Skip to content
Log in Open my dashboard
You’re signed in Open my dashboard

Updated

Privacy Policy

This policy explains what information Storelala (“we”, “us”) collects, why, and what we do with it. It covers sellers who run a store on Storelala, shoppers who order from those stores, and anyone who visits storelala.com or contacts us.

Who is responsible

For sellers’ accounts and for our own website, Storelala is responsible for your information. For shoppers, the store you order from is the seller: it decides how your order details are used, and Storelala stores and processes them for that store so it can take and deliver your order.

What we collect from sellers

  • Your Google account’s name, email address and profile photo link, when you sign in with Google. We never see your Google password.
  • Your email address and password, when you sign in with email. We keep only a salted scrypt hash of your password, never the password itself, and we can’t read it. We email you one-time codes and password reset links; a code works for 15 minutes and a reset link for 1 hour, once.
  • Your store’s content: store name and address, logo, banner, products, photos, prices, delivery settings, and the WhatsApp number and Instagram username you add.
  • A history of changes to your products, prices, stock, categories and store settings: what changed, when, from which account, and in which browser session. We keep it for 13 months.
  • A record of your sign-in attempts: your email address, when you tried, whether it worked (including codes and reset links sent and passwords changed), your IP address, your browser’s headers and facts about your device. We keep it for 12 months.
  • Messages you send to our WhatsApp support number, and their delivery status: we keep the message, your phone number, the name on your WhatsApp profile and details of any attachment (its type, id and any file details WhatsApp sends) for 13 months, to answer you and to improve Storelala. If your number matches a seller account we link them; we keep messages from people without an account too. We also record an analytics event for each message, with no message text and no phone number.
  • When you set up a store and add products, we record your IP address and your browser’s headers with them, to keep accounts safe and to see how Storelala is used.

What we collect for stores about shoppers

When a shopper orders from a store on Storelala, we store what they enter at checkout, such as their name, phone number, email address if they give one, and delivery address, together with the order itself. The store uses these details to confirm and deliver the order.

The cart and anything typed at checkout are stored on our servers with the store’s data, even when no order is placed. The store’s site keeps only a cart number in a cookie, so the cart survives a page reload.

With each order we also record the IP address and browser headers of the device it was placed from, on our servers only, so the store and we can spot fake orders and fraud. Shoppers are not tracked by our analytics.

For each store we count, per day, visits, product views, add-to-carts, orders and how fast pages load. These counts keep nothing about any shopper: no cookies, no IP address, nothing that could tell one shopper from another.

So a store can see how it is doing, we also keep one record per visitor per day: when they first and last opened the store that day, how many pages they opened, their approximate city, region and country, and where that city sits on a map, rounded to about 10 km (all worked out from the IP address by Cloudflare), how they found the store (the site they came from, the link’s source tag or the app they opened it in), whether they used a phone, tablet or computer, and whether they added to cart or ordered. We don’t keep the IP address and set no cookie for this. We tell visitors apart for one day only, with a code made from the IP address and browser details and a secret that changes every day and is deleted after four days, so a shopper’s visits on different days can’t be linked. The store sees counts by day, place and source, and the cities people are browsing from right now, but never an IP address or anything that says who a visitor is. We keep these records for 25 months.

To leave a seller’s own visits out of their store’s numbers, when they use the store admin we keep a code made from their IP address and browser details for three days (a handful of codes at most), and skip store visits that match it.

We don’t sell shopper information, and we don’t use it to advertise to shoppers or to contact them ourselves.

Sellers are responsible for their shoppers’ information

If you run a store, you are responsible for how you use your shoppers’ details. Use them only to handle their orders and to reply to them, share them only with your courier for delivery, keep them safe, and don’t add shoppers to marketing lists without their permission.

Visitors and our contact form

  • Our contact form sends your name, email address, business name and message to our own server, and we use them to reply to you. If you tick the box for news, we also send you occasional Storelala news; ask us any time to stop.
  • Like every website, our servers and Cloudflare receive basic technical data such as your IP address and browser, which we use to deliver the site and to stop abuse, for example by limiting how often sign-in can be tried and how many new stores one internet connection can make in a day.
  • We also keep our own record of each page of our website that is opened: the time, the page, the link that brought you there, your IP address, your browser’s request headers, how your connection is secured and how quickly it answers, and the analytics ID described below, and the device key described under cookies. We keep this record even if you turn analytics off, because it is how our website keeps itself working and safe.
  • Some store looks use fonts from Google Fonts, on the stores and in the previews of them on our website and in the store admin, so your browser asks Google for them, which gives Google your IP address and browser details.
  • We don’t use advertising cookies. The store admin uses one cookie to keep you signed in, each store uses one for the shopper’s cart, and our website and the store admin use one for analytics (below).
  • On www.storelala.com we also set a random device key in a cookie that scripts on the page cannot read. It lets us see that the same browser was used across sign-outs and accounts. We set it whether or not you have turned analytics off, because we use it for security and to stop abuse, not for analytics. We store it with each page record above and with the request facts we keep for orders, products and claims. It lasts up to 400 days, is refreshed every 30 days you visit, and is never set on stores.

