Privacy Policy

For Sellers (Creators/Entrepreneurs):

• Full name, email address, and profile photo
• Username and password (encrypted)
• Store name, OnePage URL, and custom domain settings
• Address and business information (required for Stripe verification)
• Identity documents, and in a web browser a selfie, collected and held by Stripe, never by Storelib (see section 6.3)
• Financial and banking information provided to Stripe for payout purposes
• Product listings, descriptions, pricing, images, and digital files uploaded for sale
• Email content created through the Storelib email system (newsletters, broadcast emails)
• Timezone, language preferences, and dashboard settings
• Billing plan and subscription information

For Buyers (Customers):

• Full name and email address (provided at checkout)
• Payment information — processed and stored securely by Stripe; Storelib does not store your full card details
• Purchase history and transaction records
• Product reviews and ratings submitted on seller product pages
• Email address when subscribing to a Seller's newsletter or email list
• Optional tip amounts added during checkout

For All Users:

• Any information you provide when contacting us for support, feedback, or inquiries
• Information you voluntarily include in your public profile or store pages

When you access or use our Services, we automatically collect certain technical and usage information:

• IP address
• Device type, operating system, and browser type/version
• Mobile device identifiers (e.g., device ID, advertising ID) when using our iOS or Android apps
• Pages visited, time spent on pages, click-through data, and navigation paths
• Referring URL and exit pages
• Approximate geographic location derived from IP address (country and region level)
• Traffic source data including UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term)
• Product page views, tracked natively using IP-based deduplication
• Crash logs and error reports from our mobile applications

We may receive information from third-party services connected to your account:

• Stripe: Account verification status, payout information, transaction confirmations, and refund statuses.
• Social login providers: If you sign up or log in using Google or Apple, we receive your name, email address, and profile picture as permitted by that provider.
• App stores: Apple App Store and Google Play Store may provide us with aggregated download and usage analytics.

• Create and manage your Seller or Buyer account
• Process transactions between Buyers and Sellers via Stripe Connect
• Deliver purchased digital products to Buyers via email and download links
• Facilitate payouts to Sellers through Stripe Connect
• Enable Sellers to manage their stores, product listings, OnePage, email subscribers, and analytics dashboards
• Process refunds when applicable
• Connect custom domains to Seller stores

• Track and display product views, sales, revenue, and conversion rates on Seller dashboards
• Identify traffic sources (direct, organic search, social media, email, referral, paid search) and UTM campaign data
• Provide geographic/country-level data on visitors and customers
• Generate aggregated performance metrics and KPIs

Note: All analytics are built natively into the Storelib platform. We do not use Google Analytics or any third-party analytics service for product view tracking.

• Send transactional emails (purchase confirmations, download links, refund notifications, payout confirmations, first sale notifications)
• Send account-related notifications (security alerts, verification requests, billing reminders)
• Enable Sellers to send newsletters and marketing emails to their subscribers through Storelib's built-in email system
• Respond to your support requests and inquiries

• Monitor and analyze usage trends to improve user experience
• Detect, prevent, and address fraud, abuse, security incidents, and technical issues
• Debug and fix errors in our website and mobile applications
• Enforce our Terms of Service and prevent prohibited activities

• Comply with applicable tax, accounting, and financial reporting requirements
• Respond to lawful requests from law enforcement or regulatory authorities
• Establish, exercise, or defend legal claims

When a Buyer purchases a digital product from a Seller on Storelib:

• The Buyer enters payment information on the Storelib checkout page powered by Stripe Elements.
• Payment card information is transmitted directly to Stripe's servers. Storelib never receives, processes, or stores your full payment card details.
• Stripe processes the charge and automatically splits the payment: the Seller's share is sent to their connected Stripe account, and Storelib's platform fee is collected as an application fee.
• Stripe handles all PCI-DSS compliance requirements for payment data security.

