Legal

Privacy Policy

Effective date: September 2, 2026 · Last updated: September 2, 2026

This policy explains what personal data StoreToNative collects, why, and what rights you have over it. It covers our website at storetonative.com, our console at app.storetonative.com, and the mobile apps we build for merchants.

We are StoreToNative LLC, a New Mexico limited liability company. Contact us at support@storetonative.com.

1. Two different roles — please read this first

We handle two kinds of personal data, under two different legal roles. The distinction determines who you contact about your rights.

When you are a merchant using StoreToNative, we are the controller. We decide how and why your account data is processed. Section 2 applies.

When you are a shopper using an app built with StoreToNative, the merchant is the controller and we are their processor. We hold and transmit your data on the merchant's behalf and act on their instructions. Section 3 applies. Direct your privacy requests to the merchant whose app you are using — we will support them in responding, but the decision is theirs.

2. Merchant data — where we are the controller

2.1 What we collect

Data	Why we hold it	Legal basis (GDPR)
Name and email address	To create and identify your account, and to contact you	Performance of a contract
Password	To secure your account. Stored as a salted hash — never in plain text, and never recoverable by us	Performance of a contract
Store connection credentials	To read your catalogue and receive order events. Encrypted at rest	Performance of a contract
Store URL and configuration	To build and operate your app	Performance of a contract
Billing details	To take payment and meet tax and accounting obligations. Full card numbers are held by our payment processor, not by us	Contract; legal obligation
Support messages	To answer your questions and improve support	Legitimate interests
Server and access logs, including IP address	Security, abuse prevention, debugging	Legitimate interests
Product usage analytics	To understand which features are used and improve them	Legitimate interests

2.2 What we do not do

We do not sell your personal data. We do not share it with advertisers. We do not use your store data to compete with you, to build a competing product, or to contact your customers for our own purposes.

2.3 Marketing

We may email you about your account, billing, security and material service changes — you cannot opt out of these, because they are necessary to the contract.

We will only send you marketing email with your consent, and every marketing email has a one-click unsubscribe.

3. Shopper data — where we are a processor

When a shopper uses an app we built for a merchant, we may handle:

Push notification tokens — only where the shopper has granted notification permission on their device, and used only to deliver order updates, abandoned-cart reminders and review prompts that the merchant has configured;
Order references and order contents — to display order status and history in the app;
Names and delivery or billing addresses — where the app's native address step is enabled by the merchant;
Account identifiers — where a shopper signs in to their store account through the app;
App usage analytics — screens viewed, features used, and crash diagnostics.

Payment card details are never handled by StoreToNative. Checkout runs through the merchant's own payment gateway.

We process this data only to provide the app to the merchant. We do not sell it, do not use it for our own marketing, and do not combine it across merchants to build profiles of individuals.

4. Where your data is held

Our primary infrastructure is hosted with Hostinger, in a data centre located in Paris, France (European Union).

Where personal data is transferred outside the EEA or UK — for example to a sub-processor, or to our own personnel in the course of support — we rely on an appropriate safeguard, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable.

5. Who else processes data for us

Sub-processor	Purpose	Location
Hostinger	Application and database hosting	Paris, France (EU)
Hostinger Email	Transactional and support email (SMTP)	EU
Stripe	Payment processing and subscription billing	USA / global
Apple, Google	App distribution and push notification delivery (APNs, Firebase Cloud Messaging)	USA / global
Umami (self-hosted)	Website and product usage analytics — runs on our own infrastructure, not a third-party service	Paris, France (EU)

We require every sub-processor to protect personal data to a standard consistent with this policy.

6. How long we keep things

Data	Retention
Account data	For as long as your account is open
Account data after closure	Deleted within 90 days, except where we must keep it by law
Build artifacts and app configuration	90 days after a subscription lapses, then permanently deleted
Billing and tax records	7 years, as required by US tax law
Server logs	90 days
Support correspondence	2 years from the last message
Shopper data	For as long as the merchant's account is active, then per the merchant's instruction

7. Security

We take security seriously and apply measures appropriate to the risk, including:

encryption in transit (HTTPS/TLS) for all connections;
encryption at rest for store connection credentials;
password hashing with a salt — we cannot read or recover your password;
access controls limiting who can reach production data;
regular patching of our infrastructure and dependencies.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority within the timeframes required by law.

8. Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you;
correct data that is inaccurate or incomplete;
delete your data ("right to erasure");
restrict or object to processing, including profiling;
portability — receive your data in a structured, machine-readable format;
withdraw consent at any time, where processing is based on consent;
not be discriminated against for exercising these rights.

If you are in the EU or UK, these rights come from the GDPR and UK GDPR, and you have the right to lodge a complaint with your national supervisory authority.

If you are in California, the CCPA/CPRA gives you rights to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined under the CCPA.

To exercise any right, email support@storetonative.com. We will respond within30 days. We may need to verify your identity first.

Shoppers: please contact the merchant whose app you used. They are the controller of your data.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Cookies and similar technologies

Our website and console use cookies that are strictly necessary to sign you in, keep your session secure, and remember your preferences. These do not require consent.

Our website analytics are self-hosted and cookieless — they do not set cookies or track you across other websites. Where we use any non-essential cookies in future, we will ask for your consent first and you can withdraw it at any time.

Our mobile apps do not use cookies, but do use device identifiers for push notifications and analytics as described in section 3.

11. Changes to this policy

We may update this policy. For material changes we will notify you by email or in the consoleat least 30 days before they take effect, and we will update the date at the top of this page.

12. Contact

StoreToNative LLC
1209 Mountain Road Pl NE, Ste N
Albuquerque, NM 87110, USA
+1 (505) 926-5550
support@storetonative.com

For data protection questions, use the same email address and mark your message "Privacy".