Privacy Policy

Last updated 8 October 2026

What Shoply collects, why, who it reaches, and how long it is kept.

1.Two different relationships

This matters more than anything else on the page, so it comes first.

For merchants. If you open an account and sell here, Shoply decides what happens to your account data. We are the controller of it, and this document describes what we do.
For buyers. If you bought something from a store hosted on Shoply, your details belong to that merchant's relationship with you, not ours. They decide what is collected and why; we hold it on their behalf. Their own privacy policy governs it, and a request to see or delete your data should go to them. We will help them answer it.

2.What we hold

If you have a merchant account

Your email address, and a hash of your password if you set one. We never store the password itself.
If you connected Google, the account identifier Google gives us and the address on it. We do not receive your Google password, and we ask Google for nothing beyond your address.
Your stores and everything in them: products, prices, files, settings, branding.
When you signed up, when you last signed in, and the country you signed up from.

If you bought from a store here

Your email address, so the order can reach you.
The order itself: what was bought, what it cost, which payment method, and whether it was delivered.
A billing address, where the payment method asked for one.
The IP address and browser the order came from, kept against fraud and chargebacks.

If you only visited a store

A count, and little else. Storefront analytics identify a visitor by a random token in the store's own browser storage, or failing that by the address and browser — and either way the token is salted with a key unique to this installation and to that one store, then hashed. Only the hash is stored. It cannot be turned back into an address by anybody, including us, and the same browser at two different stores is two unrelated visitors.

There are no third-party trackers, no advertising pixels and no cross-site profiles.

3.Why we hold it

To run the thing you asked us to run: your account, your store, your orders.
To send what has to be sent — sign-in codes, receipts, licence keys, order alerts.
To keep it standing up: rate limits, abuse reports, error reports and backups.
To show merchants how their store is doing, in aggregate.

We do not sell personal data, and we do not share it for anybody else's advertising.

4.Who else it reaches

Only the providers needed to run the platform, each for one job:

Stripe and NOWPayments — taking payments. Card details go to them directly and never touch our servers.
Resend — sending email.
Cloudflare — serving the sites, and Cloudflare R2 for merchant files.
DeinServerHost — the server everything runs on, in Germany.
Backblaze B2 — encrypted backups.
ip-api — turning an address into a country, for analytics and fraud checks.
Better Stack — uptime monitoring. It sees no personal data.

We will also hand over data where the law requires it. If that ever happens and we are allowed to tell you, we will.

5.How long

Account and store data — while the account is open. Closing it removes the account and its stores.
Orders — kept while the store exists, because a merchant needs their own sales history and buyers need their receipts.
Page-level analytics — 90 days.
Visit records — up to two years, as the hashes described in section 2.
Sign-in codes and rate-limit counters — minutes to hours, then deleted automatically.
Backups — encrypted, and they age out on their own schedule, so a deletion can take a little longer to leave them.

6.Cookies

Shoply sets a session cookie when you sign in, and a short-lived one during a "Continue with Google" sign-in that exists only to check the trip out and back belongs to the same browser. Your theme and a few layout preferences are kept in your own browser's storage and never sent to us. That is all of it; there are no analytics or advertising cookies. The Cookie Policy lists each one, and what a store hosted here keeps in a buyer's browser.

7.Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to the address at the foot of this page. If you bought from a store hosted here, send the request to that merchant first, for the reason in section 1.

8.Changes

We may change this document. The date at the top says when it last changed, and a change that affects you will be emailed before it takes effect.

Questions about this document go to [email protected].