Sellers Forge
Open menu
Pricing Stores Resources Create your store

Privacy Policy

Effective July 9, 2026.

This Privacy Policy explains what personal data the platform ("Platform Provider," "we," "us," or "our") collects, how we use and share it, and the choices available to store owners ("Tenants") and their customers ("Buyers"). It applies to the multi-tenant storefront platform and does not cover third-party sites you may reach through links on a store.

1. Our role: controller and processor

For account and platform-administration data (your login, billing, and store configuration), we act as the data controller. For your buyers' order, shipping, and payment data, we act as a data processor on your behalf as the Tenant, who is the controller of that data. You are responsible for having your own privacy policy and lawful basis for collecting data from your buyers.

2. Information we collect

  • Account data: email address, hashed password, display name, and store configuration.
  • Storefront data: products, inventory, branding assets, orders, shipments, and payment records processed through your store.
  • Buyer data: names, shipping and billing addresses, and order history submitted by your customers at checkout.
  • Operational data: IP address, request and error logs, device and browser information, and session cookies needed to keep you signed in and your cart intact.
  • Integration credentials: API keys for connected services such as Stripe and Resend, stored encrypted at rest.

3. Cookies

We use strictly necessary cookies to maintain your session, remember your cart, and protect against cross-site request forgery. We do not use third-party advertising or cross-site tracking cookies. Disabling cookies in your browser will prevent core features like checkout from working.

4. How we use information

We use collected information to operate and secure the Service, process transactions, deliver account and order communications, provide customer support, enforce our Terms of Service and Acceptable Use Policy, investigate abuse reports, and comply with legal obligations. We do not sell Tenant or Buyer personal data.

5. Sub-processors and sharing

We share data with the following categories of sub-processors, only as needed to provide the Service:

  • Payment processing (for example, Stripe), to process orders and subscription billing.
  • Transactional email (default platform sender, or a Tenant's own Resend account when configured), to deliver order and account emails. When a Tenant connects their own Resend account, the platform does not become a controller of mail sent through it.
  • Infrastructure and hosting providers that store and serve application data and backups.

We may also disclose information where required by law, to enforce our Terms, or to protect the rights, property, or safety of the Platform Provider, our Tenants, or the public.

6. Data security

We encrypt sensitive data at rest, including integration API keys, and encrypt data in transit using TLS. Access to production data is limited to personnel who need it to operate the Service. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

7. Retention

Storefront and buyer data is retained for the lifetime of the store. When a store is scheduled for deletion, its data and associated file storage are purged after a 30-day grace period; an audit record of the deletion is retained for compliance purposes. Operational logs are retained for a limited period for security and debugging, then deleted or anonymized.

8. Your rights and choices

Subject to applicable law, you may request access to, correction of, or deletion of your personal data by contacting the platform administrators, or by using in-app tools where available (for example, scheduling your own store for deletion). If you are a Buyer, requests about your order data should generally go to the store you purchased from, since they control that data; we will assist the Tenant in responding where required. Residents of jurisdictions with statutory data rights (such as the GDPR or CCPA) may have additional rights, including the right to lodge a complaint with a supervisory authority. Self-serve data export tooling is on our roadmap and not yet available for every data category.

9. International transfers

Data may be processed and stored in a country other than your own. Where required, we rely on appropriate safeguards, such as standard contractual clauses, for cross-border transfers of personal data.

10. Children's privacy

The Service is not directed to children and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact the platform administrators so we can delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted here with an updated effective date and, where required, notified to Tenants in advance. Prior versions remain available for reference.

Questions or requests? Contact the platform administrators.