Privacy Policy

Information we collect

We collect only what the service needs to run.

• Vendor account details: name, business name, email, phone and address.
• Store content the vendor creates: products, prices, images, categories and settings.
• Order information needed to fulfil a purchase, including the customer's name, phone, address and order contents.
• Basic technical data such as IP address and browser type, used for security and to keep the service working.

How we use it

• To operate the vendor's storefront and mobile app.
• To process and deliver orders.
• To provide support and to secure accounts.
• To send integration data to a third-party service the vendor has explicitly connected.

Meta integration

Connecting Meta is optional and is always started by the vendor from their own dashboard. Nothing is sent to Meta before a vendor connects.

• When a vendor connects, we store an access token issued by Meta, along with the identifiers of the Business, catalog and dataset (pixel) the vendor selected.
• The access token is encrypted at rest using AES-256-GCM and is held only on our servers. It is never shown in the dashboard, never sent to a browser or mobile app, and never included in any API response.
• We publish a product feed to the vendor's Meta catalog. It contains product information only: title, description, price, availability, product image and the public link to the product page on the vendor's storefront.
• We do not include any customer personal data in the catalog feed.
• A vendor can disconnect Meta at any time from the dashboard. We delete the stored access token immediately. The catalog stays in the vendor's own Meta Business, because it may be in use by their advertising.

Sharing

We do not sell personal data. We share it only with the service providers needed to run the platform — hosting, storage, payment processing, delivery — and with an integration a vendor has connected. Each receives only what its function requires.

Retention

Account and store data is kept while the account is active. Order records are kept as long as required for accounting and legal obligations. Integration credentials are deleted as soon as the integration is disconnected.

Security

• All traffic is served over HTTPS.
• Integration access tokens are encrypted at rest.
• Access to the Meta area of the dashboard requires the vendor to re-confirm their password, and each session is scoped to that vendor alone.

Your rights

You may request access to your data, correction of it, or its deletion. See our Data Deletion page for how to request removal.