Shop privacy policy template
Draft for legal review, version 2026-10-05-draft. Not in effect. A starting point for store owners, not legal advice. Copy it into your shop, replace everything in [square brackets], delete what doesn't apply, and have it checked for your country and the way you sell.
Privacy Policy
Last updated: [date]
[Shop name] ("we") runs this shop at [shop address]. This policy explains what we collect when you visit or buy, and what we do with it. We are the controller of your data. Contact us at [email] [and postal address].
What we collect
- When you order or book: your name, email, phone, delivery and billing addresses, what you bought or booked, and any notes or messages you send.
- If you create an account: your email and sign-in details, saved addresses and order history.
- If you sign in with Google or Facebook: the name and email address they share. For Facebook we also keep an account number it gives our shop software, so you can sign in again without a code. Google and Facebook handle their side of the sign-in under their own privacy policies. [Delete this line if your shop doesn't offer Google or Facebook sign-in.]
- Automatically: your IP address and browser details, kept in our provider's security logs.
- Payments: card and wallet details go straight to [Stripe / PayPal / Creem / Dodo Payments]. We never see full card numbers.
Why we use it
| Purpose | Legal basis (EU/UK) |
|---|---|
| Taking, delivering and supporting your order or booking | Contract |
| Sending order, download and booking emails | Contract |
| Keeping sales and tax records | Legal obligation |
| Preventing fraud and keeping the shop secure | Legitimate interests |
| [Newsletter, only if you opt in] | [Consent] |
Who we share it with
- SBCommerce.net (Stonebridge Digital LLC, USA), which runs this shop's platform for us and processes data on our instructions. Its sub-processors are listed in its Data Processing Terms.
- Our payment provider: [name], under its own privacy policy.
- [Our AI assistant provider: [name, such as Anthropic (Claude) or OpenAI (ChatGPT)], when we use it to help run the shop, such as looking up an order or answering a message. Delete this line if you don't connect an AI app to the shop.]
- Delivery companies: [names], with just what they need to deliver. [If you buy labels through EasyPost: EasyPost, Inc., which passes your address to the carrier to make the label.]
- [Anyone else, such as an accountant.]
- Authorities, when the law requires it.
Your data may be stored in the United States. [Describe the safeguard, such as the EU standard contractual clauses in SBCommerce's Data Processing Terms.]
How long we keep it
- Order and tax records: [number] years, as [country] law requires.
- Your account: until you ask us to close it.
- Messages: [period].
Your rights
You can ask to see, correct, export or delete your data, or object to how we use it, by writing to [email]. If we erase your details, we still keep order amounts and the region the order was taxed in, because the law requires sales records. You can complain to your data protection authority [name it, for example the Personal Data Protection Agency in North Macedonia].
Cookies
This shop uses a cookie to keep you signed in and your browser's storage to remember your cart. [List any analytics or advertising tools you added, and ask for consent before they load.]
Changes
We will post any change here, with a new date.