Job applications

  • When you apply for a role on our careers pages, we receive your email address and your CV and share them only with the people hiring, to consider you for the role and to reply to you.
  • If you ask to be told when buying a domain opens, we record the name you picked, your store, the time, and technical details of the device you used: your IP address, browser, language and screen. We use them to tell you when it is ready and to see how much people want it.
  • If you ask to be told when you can move to a bigger plan, we record your plan, how many stores you have, the time, and technical details of the device you used: your IP address, browser, language and screen. We use them to tell you when it is ready and to see how much people want it.
  • With each application we also record technical details: your IP address, your device, browser and language, the page and link that brought you, and how you used the form. We use them to keep the form free of spam and abuse and to understand how people find our roles.
  • We keep applications only as long as we need them for hiring, and may contact you about future roles. Ask us any time to delete yours.

Feedback

  • When you send us feedback from our website, the store admin or the community, we receive your message, and your email address and a screenshot if you add them. If you are signed in to the store admin, we also see your account email and your store. We read it to fix problems and improve Storelala, and to reply to you if you gave us a way to.
  • With each message we also record what helps us see the problem: the page you were on, the recent errors and failed requests on that page, your IP address, your device, browser and language, your connection, and how you used the form. For feedback sent from the website or the store admin, we also keep a link to the recording of your visit; the community has no recordings. We keep your feedback only as long as we need it to improve the product. Ask us any time to delete yours.

Emails we send

  • The emails we send from storelala.com record when they are opened and which links in them are clicked, so we know our messages arrive and which ones help.
  • Along with that we record technical details of the device that opened them: its IP address (from which an approximate location can be worked out), and its device, browser and language. We link them to the email address the message was sent to. For the reply to a job application, we also link them to your visits to our website.
  • We record whether each email we send arrived, along with the address it went to, whether it was delayed or bounced, with the reply your mail service gave, and the reports other mail services send us about mail that says it comes from storelala.com.

How we learn what to improve

To see what works on Storelala and what to fix, we use PostHog, an analytics service, on our website, in the store admin and in our community. It isn’t used on the stores themselves, so shoppers aren’t tracked. Your browser sends it to our own address on storelala.com, and we pass it on to PostHog without your cookies. We also keep our own copy of the same events and recordings on our servers, for 13 months. Each event is stored with the IP address it came from and the approximate location and network worked out from it, and we keep copies of the events our servers record about your account too.

  • It records how our website, the store admin and the community are used: the pages you open, what you tap or click, how far you scroll, how fast pages load, errors, your device, browser and screen size, and the page or ad that sent you.
  • It also records the screen on our website and in the store admin, not in the community, once the page has finished loading, so we can see how the visit went, like a video. What you type into boxes is recorded too, except passwords, one-time codes, card numbers and text or boxes we mark private, such as two-step sign-in keys and recovery codes. In the store admin, recording pauses on the order and customer screens, and shoppers’ names, phone numbers and addresses are hidden.
  • In the store builder we also note what you type into “I want to sell”, the look you pick, the steps you reach, how many photos you add, and the price and sizes you set. Our events keep only how long your store’s name and address are, but a recording shows what you type and the preview of your store, so it shows them. It doesn’t include your photos.
  • When something breaks, in your browser or on our servers, we record the error with the page or request it happened on, and your account and store if you are signed in. Requests the store admin makes to our servers carry the ID of your visit, so we can line up what you did with what our servers did.
  • Our servers also keep their own record of requests to our API. When you visit our website and use the builder, sign up or sign in, or use the store admin, a request carries which part of our API it asked for, when, how long it took, whether it worked, your account, your IP address, the approximate city, region and country Cloudflare works out from it, and your browser. For a seller we also keep each IP address they have used, with its approximate place and when it was last seen, so we can keep accounts safe and help with support. We keep it for 13 months. For shoppers’ requests to a store, and for opens and taps on our emails, we keep only which part of the API, which store, the timing and the result, and for failures a short error with personal details removed, with nothing that identifies the shopper.
  • Now and then we ask one optional question, such as what stopped you when you leave the store builder without saving. Your answer is kept with your visit.
  • PostHog gives your browser a random ID, kept in a cookie and in your browser’s storage, so it can tell one visit from the next. If you open our page in another browser from the builder (for example from Instagram’s browser into Chrome), the link carries this ID so we can tell it is the same visit. When you sign in, we connect your visits to your account, with your name, email address and store.
  • We also record details of your device and connection: its model, the version of its system and browser, its memory and processor cores, its screen and whether it has a touch screen, your language and display settings (dark mode, reduced motion, installed-app mode), how it is connected and how fast, your internet provider and network details (which Cloudflare, who runs our website, tells us), and your approximate location.
  • When you switch away from or leave a page, we also record how it went: how long the tab was hidden, whether your connection dropped or changed, which control was slow to respond (its tag, id or class, never its text) and the names of the script files that held the page up, how much storage your browser has left, whether the on-screen keyboard covered the field you were typing in, the number, size and type of photos you picked and how long choosing and uploading them took, and when you paste into a field, its name, how many lines you pasted and whether it looked like formatted text (never the text itself). If you leave the store builder or Add product unsaved, we note which fields were filled in and how many photos, never what they held. Passwords, codes and card fields are never read. We also note whether your browser says it is automated, to count bots.
  • PostHog receives your IP address, which it uses to estimate your country and city, and we keep it with your visits.
  • On our home page we also record, in our own database, which looks were shown to you, how long you looked at each one, and which you chose, together with your IP address and your browser’s request headers. This is linked to a cookie of ours called sl_vid, kept for one year, which also keeps your set of looks the same through the day. We use it to choose which looks to show visitors.
  • We use this to improve Storelala, including by showing some visitors one version of a page and others another to see which works better. We don’t use it for advertising and we don’t sell it.

