Privacy Policy
This is a placeholder written before legal review. It describes how we intend to work and is not yet the binding text. A few company details are still being finalised.
Who we are
ShopFast is run by Swifty LLC ("ShopFast", "we", "us"), a company registered in Colorado, United States under number 20241506844, with its registered address at 1942 Broadway St. STE 314C, Boulder, CO 80302, United States. This policy explains how we handle personal data when you use shopfa.st and its documentation, the ShopFast dashboard, the stores we host (at addresses ending in shopfa.st and on sellers' own domains), our API, and our bots on Discord and Telegram, and when you contact us.
Questions about this policy or your data go to [email protected]. Our representatives in the EU and the UK are listed under Contact and representatives. We have not appointed a data protection officer, as the law does not require one for our processing; the privacy address above handles every question.
Our two roles
We are the controller for the personal data of sellers and their team members, of visitors to shopfa.st, and of people who contact us or report content. We are also the controller for the limited processing we do on stores for our own purposes: keeping ShopFast secure, preventing fraud and abuse across stores, handling reports and legal requests, meeting our legal obligations, and, where the store owner allows it, improving our AI features.
We are a processor for the stores. When you buy from or visit a store on ShopFast, the store's owner (the seller) decides what is collected and why. The seller is the controller, and we process your data on the seller's behalf and on their instructions, under our Data Processing Addendum. The store's own privacy policy applies to you, so contact the store first about your data. If you contact us about data a store holds, we pass your request to the store and help it answer.
Payments in stores go through the payment provider each seller connects. Card numbers are entered into the provider's own fields or pages and never reach ShopFast.
Sellers and their teams
As a controller, we process:
- Account details: your name and email address, whether you confirmed the address, and your password, stored only as a hash. If you use Sign in with Google, the ID of your Google account and the email address Google confirmed. You must give us your name, your email address and a password (or use Sign in with Google) to open an account: without them we cannot provide the Service.
- Security data: your two-factor secret (stored encrypted) and recovery codes (stored as hashes); your sign-in sessions with the IP address and browser (user agent) they started from; password-reset and email-change requests, with the IP address that made them; and a history of sign-ins (including failed ones), sign-outs and changes to your password, email and two-factor settings, with the IP address, browser and, where our network provider supplies it, the country they came from.
- Store data: the store's name, web address, country, currency, category and time zone; the business details you enter (business name, registration and VAT numbers, address); your settings; and everything you add, such as products, files, keys, images, pages and themes.
- Team data: the people you invite (name, email address, role and access rules) and the store's activity log, which records who did what and when, from which IP address and browser.
- Payment setup: the payment providers you connect, your account IDs there, and the keys or credentials you enter (stored encrypted and never shown again); for crypto, the receiving addresses or extended public keys (xpubs) you give us. We never receive the private keys to your wallets.
- Billing: your plan, invoices and AI credit purchases, and the card you pay ShopFast with. Stripe stores the card; we keep its brand, last four digits and expiry.
- Support and community: messages you send our support by email, in the dashboard or on Discord, and, if you link Discord to our community server, your Discord user ID and username and the Discord grant described under Members of ShopFast's Discord server.
- AI features: what you ask Ask AI, the AI store builder and AI in the theme editor, the answers, what you did with each suggestion, and any rating or comment you give (see AI features).
- Usage and diagnostics: API request logs (the request, its status, the key used, the IP address and user agent); error reports from your browser (the page address with any tokens removed, your browser, screen size, and your user and store IDs); and, if you turn on notifications in the ShopFast app, your device's push subscription.
- How you use the dashboard: ShopFast records how sellers use the dashboard, to improve the product and to support you: the pages you open (as page types, without record IDs or search terms), how long you stay on each, the type of device and window size, and which buttons and links you click. For a sample of visits we also make a screen recording of the dashboard. In it, all text except ShopFast's own navigation is masked (so names, email addresses, messages and other content are not recorded), everything you type is masked, and password and two-factor fields, API keys and other secrets, payout wallet addresses, payment provider credentials and text editors are never recorded. We never record network traffic or your browser console. Only a small number of ShopFast staff can watch recordings, and each viewing is logged. Recordings are kept for 30 days and page views and clicks for 90 days. We do not record buyers or visitors on stores.
Buyers and store visitors
For each store, as its processor, we process the data below. What a store collects depends on its settings; for example, a store decides whether to ask for a phone number, which analytics mode to use and whether to use Fraud Shield.
