Privacy Policy
1. Who is responsible
[Legal name of the business], [address], [country], contact [email address].
- Merchants (stores using the service): we are the controller of your account data.
- Your customers (people who receive an invoice): the store is the controller; we process their data on the store's behalf and only to send and track its invoices.
2. What we use
| Whose | Data | Why |
|---|---|---|
| Merchants | Business name, email, password (stored only as a secure hash), plan, connected payment account ID and API key (encrypted), store addresses. | To run your account, send invoices and confirm payments. |
| Store customers | Name, email, country, order number, items, amounts, payment status and payment ID. | To create the invoice, email it and its reminders, and tell the store when it is paid. |
| Everyone | IP address in short-lived security counters and server logs. | To stop abuse such as password guessing. |
We never receive card details: customers pay on the payment provider's own checkout.
3. Who processes it for us
- Netlify: hosting and website functions.
- Neon: database.
- Resend: sending emails.
- Whop: the merchant's payment provider, which receives the invoice details needed for the checkout.
Some of these providers may process data outside the UK and EEA, with appropriate safeguards such as standard contractual clauses.
4. How long we keep it
Merchant accounts are kept while the account is open and deleted within [90] days of closing, apart from records we must keep by law. Invoice records are kept for [number] years for the store's accounting, unless the store asks us to delete them earlier. Security counters expire within hours.
5. Cookies
We use one cookie, only after you log in, to keep you logged in (it_session, 30 days). It is strictly
necessary, so no consent banner is needed. We use no tracking or advertising cookies.
6. Your rights
You can ask to see, correct, export or delete your data, or object to how we use it, by writing to [email address]. Store customers should contact the store first; we will help the store answer. You can also complain to your data protection authority (in the UK, the ICO).