You can turn analytics off in this browser:

How we use information

  • To run your store and show it to shoppers.
  • To sign you in and keep accounts and stores secure and separate from each other.
  • To prevent abuse, fraud and spam, including the daily limit on new stores.
  • To reply when you contact us, and to tell sellers about important changes to Storelala.
  • To meet our legal obligations.

Who we share it with

We share information only with the services that run Storelala, and only what they need:

  • Cloudflare delivers our website and every store and protects them from attacks. Traffic passes through Cloudflare’s network, which may be outside Pakistan.
  • Our hosting provider in Germany runs the servers that hold our database, the photos sellers upload and the messages sent through our contact form.
  • Google provides Google sign-in, and the fonts some store looks load from Google Fonts.
  • PostHog runs our analytics and the recordings described above. Its servers are in the United States.

We also share information when Pakistani law requires it, for example in response to a valid legal request. If Storelala is ever sold or merged, this information would move to the new owner under this policy.

How long we keep it

  • Seller accounts and store content, while your store is active. When you delete your account from the Account page in your dashboard, your stores go offline at once and, seven days later, we delete them with their products, photos, orders and your account. Until then you can tap “Keep my account” to bring everything back. Store addresses are retired: they stop working and are never given to anyone else. Backup copies are removed as backups are replaced. Feedback you sent us stays. We may keep a limited record where the law requires it, or to deal with a dispute or an abuse report.
  • Orders and shopper details, while the store exists, so the seller can see their order history. A seller can ask us to delete orders sooner.
  • Carts and checkout details that never became an order, while the store exists.
  • Sign-in attempts, 12 months. The note that you signed up stays while your account exists. If you never got a store (for example, on a day new stores were full), it is deleted 12 months after your last try, or sooner if you ask.
  • Contact form messages, as long as we need them to reply and follow up.
  • Server logs, up to 30 days.
  • Our own record of website pages opened, of requests to our API, and of whether our emails arrived, up to 13 months.
  • The history of changes to your products, prices, stock, categories and store settings, up to 13 months.
  • Messages you send to our WhatsApp support number, and their delivery status, 13 months.
  • The IP address and headers recorded with orders, products and a new store, while the store exists.
  • Daily counts of visits, product views, add-to-carts, checkout starts, orders, bot visits and page speed for each store, 25 months.
  • Analytics at PostHog: screen recordings for 30 days, everything else for up to 1 year.
  • Our own copy of the same events and recordings, with the IP address and approximate location of each event, and of the events our servers record, 13 months.

How we protect it

Every page is served over HTTPS. Each store’s data is kept separate from every other store’s in our database, so one store can’t see another’s products, orders or shoppers. Our servers sit behind Cloudflare and are not directly reachable from the internet, and sign-in attempts are limited. No system is perfectly secure; if we learn of a breach that affects your information, we will tell you.

Your choices

  • Sellers can see and change their store’s information in the store admin at any time.
  • You can turn analytics off in each browser you use, above. It stays off in that browser until you turn it back on.
  • You can delete your account and stores from the Account page in your dashboard, and ask for a copy of your products, photos, orders and customers as a zip. After you delete, you have seven days to tap “Keep my account”, or to download your copy if you asked for one. If you can’t sign in, or want something corrected, contact us from the email address you sign in with. Before we change or delete anything, we reply to that address to confirm the request came from you.
  • Shoppers who want to see, correct or delete their order details should first contact the store they ordered from. If you can’t reach the store, contact us and we will help.

Children

Storelala is for adults running a business. Sellers must be 18 or older.

Changes to this policy

We will update this policy when what we do changes, and change the date at the top. For important changes, we will tell sellers in advance.

Contact

Questions about your information or this policy? Get in touch and we will help. Our Terms of Service cover how you may use Storelala.