- Checkout and orders: your email address, name and country, and the phone number, billing address and other checkout fields when the store asks for them; what you bought, prices, discounts, gift cards, store credit, tax and tips; the payment method and the result the payment provider reports; and, for a card saved for renewals, its brand, last four digits and expiry.
- Your account at a store, if you create one: email address, name, phone number, country, password (as a hash) and marketing choice; your sign-in sessions with IP address and browser; and sign-in codes sent by email (stored as hashes).
- Delivery: the license keys and serials you bought (stored encrypted); download links and how often they were used; for licensed software, each device that activates a key (a hash of its device ID, never the raw ID, the device name you give it, its country and when it was first and last seen); and, when a store watermarks downloads, a code in each file that links the copy to your order, with a hashed buyer reference rather than your name or email address.
- Discord and Telegram: when you link Discord to get a role, your Discord user ID, username, display name and avatar, and the access tokens Discord gives us (stored encrypted); when you buy or get access through Telegram, your Telegram user ID, username and your messages with the store's bot.
- Connection and fraud prevention: your IP address, the country it points to, your browser (user agent), whether the connection comes through a proxy, VPN, Tor or a hosting network, and a random device ID kept in a cookie (sf_dev). When the store uses Fraud Shield, also the risk score and the reasons behind it (see Fraud Shield and other automated decisions).
- Messages: support requests and their attachments, emails the store sends you and whether they were delivered, status updates you subscribe to, reviews you post (shown on the store with the name you give), and privacy requests sent through the store's privacy page.
- Marketing: whether you agreed to marketing, newsletter and pop-up sign-ups, and, if the store turns tracking on, when you open its marketing emails and which links you click.
- Analytics: the pages you view, time on the page and how far you scroll, items added to the cart, searches, links you follow out of the store, where you came from (the referring site and campaign tags), your approximate location (country, region and city, from your IP address), your type of device, browser and operating system, your language and screen size. By default a store's analytics are cookieless: a visit is counted with a daily hash of the store, the day, your IP address and your browser, which cannot be linked across days, and nothing is stored in your browser. If the store's settings allow it and you agree in its consent banner, a random visitor ID is kept in your browser (sf:vid) so later visits can be recognised; some stores use this ID unless you decline. A store can also turn analytics off. If your browser sends a Global Privacy Control signal, the store's analytics stay cookieless unless the store has turned that protection off.
- Affiliates and resellers: if you join a store's affiliate or reseller programme, your name, email address, payout details, and the clicks, orders and commissions credited to you.
We also use some of this data as a controller, for the purposes in Our two roles: for example, to check the email address, IP address, device, Discord ID or card fingerprint of a checkout against ShopFast's shared blocklist when the store has opted in to it, and to keep records of reports and legal requests.
Visitors to shopfa.st
shopfa.st and its documentation load no analytics, advertising or other third-party tracking scripts and set no cookies of their own. Our servers and Cloudflare, which delivers the site, receive your IP address and browser details with every request and keep them in security and operations logs (see How long we keep it). What the site keeps in your browser is listed under Cookies and browser storage.
People who contact us or report content
When you write to us, report content at Report abuse or send a copyright notice, we process your name, your email address, your message or report, the material you report, and what we decided. For reports sent through the form we also keep a keyed hash of your network address (never the address itself), only to spot abuse of the form. We tell the seller what was reported and what we decided, but we do not give them your name or email address, except that a copyright notice is passed on in full so the seller can respond (as the Copyright and Takedown Policy describes), or where the law requires it.
Members of ShopFast's Discord server
ShopFast runs its own community server on Discord. Before the rest of the server opens, each member verifies their Discord account at shopfa.st/discord/verify, which explains what verifying does before Discord asks for approval. Sellers who link Discord in the dashboard are verified the same way. We are the controller for this data.
- What we collect: your Discord user ID, username and display name, when your Discord account was created (read from the ID), when you verified, the version of the text you agreed to, and the grant Discord gives us to know who you are and to add you to a server (an access token and a refresh token, stored encrypted). We also keep a keyed hash of the IP address you verified from, never the address itself, to spot many accounts verifying from one network during a raid.
- Why: to let verified members into the server, and so we can add you back to ShopFast's official server if it ever has to be rebuilt or moved, for example if it is compromised, raided or deleted. The grant is never used to add you to any other server, and it does not let us read your messages, your servers or your email address. To keep it usable, we refresh it before it expires and check about once a day whether you are still in the server.
- Legal basis: your consent (Art. 6(1)(a)) for the grant and the backup; our legitimate interests (Art. 6(1)(f)) for the network hash. Accounts only a few days old, bots and accounts banned from the server are refused, and nothing is kept for them.
