Privacy Policy

This policy explains what data Storecrafto(“we”, “us”) collects, why we collect it, and how we handle it. It covers both merchants (sellers who create a store on Storecrafto) and shoppers(customers who buy from a merchant's store).

Data we collect from merchants

• Account data: your name, email address, and password (stored as a salted hash — we never see or store your plain-text password).
• Store data: your store name, products, orders, settings, domains, and uploaded images.
• Billing data: your subscription plan, invoices, and billing contact details.
• Payment gateway credentials: if you connect EasyPaisa or PayFast, we store the API credentials you provide, encrypted, solely to process payments on your behalf. We never have access to the funds in those accounts.

Data we process on behalf of merchants

When shoppers buy from a store hosted on Storecrafto, the merchant is the controller of that data and we process it on their behalf. This includes shopper names, email addresses, delivery addresses, order history, and cart contents. Each store's data is kept in its own isolated database schema and is never shared with other stores. We do not sell shopper data or use it for advertising.

Payments

Storecraftodoes not receive, hold, or transmit shoppers' money. Payments are processed by the merchant's own payment providers (EasyPaisa, PayFast, bank transfer, or cash on delivery). Card and wallet details entered at checkout go to those providers directly under their own privacy policies — we receive only payment status and reference identifiers needed to confirm orders.

Third-party services we rely on

• Cloudflare — DNS, SSL certificates, and traffic protection for stores and custom domains.
• SendGrid — transactional email (order confirmations, password resets, invites).
• Cloud storage — hosting of uploaded images and media.

These providers receive only the data needed to perform their function.

Cookies

We use strictly functional cookies and tokens: keeping you logged in to your dashboard, and keeping a shopper's cart attached to their browser session. We do not use third-party advertising or cross-site tracking cookies on this site.

Data retention & deletion

We keep your data while your account is active. If you close your store, we delete your store's schema and media after a short grace period (so accidental closures can be recovered), except for invoice records we are required to keep for accounting. You can export your products, orders, and customers at any time before closing.

Security

All traffic is served over HTTPS. Passwords are hashed, gateway credentials are encrypted at rest, and every store's data is isolated in its own schema. No system is perfectly secure, but if we ever discover a breach affecting your data, we will notify you promptly and tell you exactly what happened.

Your rights

You may request a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it, by emailing [email protected]. Shoppers should direct requests to the merchant they bought from; we will assist the merchant in fulfilling them.

Changes to this policy

If we make material changes, we will update the date at the top of this page and notify merchants by email before the changes take effect.

Contact

Privacy questions: [email protected]