What MiniStore stores, why it is stored, how long it stays, and who can see it.
Who is responsible for what
There are two roles here, and they are worth keeping apart.
- The merchant is the seller. A shop's own customer list, order history and shoppers' names and phone numbers belong to that merchant. They decide what to sell, what to ask for, and how long to keep it.
- MiniStore is the platform. We store that data so the merchant's storefront works and so orders reach them, and we look after the merchant's own account.
What we store for a merchant account
- Your name, email address and a password hash. We never store your password itself and cannot read it.
- Your store details: name, web address, WhatsApp number, currency, country, theme, and any logo, banner or product photographs you upload.
- Your catalog, customers, and orders — the working data of your shop.
- Administrative records of your account: when it was created, when you signed in, and changes to your plan or status.
What a storefront collects from a shopper
When someone places an order on a storefront, the form asks for their name, their phone number, and optionally their business name and a note. Those details are used to build the WhatsApp message that delivers the order to the merchant, and are kept in that merchant's order list.
Nothing else about a shopper is required to order. There is no payment step, so no card or bank details pass through this platform at all.
Cookies and local storage
By default the only cookie we set is a session cookie, used to keep a signed-in merchant signed in and to carry a shopper's cart. It is marked HttpOnly and SameSite=Lax, and Secure when the platform runs over HTTPS. It is not used for advertising.
A merchant may switch on a Meta or TikTok pixel for their own storefront. When they do, that network sets its own cookies and sees visits to that store; we record the conversion on the server as well, so the two agree. Those cookies are the merchant's choice and are covered by their own privacy notice — we set none of them unless a merchant turns the feature on.
Analytics we keep for merchants
Storefront visits and actions are recorded as events so a merchant can see which products get looked at. These events are tied to a store, not to a person: we do not build a profile of a shopper across stores, and a merchant's own signed-in visits are not counted.
Analytics events are removed automatically after 2 years.
Emails we send
We email you to verify your address, to reset your password when you ask, and about your account and plan. These are transactional messages, not marketing, and there is no newsletter to unsubscribe from.
Who can see your data
- Your own store's data is visible to you, and to anyone you give access to.
- Platform administrators can see account and store records when needed to run the service, to support you, or to investigate abuse.
- Other merchants cannot see your data. Each store's data is separated from every other store's, and that separation is enforced on every request.
- We do not sell personal data, and we do not share it for advertising.
How long data is kept
Account and store data stays while the account is open. Analytics events are deleted after 2 years. If you close your account, your store and its data can be deleted on request; take a copy of your orders and photographs first if you need them, because deletion is not reversible.
Asking about your data
A merchant can see and correct most of their own data from their account, and can export their catalog and orders. To ask for a copy of your data, to correct it, or to have it deleted, contact us and we will respond within a reasonable period.
A shopper who wants to know what a shop holds about them should contact that shop: the merchant is the seller and holds the order record. We will help a merchant respond.
Security
Passwords are stored as hashes. Connections are encrypted when the platform runs over HTTPS. Access to administrative areas is restricted and logged. No system is perfect, and we will tell affected users if a breach puts their data at risk.
Children
This platform is for businesses and is not intended for children. We do not knowingly collect data from a child.
Contact
Privacy questions go to the contact address published on our website.
See also our terms of service.