- How long: until you withdraw. If you leave the server, your verification is deleted 180 days later. When we move members to a new server, the record of who was added is kept for 90 days.
- Withdrawing: run /unverify in the server, use the button on the page you see right after verifying, or remove ShopFast under Discord → User Settings → Authorized Apps. We delete your verification, revoke the grant with Discord and take the Member role back, so you see only the rules and the verify channel. If you linked Discord as a seller, /unverify unlinks it too. Withdrawing does not affect what we did before.
Why we use personal data, and our legal bases
The articles below are those of the EU GDPR; the UK GDPR has the same ones.
| Purpose | Personal data | Legal basis |
|---|---|---|
| Create and run your account and stores | Seller account, store, team and payment setup data | Contract (Art. 6(1)(b)) |
| Bill plan fees and AI credits, and keep accounting records | Billing data | Contract; legal obligation (Art. 6(1)(c)) for the records |
| Keep accounts and the Service secure: sign-in, two-factor, sessions, rate limits, activity logs, error reports and malware checks | Security and usage data, IP addresses and browser details | Legitimate interests (Art. 6(1)(f)) in protecting our users and the Service |
| Prevent fraud and abuse across stores, including ShopFast's shared blocklist | Email addresses, IP addresses, device IDs, Discord IDs, card fingerprints and the outcome of checks | Legitimate interests in preventing fraud |
| Run stores for sellers: checkout, delivery, licensing, emails, support, analytics and Fraud Shield | Buyer and visitor data | We act as the store's processor; the store chooses the legal basis |
| Answer support requests and send service messages | Contact details and messages | Contract; legitimate interests in helping you |
| Improve the dashboard and help sellers who ask for support | Dashboard usage: pages opened, time on each, clicks and, for a sample of visits, a masked screen recording | Legitimate interests in improving the Service and supporting you |
| Tell sellers about new features and offers | Name and email address | Legitimate interests; you can opt out at any time (or your consent, where the law requires it) |
| Improve ShopFast's AI features with AI conversations, unless the store owner turns this off | AI conversations, after the redaction described below | Legitimate interests |
| Handle reports, moderate content and enforce our terms | Reports, store content and account data | Legal obligation (EU Digital Services Act); legitimate interests |
| Verify members of ShopFast's Discord server, and add them back to our official server if it has to be rebuilt or moved | Discord user ID, username and display name, account creation date, the Discord grant (stored encrypted) and the consent version | Consent (Art. 6(1)(a)); you can withdraw it at any time |
| Keep raids out of ShopFast's Discord server | A keyed hash of the IP address used to verify (never the address) | Legitimate interests in keeping the server safe |
| Comply with the law and answer lawful requests, including tax and sanctions rules | What the request or rule requires | Legal obligation; legitimate interests |
| Establish, exercise or defend legal claims | What the claim requires | Legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see Your rights). We do not sell personal data, and we do not use it for advertising across other companies' sites and apps.
Fraud Shield and other automated decisions
Stores can use Fraud Shield, which checks every checkout automatically: before payment, and again once the payment provider confirms it. It looks at:
- the network: whether the IP address belongs to a VPN, proxy, Tor or a hosting provider, and its reputation, from our IP data provider (ipinfo.io);
- the email address: whether its domain can receive mail and whether it is a disposable address;
- speed: how many checkouts the same IP address, email address, device or card made at that store in the last hour, day and week;
- location: whether the billing country, the IP address's country and the card's country match;
- history at that store: earlier orders, refunds and chargebacks, and how old your account at the store is;
- the cart, compared with the store's usual order;
- the card details the payment provider reports after payment, such as the card type and whether 3D Secure was used; and
- your visit to the store earlier that day, and the time of day.
Signals add points to a risk score from 0 to 100. Before the score, Fraud Shield checks the store's own lists and rules and, if the store opted in, ShopFast's shared blocklist. Depending on the store's settings, a checkout can go ahead, need a 6-digit code sent to your email or 3D Secure, be limited in quantity, be offered only payment methods that cannot be reversed (such as crypto or store credit), be held for review, or be blocked. A held order is paid, but nothing is delivered until a person at the store approves, cancels or refunds it.
These decisions are made for the store, with the store's settings. If your checkout was blocked or held, contact the store: its team can see exactly why, can approve the order or allow you, and you can explain your side and ask for a person to review the decision. If you think ShopFast's shared blocklist names you by mistake, write to [email protected] and a person will review the entry. Stores make these decisions because they are needed to enter into the contract with the buyer safely (Art. 22(2)(a) GDPR); a buyer whose checkout is blocked can ask the store for a person to review it, give their point of view and contest the decision.
