Privacy Policy

• Account data. Name, email, business details, and authentication information you provide when you sign up.
• Billing data. Plan, billing cycle, and payment metadata. Card details are handled directly by our PCI-compliant payment processors and are not stored on our servers.
• Store & shopper data. Product catalogs, orders, and customer records that you or your shoppers submit through your storefront. This data is processed on your behalf.
• Usage & device data. Log data, IP address, browser type, and interactions with the Service, collected to keep it secure and to improve it.
• Cookies. Essential cookies to run the Service and, with consent where required, analytics cookies to understand usage.

We use personal data to:

• Provide, operate, secure, and maintain the Service.
• Process subscriptions, billing, and payouts.
• Provide support, send service-related notices, and respond to requests.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Improve and develop new features, using aggregated or de-identified data where possible.
• Comply with legal obligations and enforce our Terms.

We do not sell your personal data, and we do not use merchant shopper data for our own advertising.

Where the GDPR or similar laws apply, we process personal data on the bases of performing our contract with you, our legitimate interests in operating and securing the Service, your consent (for example, for certain cookies or marketing), and compliance with legal obligations.

We share personal data only as needed to run the Service:

• Sub-processors. Vetted providers for hosting, infrastructure, payments, analytics, and email who process data under contract on our instructions.
• Merchants. Shopper data is shared with the merchant whose storefront the shopper interacts with.
• Legal. When required by law, to protect rights and safety, or in connection with a corporate transaction such as a merger or acquisition.

A current list of sub-processors is available on request at [email protected].

We protect data with encryption in transit and at rest, network isolation between tenants, least-privilege access controls, continuous monitoring, and regular security reviews. Our platform is operated in line with SOC 2 Type II and ISO 27001 controls. No system is perfectly secure, but we work continuously to safeguard your data and to notify affected parties of any breach as required by law.

We retain personal data for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. When you delete your account we close it straight away and remove your personal data after the grace period described in Deleting your account below, keeping only the records we are required to retain.

You can close your Storlox account at any time: in the Storlox app under Settings → Security → Delete account, in the Merchant dashboard under Account → Security → Delete account, or from our public Account & Data Deletion page if you can no longer sign in.

Requesting deletion closes the account and takes any store you own offline straight away. Your personal data is removed after a grace period, during which the request can be undone from a link we email you: sign-in credentials, sessions, registered devices, notification history and team memberships are deleted, and your name, email address and photo are stripped from the account record.

Some records remain, and we say so rather than promise an erasure we do not perform. Orders, invoices, payments and the records attached to them are business and financial records we are required to keep; they stay linked to an anonymized account rather than to you. Conversations and invitations that involve someone else go on existing but stop naming you, and data your shoppers gave a store belongs to those shoppers rather than to the merchant account that is closing. The deletion page above sets out the full list.

We operate globally and may transfer personal data to countries other than where you live. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses to protect data transferred across borders.

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing or withdraw consent.

• For merchant-account data, contact us directly to exercise these rights. Deletion needs no request: see Account & Data Deletion.
• For shopper data held on a merchant’s behalf, please contact the relevant merchant; we will assist them in responding.

You may also have the right to lodge a complaint with your local data protection authority.

The Service is not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service. The “last updated” date above reflects the most recent revision.

For privacy questions or to exercise your rights, contact our team at [email protected].