This Privacy Policy explains how Kazi Raihan Ur Rahman (the "Operator", "we", "us", or "our") collects, uses, discloses, and safeguards your information when you use Shopo — the multi-tenant e-commerce website builder and platform accessible at shopo.site and any hosted store on a *.shopo.site subdomain or connected custom domain (together, the "Service").
The Operator, Kazi Raihan Ur Rahman, is an individual based in Bangladesh and is the data controller responsible for your personal information, except where noted below (for example, your own merchant's storefront customer data, which your merchant controls). responsible for your personal information, except where noted below (for example, your own merchant's storefront customer data, which your merchant controls).
1. Who this policy applies to
The Service serves two distinct audiences. This policy addresses both:
- Merchants — store owners, invited editors, and team members who create and manage stores through the Shopo dashboard, and who subscribe to a paid plan billed through Creem.
- Storefront customers — end shoppers who browse, register, and place orders on a merchant's storefront, and whose card payments are processed through Stripe Connect (see Section 13).
2. Information we collect
2.1 Information you provide directly
- Account information — full name, email address, phone number (optional), and physical address (optional). You authenticate through Clerk, our authentication provider, which may also collect credentials, one-time passcodes, and OAuth data (for example, when you sign in with Google).
- Store data (merchants) — store name, subdomain and/or custom domain, store logo and branding, product descriptions and images, categories, footer text, blog and page content, theme configuration, and team-member invitations.
- Customer information (storefront) — name, email, phone, shipping address, and order details that you submit when you register or check out on a merchant's store.
- Support communications — the content of any emails or messages you send us when you request help.
2.2 Billing information
For the Shopo Pro subscription ($15 USD/month), checkout and payment are handled by Creem, our Merchant of Record. We receive limited transaction metadata (such as plan, status, renewal date, and subscription identifier) but Creem processes and stores your card and payment details — we never see or store your full card number.
You are always in control of your subscription: you can view your plan and cancel your subscription at any time directly from the Billings page in your dashboard (/dashboard/billings), or via the Creem Customer Portal. Cancellation takes effect at the end of your current billing period, and we do not make it hard to find or leave the service.
2.3 Storefront payment information
When you pay for an order on a merchant's storefront, your card is charged through Stripe directly to that merchant's connected account. Shopo does not receive, hold, or store your card number; we retain only the order record and limited payment status returned by Stripe.
2.4 Usage and technical data
- Device type, browser, operating system, IP address, and referrer.
- Pages visited, session timing, and feature usage.
- Cookies and similar technologies (see Section 10).
This information is collected through our hosting provider (Vercel) and Vercel Analytics, and through the in-product visitor analytics we provide to each merchant.
3. How we use your information
- To provide, host, maintain, and secure the Service and your store.
- To create and administer accounts, authenticate you, and manage store membership and invitations.
- To process the Pro subscription through Creem and to enforce plan limits (Free stores are limited to 10 products; Pro stores are unlimited).
- To process storefront orders and send transactional and order emails.
- To monitor and improve the Service, investigate abuse and fraud, and ensure legal and regulatory compliance.
- To communicate with you about your account, billing, and important changes.
4. Legal bases for processing
We process your personal information on the following bases:
- Contract — to deliver the Service you requested under our Terms of Service.
- Consent — where you affirmatively agree (for example, optional marketing communications or certain cookies).
- Legitimate interests — to operate securely, prevent fraud and abuse, and improve the Service.
- Legal obligation — to meet record-keeping, tax, and other legal requirements.
5. Third-party processors
We rely on trusted third parties to operate the Service. Each is a separate controller or processor of the data you share with them, subject to their own privacy policies:
- Clerk — authentication, identity, sessions, and sign-in (including Google OAuth).
- Creem — Merchant of Record for the Shopo Pro subscription; processes payment and handles VAT/GST/sales tax and chargebacks for that subscription.
- Stripe — processes storefront customer card payments directly to each merchant's connected account.
- Amazon Web Services (S3) — stores product images and uploaded assets.
- Neon (PostgreSQL) — hosts our primary application database.
- Vercel — hosts the application and provides usage analytics.
- Transactional email (via SMTP/nodemailer) — delivers order confirmations, invitations, and account emails.
- AliExpress — an optional merchant integration for product import; only used if a merchant connects it.
6. How we share information
- With the processors listed above, strictly to operate the Service and only under agreements that require confidentiality and lawful use.
- Within your store — store admins can see invited editors and their activity, and merchants can view the customers and orders of their own store.
- With payment providers — the minimum data required to complete and reconcile payments.
- To protect rights, safety, and property; to investigate fraud or violations of our Terms of Service; and where required by law, court order, or legitimate government request.
- In connection with a merger, acquisition, or sale of all or part of our business, subject to confidentiality.
We do not sell your personal information.
7. Data retention and deletion
We keep your information for as long as your account is active and for as long as needed to provide the Service, meet legal obligations, resolve disputes, and enforce our agreements. When a store is deleted, its products, categories, orders, pages, and related data are removed from our database. We retain limited billing and tax records for as long as required by law, even after account closure.
8. Data security
We use reasonable technical and organizational measures — encrypted databases, secure file storage, HTTPS in transit, scoped access controls, and audited authentication — to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. International data transfers
The Operator is based in Bangladesh, but our processors operate globally. Your information may be processed and stored outside of Bangladesh — for example in Singapore (AWS), the United States (Neon, Vercel, Clerk), the European Union, or other regions where Stripe and Creem operate. By using the Service, you acknowledge and consent to these transfers.
10. Cookies and tracking technologies
We and our providers use cookies and similar technologies to keep you signed in, remember preferences, measure traffic, and understand how the Service is used. You can control cookies through your browser settings; disabling them may affect some features.
11. Your privacy rights
Subject to applicable law, you may have the right to access, correct, delete, export, restrict, or object to the processing of your personal information, and to withdraw consent where we rely on it. To exercise any right, contact us at raihan@shopo.site. We will respond within a reasonable timeframe and may verify your identity before acting.
12. Children's privacy
The Service is not intended for individuals under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will take steps to delete it.
13. Storefront customers — important note
When you shop on a merchant's storefront, that merchant is the controller of your order and customer information (name, contact, shipping, and order details) and is responsible for fulfilling your order, honoring their own return and refund policy, and handling customer-service requests. Shopo acts as the technology provider that hosts the store and processes the payment on the merchant's behalf through Stripe. Card details are handled by Stripe, not by Shopo.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date above and, for material changes, provide notice through the Service or by email. Your continued use of the Service after a change takes effect means you accept the updated policy.
15. Contact us
If you have any questions or requests regarding this Privacy Policy or your personal information, contact the Operator at raihan@shopo.site.