How we collect, use and protect personal data.
1. Who is responsible
For merchants' account data and our own website, SeraFox is the data controller. For the personal data of your customers that you collect through your store, you are the controller and SeraFox acts as your processor, handling it only on your instructions as described in our Data Processing Addendum.
2. What we collect
Account data: name, email address, password (stored hashed), plan and billing status. Store data: products, orders, customers, messages and settings you add or generate. Technical data: IP address, device and browser type, pages viewed and approximate location (country, region, city) derived from the connection, used for security and analytics. Cookies and similar storage: see our Cookie Policy.
3. How we use it
To provide and secure the Service; to process orders and send notifications you enable; to show analytics and the Live View on your dashboard; to provide support; to detect fraud and abuse; to bill you; and to improve the product. We do not sell personal data and we do not use your customers' data to advertise to them.
4. Legal bases
Where privacy law requires a legal basis, we rely on performing our contract with you, our legitimate interests in running and securing the Service, your consent (for example for optional marketing or non-essential cookies) and compliance with legal obligations.
5. Sharing
We share data only with service providers that help us run the Service (hosting, database, email delivery, payments and error monitoring), with the payment, advertising and other integrations you choose to enable, when required by law, or in a business transfer. Providers are bound by contract to protect the data.
6. International transfers
Our infrastructure may process data in different countries. Where data is transferred internationally we use appropriate safeguards such as standard contractual clauses where required.
7. Retention
We keep account data while your account is open and for a reasonable period afterwards for legal, tax and security purposes. Store data is deleted or anonymised after closure following a short export window, unless we must keep it by law.
8. Your rights
Depending on where you live you may have the right to access, correct, delete or export your data, to object to or restrict some processing, and to withdraw consent. If you are a customer of a store built on SeraFox, please contact that store first. To exercise rights regarding our own data, write to legal@serafox.com. You may also complain to your local data protection authority.
9. Security
We use encryption in transit, access controls, row-level data isolation between stores, hashed passwords and server-side handling of secrets. No system is perfectly secure; if a breach affects you we will notify you as the law requires.
10. Children
The Service is not directed to children under 16 and we do not knowingly collect their personal data.
11. Changes and contact
We will post updates here and notify you of material changes. Contact: legal@serafox.com.
This document is provided for information and does not replace advice from a qualified lawyer about your own obligations.