay.
• Deciding whom to follow up with first. See section 6.
• Sending WhatsApp tips and updates, only if you ticked that box. We use your name and WhatsApp number to send you ecom tips and updates.
• Seeing what brings in applications. We use the link tags, page address and referring domain to learn which of our videos, posts or ads lead people to apply.
• Stopping spam. We use the time taken, the hidden anti-spam field and the application ID to spot automated or duplicate submissions.
• Keeping a record of your consent. We keep your tick-box answer, the notice version and the time we received your application.
• Meeting legal duties. For example, answering a lawful request from an authority, or keeping records the law requires if you enrol.

Our legal basis is your consent. You give it when you tick the required box and submit the form, after the short privacy note shown with the form. It covers the purposes above, except WhatsApp tips and updates. Those need the separate, optional tick box. You do not need that one to apply or to join. Where the law lets us use data without consent, for example to meet a legal duty, we rely on that instead.

If we ever want to use your data for a new purpose, we will tell you first and, where the law requires, ask for your consent again.

6. Automatic scoring

Our Lead Manager automatically gives every application a score and a priority tier. It works these out from your answers about:

• how ready you are to invest;
• how confident you feel;
• your timeline;
• your revenue;
• whether you have a store;
• whether you have bought courses before;
• how much you wrote in your answers.

What the score does: it only sets the order in which our team follows up, and so how soon we aim to contact you. A higher-priority application may get a message sooner.

What the score does not do: it does not accept or reject anyone, and it does not decide whether you can join. People on our team look at applications and make those decisions. [Choose: A. "A person on our team looks at every application that is not flagged as spam, whatever its score." / B. "We may not reply to every application. If you have not heard from us within (N) days, email us and a person will look at your application."]

Submissions that look like spam are flagged automatically. We keep them, marked as likely spam, rather than deleting them automatically. If you applied and have not heard from us, email us and we will check.

If you think your application was scored or flagged wrongly, tell us. You can see what we hold about you and have it corrected (see section 11).

7. Who we share it with

Our team

Nick Arora and the team members who handle applications can see your application in our Google Sheet and Slack.

Services that work for us

These companies store or process your data on our behalf. The DPDP Act calls them "Data Processors". We stay responsible for your data while they handle it.

• Google. Its Apps Script web app receives the form, and its Google Sheets service stores your application. Our team may also get email alerts and summary reports about applications, sent through Google. Google Privacy Policy
• Slack. When you apply, a message goes to our team's Slack channel. It shows your name, phone number, track, plan to invest, timeline, revenue band, biggest problem, the source that brought you to us, and your priority tier and score. Slack Privacy Policy
• Our hosting provider, DigitalOcean (managed through RunCloud), runs the cloud server that delivers our website. Server location: India (Bengaluru).
• Cloudflare manages our domain name system (DNS), which tells browsers where to find ecomtornado.com. Cloudflare answers the lookup for our domain name but does not carry the page itself.
• WhatsApp (Meta) and our email provider, Google Workspace, carry the messages we exchange with you.

Services your browser connects to directly

• Google Fonts. Our page loads its fonts from Google's servers. Your browser asks Google for them, so Google receives your IP address and basic browser details.
• YouTube. Videos on our page do not load until you tap one. When you tap, the player loads from youtube-nocookie.com and YouTube's player script loads from youtube.com. From then on, YouTube (Google) receives your IP address and viewing data, and may store cookies or similar data on your device under Google's own policy.

When the law requires it

We may share data with a government agency, regulator or court when Indian law requires us to, for example under a lawful order.

[Confirm or delete: We do not sell or rent your personal data, and we do not give it to other businesses for their own marketing.]

If we start using a new service that handles your data, we will update this list before it does.

8. Storage outside India

Google and Slack may store and process your data outside India, for example in the USA. Our application form tells you this before you submit. WhatsApp, Cloudflare, Google Fonts and YouTube are global services, so they may also handle your data outside India.

What the law says: the SPDI Rules allow data to go abroad if you have agreed to it, or if it is needed for a lawful contract with you, and the receiver keeps it as safe as we must. The DPDP Act allows transfers except to countries the Government of India restricts by notification. If the Government restricts a country where one of our services keeps your data, we will stop sending data there.

9. How long we keep it

• If you apply but do not join: we keep your application for [how long you keep applications, e.g. 12 months] from the date you applied. Then we delete it.
• Likely-spam submissions: [Choose: kept for the same period as other applications / deleted after N days].
• If you join: we keep what we need while you are in the programme. Records the law requires, such as invoices and payment records, are kept for [how long you keep client and invoice records, e.g. 8 years; check with your CA].
• If you withdraw consent or ask us to delete your data: we stop contacting you and delete your data as soon as we can, within one month at most, unless the law requires us to keep some of it. If we must keep something, we will tell you what and why.

Deleting means we remove your row from the "Website responses" tab, your row in the Lead Manager, the Slack message about you, and any alert email about you. [Choose: A. We also delete our WhatsApp chat and email thread with you / B. We keep our WhatsApp chat and email thread with you for (period) because (reason)].

