Privacy Policy

This policy explains what data Storecrafto (“we”, “us”) collects, why we collect it, and how we handle it. It covers both merchants (sellers who create a store on Storecrafto) and shoppers (customers who buy from a merchant's store).

Data we collect from merchants

• Account data: your name, email address, mobile number and password (stored as a salted hash — we never see or store your plain-text password), your two-factor settings, the date and version of the Terms of Service you accepted, and the devices signed in to your account (browser, IP address, sign-in and last-used times).
• Store data: your store name, products, orders, settings, domains, and uploaded images.
• Usage and support data: a record of each AI tool you run (what was requested, when, and what it cost — never the text or images themselves), your store's setup milestones, your conversations with our support team, and the log our systems keep of operator actions on your account.
• Billing data: your subscription plan, invoices, and billing contact details.
• Payment gateway credentials: if you connect EasyPaisa or PayFast, we store the API credentials you provide, encrypted, solely to process payments on your behalf. We never have access to the funds in those accounts.

Data we process on behalf of merchants

When shoppers buy from a store hosted on Storecrafto, the merchant is the controller of that data and we process it on their behalf. This includes shopper names, email addresses, delivery addresses, order history, and cart contents. Each store's data is kept in its own isolated database schema and is never shared with other stores. We do not sell shopper data or use it for advertising.

How we access your account

To run the platform we have administrative access to every store on it, and our Terms of Service set out when we use it. In practice that means our operators can open your dashboard, view your store's settings, content, orders and customer records, and change or disable them when that is needed to support you, to keep the platform secure, to prevent fraud and abuse, to handle a complaint or a legal request, or to enforce the Terms. Every operator sign-in to a store and every lock, suspension or deletion is recorded in an audit log that we keep after the account closes. We also monitor the use of the Service — including the emails and WhatsApp messages sent through it and your conversations with our support team — to detect abuse and keep the service working. We never use this access to sell your data or to compete with you.

Payments

Storecrafto does not receive, hold, or transmit shoppers' money. Payments are processed by the merchant's own payment providers (EasyPaisa, PayFast, bank transfer, or cash on delivery). Card and wallet details entered at checkout go to those providers directly under their own privacy policies — we receive only payment status and reference identifiers needed to confirm orders.

Third-party services we rely on

• Cloudflare — DNS, SSL certificates and traffic protection for stores and custom domains.
• Amazon Web Services (SES) — transactional email (order confirmations, verification codes, password resets, invites, invoices).
• An SMS gateway in Pakistan — the verification codes and password-reset messages we text to merchants.
• Cloud storage and hosting providers — the servers that run the platform and host uploaded images and media. They may be located outside Pakistan; wherever they are, the protections in this policy apply.
• AI providers (OpenAI, Anthropic and image-generation providers) — the prompts, product text and images you submit to our AI tools are sent to the provider to produce the result and are not used by us to train models.
• Meta Platforms — the Meta Pixel on our marketing pages and sign-up flow, used to measure our own advertising and to show our adverts to people who have visited storecrafto.com; and the WhatsApp messages your store sends to shoppers through the Service (order updates and reminders) are delivered from our platform number through Meta's WhatsApp Business API. When you sign up on the web we also send Meta a server-side confirmation of the signup — your email, phone and name hashed, with your IP address, browser details and the plan you chose — so our adverts are measured correctly; signups from the Android app are never sent. Meta's privacy policy.
• Payment gateways and couriers you connect — receive the order details needed to take a payment or book a shipment.

These providers receive only the data needed to perform their function.

Cookies

Most of what we set is strictly functional: keeping you logged in to your dashboard, and keeping a shopper's cart attached to their browser session.

On our own marketing pages and sign-up flow we also run the Meta Pixel, which sets measurement cookies (_fbp, _fbc) so we can tell which of our adverts brought a merchant to us and to reach those visitors again on Instagram and Facebook. Those are the only advertising cookies we set, and they are about our marketing, not yours. Shoppers browsing a merchant's storefront are unaffected — a store only carries advertising cookies if that merchant connects their own ad accounts, under their own cookie notice.

Data retention & deletion

We keep your data while your account is active. If you close your store, or we terminate it, we delete your store's schema and media after a short grace period (so an accidental closure can be recovered). We keep the billing records we are required to retain for accounting, the audit log of operator actions on the account, and your conversations with our support team. You can export your products from the dashboard at any time, and ask us for a copy of your orders and customer data before closing.

Security

All traffic is served over HTTPS. Passwords are hashed, gateway credentials are encrypted at rest, and every store's data is isolated in its own schema. No system is perfectly secure, but if we ever discover a breach affecting your data, we will notify you promptly and tell you exactly what happened.

Your rights

You may request a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it, by emailing support@storecrafto.com. Shoppers should direct requests to the merchant they bought from; we will assist the merchant in fulfilling them. Store owners can also request deletion of their account and store.

Changes to this policy

If we make material changes, we will update the date at the top of this page and notify merchants by email before the changes take effect.

Contact

Privacy questions: support@storecrafto.com