Privacy policy

Last updated 9 November 2026. Controller: Lukasz Madrzak, Ireland, [email protected].

Merchants (people with an account)

We store your name, email address, a hashed password if you set one, your shop's settings and products, your Stripe account id and its status, your API keys as hashes, and the orders made through your shop. We use this to run the service, to email you about your orders and account, and to keep the service secure. Legal basis: performance of our contract with you, and our legitimate interest in security.

Buyers (people who buy from a merchant's shop)

When you pay, Stripe collects your payment details on its own pages. We never see your card number. Stripe sends us your name, email address, the items you bought, the amount, and your shipping address if the merchant asked for one. We store this so the merchant can fulfil your order and so you can get an order email. The merchant is the controller of this data for their shop; we process it on their behalf and under our contract with them. If you have questions about an order, contact the shop you bought from.

The storefront script on a merchant's website keeps your cart in your own browser's storage. It sets no cookies and does not track you across sites.

Processors

Stripe (payments), Postmark (email), Hetzner (hosting, Germany), Cloudflare (network). We use privacy-friendly analytics on addtheshop.com that set no cookies.

Retention

Account data is kept while your account exists and deleted within 30 days of a deletion request. Orders are kept for as long as the merchant's account exists, and merchants may be required by tax law to keep their own records longer.

Your rights

You can ask for a copy of your data, a correction, or deletion by emailing [email protected]. You can complain to the Irish Data Protection Commission.

Security

Data is encrypted in transit. Passwords are hashed with bcrypt. Secret keys are stored as SHA-256 hashes and shown once. Access to the server is restricted to the operator.