Privacy Policy

1. Information We Collect

We collect information necessary to operate multi-tenant store instances:

• Merchant Profile: Name, business email, and encrypted credentials.
• Customer Orders: Customer delivery address, phone number, order items, and delivery preferences provided during checkout.
• Technical Metadata: Anonymized request logs, IP addresses (stored cryptographically as SHA-256 hashes), and browser agent strings for audit compliance.

2. How Data is Processed & Secured

All customer and order records are partitioned by tenant UUID and strictly isolated using PostgreSQL Row-Level Security (RLS). Connections are encrypted in transit via TLS 1.3, and access tokens are stored in HttpOnly, SameSite=Lax, Secure cookies.

3. Authorized Sub-Processors

We partner with trusted enterprise cloud infrastructure providers to deliver high reliability:

• Hosting & Edge Delivery: Vercel Inc. (United States / Global CDN).
• Database & Storage: Supabase Pte. Ltd. / AWS (Tokyo region / APAC).
• Distributed Caching & Rate Limiting: Upstash Inc. (Serverless Redis REST).

4. Customer Rights & Anonymization

Merchants can request complete deletion or anonymization of specific customer records. Our privacy service redacts personally identifiable information (PII) like names, phone numbers, and delivery addresses while preserving immutable financial order ledger amounts.

5. Cookie Policy

We use strictly necessary session cookies for authentication and cart persistence. We do not use third-party advertising tracking cookies.