To receive payouts, Sellers set up payments with Stripe through Storelib. Stripe collects identity and banking information directly, including banking details, tax identification information, and address. This information is provided to and controlled by Stripe, not Storelib. Storelib receives only limited information such as the Seller's Stripe account ID, verification status, country, payout currency, the last four digits of the payout bank account, and payout history.

Verification is required by law and by the card networks before a Seller can be paid. Storelib's own payout form collects only what Stripe requires of an individual in their country, typically a date of birth, a home address and a phone number, together with the bank account payouts are sent to and the currency the Seller chooses to be paid in. Storelib does not ask for a utility bill or bank statement. Where Stripe accepts an identity document in place of a national identification number, the identity document answers for it; only where the rules of the Seller's country leave Stripe no alternative (for example a United States Social Security number) is the number asked for, and it is passed to Stripe without being stored by Storelib.

Where Stripe requires an identity document, the Seller presents a passport, national identity card or driving licence. In a web browser the check is run by Stripe Identity on Stripe's own screens: Stripe scans the document with the device camera and takes a photograph of the Seller's face, and processes both with automated and biometric technology to confirm that the document is genuine and belongs to the person presenting it. That document image, that facial image and the biometric comparison between them are collected by Stripe directly and never pass through Storelib. In the Storelib mobile application, and anywhere Stripe Identity is unavailable, the Seller instead photographs the document with the camera in the Storelib application; Storelib transmits that photograph to Stripe over an encrypted connection and does not store it, and no facial image or biometric comparison is collected on that path.

Storelib passes the details a Seller types to Stripe over an encrypted connection as they are submitted and does not store them: no identity document, facial image, identification number, date of birth or full bank account number is written to Storelib's databases or logs. Afterwards Storelib holds only the Seller's name, country, verification status and the last four digits of their payout account. Stripe is an independent controller of that data, retains it for the period its own policies and applicable law require, and a Seller may ask Stripe to delete their verification data as described in Stripe's privacy policy. Verification cannot be skipped: without it, Storelib cannot accept payments on a Seller's behalf.

When a Buyer disputes a payment, Storelib records the dispute, its reason, its amount and its outcome, together with any evidence the Seller chooses to add, so the dispute can be answered and so both parties have a record of it. Evidence a Seller supplies is shared with Stripe and, through Stripe, with the card networks and the Buyer's bank for the purpose of deciding the dispute.

Storelib collects a platform transaction fee on each sale, which varies based on the Seller's subscription plan (Free or Pro). These fees are collected automatically via Stripe Connect's application fee mechanism.

Stripe is an independent data controller for the payment and financial data it processes. For details, refer to Stripe's Privacy Policy at https://stripe.com/privacy.

Storelib provides Sellers with a built-in analytics dashboard. All analytics tracking is performed natively by Storelib — we do not use Google Analytics or any third-party analytics service for tracking views on Seller product pages and stores.

Our native analytics system tracks:

• Product page views. With your consent to analytics, a returning visitor is recognised by a cookie so a visit is counted once. Without it, nothing is stored on your device: the pages of one visit are grouped by a code made from your IP address and browser for that store, which changes every day and cannot be turned back into either. Your IP address itself is not stored
• Traffic sources (direct, organic search, social media, email, referral, paid search)
• UTM campaign parameters
• Geographic/country-level data (derived from IP addresses)
• Sales, revenue, and conversion rate metrics

Sellers see only aggregated analytics data and cannot identify individual visitors. Where you have agreed to analytics, we also use Vercel Analytics, which measures traffic and page speed without setting cookies.

Necessary cookies are always on. Everything else is off until you choose otherwise, and you can change your choice at any time with the button below or Cookie preferences at the bottom of any page. Your choice is kept for twelve months, then we ask again. We do not use advertising cookies or sell data collected through cookies.

Besides the choices above, you can block or delete cookies in your browser settings. If you block necessary cookies, signing in and checkout will not work. Our mobile apps set no analytics or advertising identifiers.

Storelib provides Sellers with a built-in email system to communicate with their subscribers and customers. This includes newsletters, product announcements, and automated emails. The email system is hosted and operated by Storelib.

