Privacy policy
Draft for review. This text has not yet been checked by a lawyer and may change before launch.
The short version
- We collect what we need to run your account and your store, and nothing more.
- Customers can browse stores without giving us anything.
- Customer records a store chooses to keep belong to that store. We don’t use them for our own marketing.
- We don’t sell personal data.
What we collect from store owners and staff
Your name, email address, a hashed version of your password, and the details you add about your stores, such as address, phone and catalogue.
We also keep security records such as sign-in times and the IP address and browser of active sessions, so we can protect your account.
What we collect from customers of a store
Browsing a store page requires no personal data. To place an order, a store may ask for your name, phone number, email and, for delivery, an address. The store decides which of these it needs. If you write a review, we keep your rating, comment, first name and phone number; your number is never shown publicly.
The store uses these details to fulfil your order and to recognise you next time. The store decides how its customer records are used; we store and process them on the store’s behalf. For a request about your details, ask the store, or contact us and we’ll pass it on and help.
How we use data
- To provide the service: accounts, store pages, catalogue and orders.
- To send essential emails, such as verification codes and security alerts.
- To keep the service secure and to prevent abuse.
Who we share it with
Service providers who help us run the product: hosting and database, email delivery (Brevo), image storage (Cloudinary) and, for order notifications, Firebase Cloud Messaging. They process data on our behalf.
How long we keep it
Account data is kept while your account is active. Sign-ups that are never verified are deleted after 7 days. When a store is deleted, its catalogue, settings, orders, customer records, reviews and uploaded images are deleted too. Security logs are kept for one year and then deleted.
Your choices
You can update your details from your account, ask for a copy of your data, or ask us to delete it. Contact us for any privacy request.
Grievances
If you have a complaint about how your personal data is handled, contact our grievance officer at our contact page. We acknowledge complaints promptly and aim to resolve them within 30 days.