Some other checks run automatically but do not decide anything significant about you: uploads can be checked for malware and blocked if they fail, and analytics leave out traffic that looks automated. We make no other decisions about you based only on automated processing that have legal or similarly significant effects.
AI features
Sellers can use AI features: Ask AI (an assistant in the dashboard), the AI store builder, and AI in the theme editor. What the seller types, the store content the feature needs and, for Ask AI, the store data it reads to answer, such as orders and customers including buyers' names and email addresses, are sent to Anthropic, which runs the models. Under our agreement with Anthropic, it does not use this data to train its models.
We keep each conversation, the answers, what the seller did with each suggestion and any rating or comment for 12 months after the conversation was last used, so the store can see its history and we can bill AI credits. Unless the store owner turns off "Help improve ShopFast AI" (AI → Usage), we may use these conversations to improve ShopFast's AI features. Before that use we remove email addresses, phone numbers, IP addresses, long numbers such as card numbers, the values of buyer fields, and the names of the store and its team; a name typed into a question as free text can remain. Conversations started while the setting is off are never used this way, and turning it off also excludes earlier ones. We rely on our legitimate interests for this, and we never share conversations with a model provider to train its models.
Who receives personal data
Our service providers
These providers process personal data for us, on our instructions. Each of them is bound by data processing terms or acts under its own published terms for the public data it serves.
| Provider | What it does | Personal data | Where |
|---|---|---|---|
| Hostinger | Servers and database that run ShopFast, with its backups. Used for every store. | All personal data ShopFast holds | United States (Boston) |
| Cloudflare | Network, DNS, security filtering, certificates for custom domains, the edge cache, and storage (R2) for uploaded files, product files and images. Used for every store. | All web traffic (IP addresses, browser details, the pages requested), uploaded files and images | United States and Cloudflare's global network |
| Resend | Sends email (receipts, deliveries, sign-in codes, store and marketing emails) and receives replies to store support. Used for every store. | Email addresses, names and email content, which can include order details, license keys and download links | United States |
| ipinfo.io | IP address intelligence for Fraud Shield: whether an address is a VPN, proxy, Tor exit or hosting network, its network owner and country. Used at checkout. | IP addresses | United States |
| Anthropic | Runs the AI models behind Ask AI, the AI store builder and AI in the theme editor. Used only when a seller uses an AI feature. | What the seller types, store content, and the store data Ask AI reads to answer, which can include buyers' names, email addresses and orders | United States |
| mempool.space, litecoinspace.org, Etherscan and a Solana RPC node | Read public blockchains to detect payments to a seller's own wallet. Used only by stores that take crypto that way. | Payment addresses and transaction IDs (no names or email addresses) | United States and other countries (public blockchain services) |
| Stripe | Takes sellers' payments to ShopFast: plan fees and AI credits. | Sellers' names, email addresses and payment cards (Stripe stores the card; ShopFast keeps its brand, last four digits and expiry) | United States |
CoinGecko provides exchange rates for crypto payments and receives no personal data.
Others
- The store and its team. A store's team sees the data of its buyers and visitors, within the permissions the owner gives them.
- Payment providers. The provider a store connects (such as Stripe, PayPal, Square, Mollie, Razorpay, Paystack, NOWPayments, Cryptomus or the store's own BTCPay Server) receives what it needs to take your payment, under its own privacy policy.
- Services a store adds. Tools a store adds to its storefront, such as Google Analytics, Google Ads, Google Tag Manager, Meta Pixel, TikTok Pixel, X Pixel, Reddit Pixel, Microsoft Clarity, Plausible, Umami, Fathom, Crisp, Tawk.to or Trustpilot, collect data in your browser under the store's control. A store can make them wait for your consent; a store that uses Google Tag Manager always asks. The store's webhooks, plugins, apps and Slack notifications receive the data the store sends them, and product videos load from YouTube or Vimeo.
- Discord and Telegram, when you link your account, buy through their bots or join a community, under their own privacy policies.
- Google, which confirms your identity when you use Sign in with Google.
- Browser push services (for example from Google, Mozilla, Apple or Microsoft), which deliver notifications to sellers who turn them on. The messages are encrypted so the push service cannot read them.
- Public blockchains. Crypto payments are recorded on public blockchains, where anyone can see the addresses and amounts.
- Authorities and others where the law requires it, or where it is needed to protect the rights, property or safety of our users, the public or ShopFast.
- Professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality.