Google Sheets also keeps an edit history of the file, so an older copy of your row can stay in that history. Only people we have given access to the file can see it. [Choose: A. "Every (N) months we move current applications to a fresh copy of the sheet and delete the old file, which removes that history." / B. Describe how you clear the edit history] Google and Slack may also take some time to clear deleted data from their own systems and backups.

10. How we protect it

We take reasonable steps to protect your data, as the IT Act and SPDI Rules require:

• Your application is kept in Ecom Tornado's own Google account and our team's Slack workspace, not on any public page.
• We protect these accounts by [your account safeguards, e.g. giving access only to team members who handle applications, strong passwords, 2-step verification, and removing access when someone leaves the team].
• The form has checks that flag likely spam.

No website or online service is completely secure, so we cannot promise perfect security. If a breach affects your data, we will tell you. We will also report it as Indian law requires, for example to CERT-In, and to the Data Protection Board once that duty applies.

11. Your rights and choices

You can use these rights now, before every part of the DPDP Act applies. You can:

• Access your data: ask for a summary of the personal data we hold about you, what we do with it, and the names of the services we have shared it with.
• Correct or update it: ask us to fix anything wrong, incomplete or out of date.
• Erase it: ask us to delete your data. We will, unless the law requires us to keep it.
• Withdraw consent: this is as easy as giving it. Tap Withdraw consent / delete my data. It opens an email to us with the subject already filled in. Send it from the email address you applied with, or add the WhatsApp number you used. If the link does not open an email app, email nick@ecomtornado.com with the subject "Withdraw consent / delete my data".
• Stop WhatsApp tips and updates only: reply STOP to any update, or tap Stop WhatsApp updates. Your application stays open.
• Nominate someone: name a person who can use these rights for you if you die or become unable to act for yourself. Email us their name and contact details.
• Complain: raise a grievance with our grievance officer (see section 12).

When you withdraw consent, we stop contacting you and delete your data as explained in section 9. We will not ask you for extra proof just to stop contacting you. We will not be able to continue your application. Withdrawing does not make our earlier use of your data unlawful.

To make any other request, email nick@ecomtornado.com. For access, correction or deletion requests, we may ask you to confirm from the email address or WhatsApp number you applied with. This stops us handing your data to someone else. We will reply within one month.

Once its duties apply, the DPDP Act also asks you not to pretend to be someone else, not to make false or frivolous complaints, and to give only true information when you ask us to correct your data.

12. Grievance officer and complaints

If you have a concern about how we handle your data, contact our grievance officer:

• Name: [Grievance officer name]
• Designation: [Grievance officer's designation, e.g. Founder]
• Email: [grievance email]
• Phone: [Choose: add a phone number for complaints / delete this line]
• Address: [Registered address]

We will acknowledge your complaint within 48 hours. We will look into it and reply with our decision as quickly as we can, and within one month of receiving it. This is what rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 requires, as do the Consumer Protection (E-Commerce) Rules, 2020 where they apply.

Data Protection Board of India: once the complaint provisions of the DPDP Act and the DPDP Rules, 2025 come into force, you can complain to the Data Protection Board of India if you are not happy with our reply. The Act asks you to raise the issue with us first. We will add a link to the Board's complaint page here when it opens.

13. Cookies and tracking

Today, the Ecom Incubator page:

• sets no cookies of its own;
• uses no analytics tools;
• has no advertising pixels, such as the Meta Pixel or Google Ads tags.

Two outside services are involved, as explained in section 7: Google Fonts, which loads with the page, and YouTube, which loads only when you tap a video and may then set its own cookies.

If we add a Meta or Google pixel, or any analytics tool, we will first update this policy, with a new date and notice version, before the tool goes live. [Choose: A. We will also ask for your permission, with a cookie choice on the page, before any pixel loads (recommended) / B. We will explain how you can opt out]

14. Only for adults (18+)

The Ecom Incubator and our application form are only for people aged 18 or older. Everyone who applies confirms this in the required tick box. We do not knowingly collect data from anyone under 18. If we learn that someone under 18 has applied, we will delete their application. If you are a parent or guardian and think your child has applied, please email us.

15. Laws we follow

Today, we handle your data under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are coming into force in stages. We will follow each part as it commences. Where they replace the older rules, the new rules will apply instead.

Governing law and the courts for disputes are set out in our Terms. Nothing in this policy or our Terms takes away your rights under Indian law. For example, you can still complain to the Data Protection Board (once that route opens) or to a consumer commission.

16. Changes to this policy

When we change this policy, we update the "Last updated" date at the top and the notice version below. Every application records the notice version in force when it was sent, so we know which version applied to you. We keep each earlier version, so we can show you the one that applied when you applied. If a change affects how we use data you have already given us, we will tell you by [Choose: email / WhatsApp / both] before the change takes effect and, where the law requires, ask for your consent again.

Notice version: [notice version; must match NOTICE_VERSION in index.html, currently 2026-10-12.3; change both together]

17. Contact us

Questions about this policy or your data: nick@ecomtornado.com

[Legal business name], trading as Ecom Tornado, [Registered address].

Back to the Ecom Incubator · Terms · Refund Policy