Privacy Policy

Last updated: [DATE] — template, not yet finalized

1. Who we are

StoreLink ("we", "us") operates a platform that lets sellers create online stores and lets buyers purchase from them. This policy explains what personal data we collect, why, and what rights you have over it.

2. What we collect

Account data (sellers): name, email, phone, country, store details, payment/payout information.
Order data (buyers): name, email, phone, delivery address, order contents.
Payment data: processed by our payment gateway partners (Paystack, Flutterwave, Stripe, PayPal, MyroPay, etc.) — we do not store full card numbers.
Verification data (sellers, where required): government ID, proof of address, for identity verification before certain payouts.
Usage data: pages visited, device/browser type, approximate location (derived from IP address), cookies (see our Cookie Policy).

3. Why we collect it

To operate your account and process orders/payments.
To detect and prevent fraud, and to meet identity-verification (KYC) and anti-money-laundering obligations for payouts.
To calculate applicable shipping and tax based on your location.
To communicate order updates, and (with consent, where required) marketing.
To comply with legal and regulatory obligations.

4. Who we share it with

Payment gateways processing your transaction; shipping/logistics partners a seller uses to fulfil an order; our infrastructure providers; and regulators or law enforcement where legally required. We do not sell personal data.

5. International transfers

[TEMPLATE: describe where data is stored/processed and the legal mechanism for any cross-border transfer — e.g. Standard Contractual Clauses for EU data leaving the EEA. This must be filled in accurately for your actual infrastructure before publishing.]

6. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your data, and to object to or restrict certain processing. [TEMPLATE: list the specific regional frameworks that apply — GDPR (EU/UK/EEA), CCPA/CPRA (California), NDPR (Nigeria), POPIA (South Africa), etc. — and how to exercise each.]

7. Data retention

[TEMPLATE: specify how long account, order, and verification data is kept, and the basis for that period — e.g. tax/accounting record requirements often mandate multi-year retention regardless of account closure.]

8. Contact

Questions about this policy: [TEMPLATE: insert a real contact email/address, and a Data Protection Officer contact if one is required for your scale/jurisdiction].