Buyers and visitors may voluntarily provide their email addresses to Sellers through Subscribe Bars on Seller stores, OnePage link-in-bio pages, free product downloads (lead magnets), or at checkout. When a visitor subscribes to a Seller's email list, that Seller can view the subscriber's email address in their Storelib dashboard and send them emails through the platform.

Every email sent through Storelib's email system includes a clearly visible unsubscribe link. Subscribers can unsubscribe at any time. Once unsubscribed, the Seller will no longer be able to send them marketing emails through Storelib.

The number of emails a Seller can send per month depends on their subscription plan: Free plan: 500 emails/month; Pro plan: 2,000 emails/month. Sellers on a plan that is no longer offered keep that plan's limit while the subscription remains active.

When you make a purchase from a Seller or subscribe to a Seller's email list, the Seller receives your name, email address, purchase details, and any review you submit. Sellers are independent data controllers for the Buyer data they receive and are responsible for their own compliance with privacy laws.

We share transaction information with Stripe to process payments, manage payouts, handle refunds, and comply with financial regulations.

We may share information with trusted third-party service providers who assist us in operating our Services, including hosting providers, email delivery services, customer support tools, and error monitoring services. These providers are contractually obligated to use your data only for the purposes we specify.

We may disclose your information if required by law, in response to a valid legal process (such as a court order, subpoena, or government request), or to protect the rights, property, or safety of Storelib, our users, or the public.

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of our assets, your personal information may be transferred as part of the transaction. We will notify you of any such change.

We may share aggregated or anonymized information that cannot reasonably be used to identify you with third parties for business, research, or statistical purposes.

If you are located in the European Economic Area or the United Kingdom, you have the following rights:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request that we correct inaccurate or incomplete personal data.
• Right to Erasure (“Right to Be Forgotten”): You can request that we delete your personal data, subject to certain legal exceptions.
• Right to Restriction of Processing: You can request that we restrict the processing of your personal data in certain circumstances.
• Right to Data Portability: You can request to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You can object to the processing of your personal data based on our legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw your consent at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your country of residence.

• Right to Know: You can request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You can request deletion of your personal information, subject to certain legal exceptions.
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

If you are located in a jurisdiction with specific privacy legislation (such as Brazil's LGPD, Canada's PIPEDA, or various US state privacy laws), you may have similar rights. Please contact us at privacy@storelib.com to exercise your rights.

You can exercise your rights by emailing privacy@storelib.com with your request. Please include sufficient information to verify your identity and describe your request clearly. We will respond within the time frame required by applicable law (generally 30 days for GDPR and 45 days for CCPA requests). We will not charge a fee for processing your request unless it is manifestly unfounded or excessive.

Our mobile applications are available on the Apple App Store and the Google Play Store. When you download and use our apps, the respective app store may collect information about you in accordance with its own privacy policy. We encourage you to review Apple's and Google's privacy policies.

Our mobile applications may request certain permissions on your device, such as:

• Camera and photo library access: To allow Sellers to upload product images and profile photos
• Push notifications: To send you alerts about sales, orders, and account activity
• Internet access: Required for all core functionality
• Storage access: To enable downloading of purchased digital products

You can manage these permissions at any time through your device's settings.

On iOS, we comply with Apple's App Tracking Transparency (ATT) framework. We will request your permission before tracking your activity across other companies' apps and websites. On Android, we respect your advertising ID settings. We do not use your mobile device identifiers for advertising purposes.

Our mobile applications may collect crash reports and diagnostic data to help us identify and fix bugs. This data may include device type, operating system version, app version, and technical logs. This data does not include your personal content or financial information.

Some web browsers transmit "Do Not Track" (DNT) signals. Because there is no universally accepted standard for how DNT signals should be interpreted, we do not currently alter our data collection and use practices in response to DNT signals. We will update this Privacy Policy if a standard for responding to DNT signals is established.