How Ecovacs treats owners after the sale, from our assessment of its robot vacuum and window robot sold in Spain: warranty, updates, parts for older models, independence from its cloud, and privacy.
Draft scores, in review: not yet checked by a second reviewer. Manufacturers can raise a score by publishing the missing information.
Ecovacs publishes a Spain support-period policy: security updates for at least 3 years from each model's launch; T90 PRO OMNI listed with launch 2026-01-23 and security updates until 2029-01-23.
Brand policy: security updates for at least 3 years from launch for 'certain device models'; the model list is rendered by script and W2S OMNI coverage could not be confirmed.
Ecovacs published a security advisory for DEEBOT X2 OMNI devices on 2025-11-15 (within the last 12 months); the X2 OMNI launched in Spain 2022-10-18 (just under 4 years ago). Older models (T10, X1, launched 2022-01) got security fixes by July 2025, outside the 12-month window.
The only parts found for the comparison model (OZMO T8, 2020) are mop pads sold by Amazon.es on its own account, which the Standard doesn't count. Ecovacs' EU parts distributor (Krempl) stocks T8 parts, but delivery to Spain couldn't be confirmed.
Old model: WINBOT 920 (production start 08.02.2021 per Krempl). Nothing for it is orderable to Spain through an accepted channel. On ecovacs.com/es the only WINBOT accessories are for the W1 Pro, and no accessory can be added to the cart. On Amazon.es, WINBOT 920 cleaning pads (ECOVACS brand) are sold by the third-party seller iPerGo, not ECOVACS or Amazon, so they are not counted. The WINBOT 950/930-era extension cable is sold by the third-party seller NETNBUY. Krempl's WINBOT 920 and 880 pages list only cords and springs, all 'Nicht lieferbar', and Spain delivery is unverified. 0 of 6 key modules.
The manual states the battery is replaceable only by skilled persons via Customer Service, i.e. an official service-centre battery path exists; no battery is sold to consumers and no third-party T90 battery was found.
Manual states the battery must be replaced by Ecovacs or its service agent; no battery sold to consumers. Based on standard safety wording, not an explicit service offer.
On-demand cleaning via the physical start button works offline and without accepting the app terms, but scheduling, maps and zones need the ECOVACS HOME app and a connection; Ecovacs says offline you must start each clean manually.
Ecovacs states WINBOT works without Wi-Fi via power and mode buttons; app-only extra modes and troubleshooting are lost. Scheduling does not apply to window robots.
No Matter certification confirmed for T90 PRO OMNI (Ecovacs' Matter list names X2/X2 Combo/T50/T50 Max/X8 only) and no official local API. The Home Assistant Ecovacs integration supports the T90 PRO OMNI but is Cloud Push; its self-hosted option relies on Bumper, which does not list the T90 as working.
Published vulnerability disclosure policy (security.txt, product security centre). Fix timeliness is mixed: after the Aug 2024 DEF CON disclosure Ecovacs first said it would not fix, and the BLE RCE advisory came 2024-11-19 (~100 days); the 2025 base-station CVEs were fixed within ~2 months of the CISA advisory.
Published vulnerability handling standard and reporting channel. Fixes not consistently within 90 days of public disclosure: DEEBOT flaws shown at DEF CON (Aug 2024) still unpatched in Oct 2024 and base-station CVEs patched July 2025.
In-app account cancellation is available (App account settings). But the ECOVACS HOME privacy policy uses device operational logs and work-environment maps for profiling to customise own and third-party ads, and shares data with advertising providers (opt-out only). Apple's ES privacy label also lists identifiers and usage data used for tracking/third-party advertising. Google Play's data-safety section says no data is shared, which contradicts this.
In-app account cancellation is available (App account settings). But the ECOVACS HOME privacy policy uses device operational logs and work-environment maps for profiling to customise own and third-party ads, and shares data with advertising providers (opt-out only). Apple's ES privacy label also lists identifiers and usage data used for tracking/third-party advertising. Google Play's data-safety section says no data is shared, which contradicts this.
