Privacy Policy

Who we are

Crawlog LLC, 30 N Gould Street, Sheridan, WY 82801, USA, runs Storeware. Write to hi@storeware.ai about anything in this policy.

Two different roles

Storeware handles personal data in two capacities, and they carry different duties.

For merchants, and for people who visit storeware.ai, we are the controller. We decide what data we need to run the platform and bill for it, and this policy describes it.

For a merchant’s customers, the merchant is the controller and we are their processor. We hold shopper data on their instructions. The Data Processing Addendum governs that, and a shopper asking about their data should ask the shop they bought from.

What we hold about merchants

Your email address and name, your organisation and the people you invite into it.

What Stripe needs to verify you and your business so your shop can take payments, which may include your legal name, date of birth, address, tax number, the last digits of a government identity number, and your bank details. We pass it to Stripe and keep only what we need to show you the state of your payments account.

Your shop configuration: what you sell, how you price it, where you ship, and what your shop looks like.

Billing records. Card details go to Stripe and we never see or store them; we keep the customer reference, the plan and the invoice history.

Operational logs: requests, errors, the device and network address a request came from, and the model calls your shop made, which is also how usage limits are enforced.

What we hold on a merchant’s behalf

Orders and their contents, the buyer’s name, email address, delivery and billing address, and any phone number given at checkout.

Questions shoppers asked the shop assistant, and the answers it gave, so a merchant can see what their shop is being asked and where it answered badly.

Where a shopper has chosen to be remembered, the preferences they gave. They can clear that themselves from their account on the shop.

How fast a shop’s pages were for the people who visited them, as daily totals by kind of page and by phone or computer. Each visit’s report is added into those totals and discarded. No address, identifier, page address or time of visit is kept.

We do not receive card numbers. They go from the shopper’s browser to Stripe.

Why we are allowed to

To perform the contract with you, which covers running your shop and billing you.

Our legitimate interests in keeping the platform secure, preventing fraud and abuse, and improving it, weighed against your rights.

Consent, where you have given it, for marketing email. You can withdraw it at any time and every message carries a link that does so.

Legal obligation, for identity checks, tax and accounting records, and answering lawful requests from authorities.

Who else sees it

Stripe, for payments, for verifying merchants, and for our own subscription billing.

Supabase, which hosts the database, in the United States.

Cloudflare, which serves every request, checks that a person is signing in, stores uploaded images and files, and runs the model that turns pages into text for shopping agents.

Pinecone, which holds the search index for your catalogue, in the United States.

OpenAI, which runs the models behind catalogue writing and the shop assistant. Prompts contain product and question text. We do not send them payment details.

OpenRouter, which routes the model that judges whether a product answers a search and how products relate. Prompts contain product and question text.

Modal, which runs the model that ranks search results, in the United States. It receives the search and the product text it ranks.

Resend, which delivers email.

Shippo, which quotes and buys postage for shops that have switched postage on. It receives the delivery address and the name on it, and the phone number and email address where the order has them.

Professional advisers, a buyer of our business, and authorities where the law requires it or to protect people, the platform or our rights.

We do not sell personal data, and we do not share it for cross context behavioural advertising.

Where it goes

Data is processed in the United States and, for requests served at the edge, in the region nearest the person making the request.

Transfers out of the United Kingdom and the European Economic Area rely on the standard contractual clauses, which our processors have entered into.

How we protect it

Encryption in transit and at rest, each merchant’s data kept apart by rules in the database itself, stored third party credentials encrypted, daily backups, and access limited to the people who need it. No system is perfectly secure, and if a breach affects you we will tell you as the law requires.

How long we keep it

Account data for as long as the account is open, and 30 days after it closes, except what the law requires us to keep longer.

Order records for as long as the merchant needs them for tax and accounting, which is commonly six or seven years depending on where they trade.

Billing and verification records for as long as tax, accounting and anti money laundering law requires.

Operational logs for a rolling short window, currently measured in days rather than months.

What you can ask for

A copy of your data, correction of anything wrong, deletion, a machine readable export, and an objection to processing we base on legitimate interests.

Ask at hi@storeware.ai and we will answer within 30 days, or sooner where the law requires. We may need to confirm it is you before we act.

If you are a shopper rather than a merchant, ask the shop you bought from. They hold the decision and we act on their instruction.

You may also complain to your data protection authority. In the United Kingdom that is the Information Commissioner’s Office.

Your rights in US states

If you live in California or another US state with a privacy law, you have the right to know what personal data we hold about you and how we use it, to correct it, to delete it, and to opt out of its sale or sharing. We do not sell or share it, so there is nothing to opt out of.

We will not treat you differently for using these rights. You may ask through someone you authorise, and if we refuse a request you may ask us to reconsider. We answer within 45 days.

Shops on Storeware honour Global Privacy Control.

Children

The platform is for businesses and is not directed at children. We do not knowingly collect data from anyone under 16, and we delete it if we learn we have.

Changes

We will post any change here with a new date, and email merchants about a material one before it applies.

Contact

Crawlog LLC, 30 N Gould Street, Sheridan, WY 82801, USA. Privacy questions go to hi@storeware.ai.