Privacy Policy

This policy explains what personal data StorePilot collects, why we collect it, how we protect it, and the rights you have over it. It covers our website at storepilot.app and the StorePilot application, including the StorePilot app for Shopify.

Effective date: 9 July 2026

1. Who we are

StorePilot is operated by EN5 Ltd ("StorePilot", "we", "us"), a company registered in England and Wales. For anything privacy-related, you can reach us at [email protected] or via our contact form.

Depending on how you interact with us, we act in one of two roles:

• Data controller: for data about website visitors, waitlist subscribers, and merchants who create a StorePilot account or install our app.
• Data processor: for store data we handle on a merchant's behalf (catalog, inventory, and order records). StorePilot is deliberately designed so that this data does not include the merchant's customers' personal details; see Your customers' data below.

2. Information we collect

Information you give us directly

• Waitlist signup: your email address.
• Contact form: your name, email address, message, and optionally a phone number.

Information from the StorePilot app for Shopify

When you install the StorePilot app on your Shopify store, we access data through Shopify's APIs under the permissions you grant during installation. This may include:

• Store information: your store name, domain, contact email, address, currency, and locale.
• Catalog and inventory data: products, variants, listings, images, prices, and stock levels.
• Order data: order number, dates, payment and fulfillment status, totals, and line-item basics (product title, SKU, quantity, price). We do not request, receive into storage, or keep your customers' names, email addresses, phone numbers, or billing and shipping addresses.
• Authentication tokens: the OAuth access token Shopify issues to our app, which we store securely to act on your behalf.

We never receive or store full payment card numbers; payments are handled entirely by Shopify and the connected marketplaces.

Information from connected marketplaces

If you connect other sales channels such as Amazon or Kaufland, we receive equivalent catalog, inventory, and order data from those platforms, together with the credentials or tokens needed to keep them in sync.

Information collected automatically

• Usage and log data: IP address, browser type, pages visited, and timestamps, collected through our hosting provider (Cloudflare) for security and reliability.
• Analytics: we use Google Analytics on our website, which sets cookies to help us understand aggregate site usage. See Cookies below.

3. How we use your information

We use personal data to:

• Provide and operate the StorePilot service, synchronising products, inventory, and orders across your connected sales channels.
• Respond to messages sent through our contact form and provide support.
• Manage the waitlist and let you know about access and product updates (you can opt out at any time).
• Maintain the security, reliability, and performance of the service, including fraud and abuse prevention.
• Understand how our website is used so we can improve it.
• Comply with legal obligations.

We do not sell personal data, and we do not use your store's data or your customers' data for advertising or to train machine-learning models.

4. Legal bases for processing

Where the UK GDPR or EU GDPR applies, we rely on the following legal bases:

• Performance of a contract: processing store and order data to provide the service you signed up for.
• Legitimate interests: securing our systems, preventing abuse, responding to enquiries, and improving the service.
• Consent: waitlist and product-update emails, and analytics cookies where required.
• Legal obligation: retaining records where the law requires it.

5. Your customers' data

If you are a merchant, StorePilot does not collect or store your customers' personal data. Our order records are limited to order-level facts (order number, dates, status, totals, and line-item basics), and our Shopify API access does not request customer fields at all. Your store remains the system of record for customer information.

Your customers should direct privacy requests to you as the merchant. We still honour Shopify's mandatory privacy requests: on a customer data request we confirm we hold no customer personal data; a customer redaction request requires no action for the same reason; and on a shop redaction request we delete all of the store's data, in line with Shopify's requirements.

6. How we share information

We share personal data only with service providers who help us run StorePilot, and only to the extent necessary:

• Cloudflare: website hosting, content delivery, and security.
• Postmark (ActiveCampaign): transactional email delivery for the waitlist and contact forms.
• Google Analytics: aggregate website usage statistics.
• Shopify and connected marketplaces (Amazon, Kaufland): we exchange the data required to synchronise your listings, inventory, and orders with the platforms you have chosen to connect. Each platform's own privacy policy governs its handling of that data.

We may also disclose information if required by law, to protect our rights or the safety of others, or as part of a business transaction such as a merger or acquisition (in which case this policy would continue to apply to the transferred data).

7. Data retention

Every StorePilot customer runs on their own dedicated, access-gated server instance; your store's data is never pooled with other customers' data.

• Waitlist and contact data is kept for as long as needed to manage your request, or until you ask us to delete it.
• Store and order data is kept on your dedicated instance while your account is active or the app is installed.
• On uninstall or account closure, your dedicated instance and all store data on it are deleted immediately, except where the law requires us to retain specific records. Shopify shop-redaction requests are honoured on the same basis.
• Server logs are retained for a short, rolling period for security purposes.

8. International transfers

We are based in the United Kingdom, and our service providers may process data in the UK, the European Economic Area, and the United States. Where personal data leaves the UK or EEA, we rely on appropriate safeguards such as adequacy decisions, the EU–US and UK–US Data Privacy Frameworks, or Standard Contractual Clauses.

9. Security

We take reasonable technical and organisational measures to protect personal data, including single-tenant isolation (each customer's data lives on their own dedicated, access-gated server), encryption in transit (TLS) for all connections, encrypted storage of API credentials and access tokens, and access to production data restricted to those who need it to operate the service. No method of transmission or storage is completely secure, but we work to protect your data against unauthorised access, alteration, or loss, and we will notify you and the relevant authorities of a breach where the law requires it.

10. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you, and receive a copy in a portable format.
• Correct inaccurate or incomplete data.
• Ask us to delete your data.
• Restrict or object to certain processing.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email [email protected]. We respond within the timeframes required by applicable law. If you are in the UK or EEA, you also have the right to lodge a complaint with your supervisory authority; in the UK this is the Information Commissioner's Office (ICO). We extend these rights to all users regardless of location, including rights under the California Consumer Privacy Act (CCPA) where it applies.

11. Cookies

Our website uses a small number of cookies:

• Essential cookies: required for basic site functionality and security.
• Analytics cookies: Google Analytics (_ga and related cookies) to measure aggregate site usage.

You can block or delete cookies through your browser settings, or opt out of Google Analytics specifically using Google's browser add-on. The site remains fully usable without analytics cookies.

12. Children

StorePilot is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date at the top of this page, and for material changes we will provide more prominent notice, for example by email or an in-app message. The current version is always available at storepilot.app/privacy.

14. Contact us

Questions, concerns, or requests about this policy or your data? Write to [email protected] or use our contact form. We're happy to help.