Privacy policy

Merchants and staff

• Your account: name, email address and password (stored only as a one-way hash). If you turn on two-step authentication, its secret. If you sign in with Google, your Google account's id and email.
• Your stores: everything you add to run them, such as products, photos, prices, settings, staff and their permissions.
• Plans and billing: when a store pays for a plan, card payments are handled by Stripe. We never see or store full card numbers.

The mobile app

• Signed-in phones: the phone's model name, its system (Android or iOS), the app version and the first part of its network address. You see this list under Account → Security, where you can sign any phone out.
• Sign-in: the app keeps its sign-in token in the phone's secure storage (Android Keystore or iOS Keychain).
• Notifications: if you turn them on, the phone's Firebase Cloud Messaging token, so we can send them. Notifications never show a customer's name, email or address on the lock screen. We keep notification records for 7 days.
• Camera and photos: used only when you take or choose a product photo, or scan a barcode. Barcodes are read on the phone. Photos are uploaded only when you add them to a product.
• App lock: fingerprint and face checks are done by your phone. We never receive biometric data.
• The app has no advertising and doesn't track you across other apps or websites.

Shoppers in our merchants' stores

When someone shops in a store on Shopix, the store's owner decides what is collected, such as orders, contact and delivery details. We hold that data on the merchant's behalf to run their store, and only their staff can see it. Shoppers with questions about their data should contact the store first.

Storefront visit statistics need no cookies. We don't store visitors' network addresses. Visits are counted with a key that changes every day, and the country is estimated from the browser's time zone.

Who else handles data

We share data only with services needed to run Shopix, and only what each one needs:

• an email delivery service, for account and order emails;
• Stripe, for payments;
• Google, if you choose to sign in with Google;
• Google's Firebase Cloud Messaging, to deliver app notifications.

We don't sell personal data.

Security

Connections use HTTPS. Each store's data is separated at the database level, not only in the app. Passwords are stored only as one-way hashes, and access to stores is checked on every request, from the website and from the app.

Your choices

• Change your account details and security settings in Account on the website.
• Sign out phones from the app or the website. Turn notifications off per phone or per kind.
• To delete your account, follow how to delete your account. For a copy of your data, contact us at the address below.

Contact

Questions about this policy or your data: contact us by replying to any email we've sent you.