- A buyer or successor if ShopFast is reorganised, merged or sold, who must keep protecting personal data as this policy describes.
International transfers
Our servers are in the United States (Boston) (Hostinger), Cloudflare serves traffic from data centres around the world, and most of our providers are in the United States. ShopFast itself is registered in Colorado, United States. When we transfer personal data from the EEA, Switzerland or the UK to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses with the UK addendum, or rely on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions for providers certified under it. You can ask for a copy of these safeguards at [email protected].
How long we keep it
We keep personal data only as long as we need it for the purposes above. These are the periods our systems apply, or will apply once confirmed:
| Data | How long |
|---|---|
| Seller account and store data | While the account is open; 90 days after it closes, except records the law requires us to keep |
| ShopFast's own invoices and billing records | 7 years after the end of the financial year, as tax and accounting law requires |
| A store's orders, customers, delivery and support records | As long as the store keeps them, and deleted with the store; the store decides |
| Sign-in sessions | Until they expire (seller sessions after 30 days, or 7 days unused; store accounts after 30 days) or you sign out |
| Sign-in and account security history | 1 year |
| One-time codes, password-reset and email-change links | Deleted a day after they expire (codes last 10 minutes, password-reset links 15 minutes) |
| Fraud Shield checks: score, signals, email and IP address | 90 days |
| Store blocklists and allowlists, and ShopFast's shared blocklist | Until removed, or 30 days after they expire |
| Store activity log (who changed what, with IP address) | Set by the store owner: 30 days to 7 years, 365 days by default |
| License check log (never the key or the raw device ID) | 30 days |
| Raw analytics events | 400 days; daily totals stay |
| Analytics visit records and daily visitor hashes | 400 days |
| A store's search history | 400 days |
| AI conversations, suggestions and feedback | 12 months after the conversation was last used |
| API request logs | 30 days |
| Plugin run logs | 14 days |
| Webhook messages to sellers' endpoints | 30 days after every delivery succeeded; 90 days at most once finished |
| Error reports | 14 days |
| Dashboard page views and clicks | 90 days |
| Masked screen recordings of dashboard visits | 30 days |
| Uploaded files that nothing uses | 3 days (uploads that never finished: 1 day) |
| Support messages to ShopFast | 3 years after the conversation ends |
| Reports, notices and moderation decisions | 3 years after the decision |
| Discord verifications for ShopFast's server (ID, username, grant, network hash) | Until you withdraw; 180 days after you leave the server |
| Who was added when we moved members to a new Discord server | 90 days |
| Server and security logs at our hosting provider and Cloudflare | 30 days |
| Database backups | 14 days |
When a store is deleted, its data is deleted with it, including the buyers' data held for it, except records we must keep by law. Deleted data can remain in a backup until that backup expires.
Your rights
Under the GDPR and the UK GDPR, and similar laws elsewhere, you have the right to:
- get a copy of your personal data and information about how we use it;
- have inaccurate data corrected;
- have your data deleted;
- have our use of your data restricted;
- receive data you gave us in a structured, machine-readable format, and have it sent to another company;
- object to our use of your data based on legitimate interests, and to direct marketing at any time;
- withdraw consent you gave, at any time, without affecting what we did before; and
- not be subject to a decision based only on automated processing that significantly affects you, and to ask a person to review it.
Sellers can see and export much of their data in the dashboard. For anything else, write to [email protected]. If you are a buyer, send your request to the store first; we pass on any request we receive about a store's data and help the store answer. We answer within one month, or within three months for complex requests, and tell you if we need longer. We may ask you to confirm your identity first. Exercising your rights is free.
You can also complain to a data protection authority: in the EU, the authority in the country where you live or work or where you think the problem happened (list of EU authorities); in the UK, the Information Commissioner's Office. If you live in California or another US state with a consumer privacy law, you also have the right to know what personal data we hold about you, to correct and delete it, and to opt out of its sale or sharing. We do not sell personal data or share it for cross-context behavioural advertising, and we do not treat you differently for using these rights. Write to the privacy address above to use them.
Children
Sellers on ShopFast must be 18 or older. Each store decides who it sells to and must follow the law on selling to children and on their personal data. Buyers must be old enough to enter into a contract where they live, or have a parent's or guardian's permission. We do not knowingly collect personal data from children for our own purposes. If you think a child has given us personal data, write to [email protected] and we will delete it or pass the request to the store concerned.
Security
We protect personal data with measures that include:
- encryption in transit (TLS) for every connection;
- passwords stored only as Argon2id hashes, and two-factor sign-in, available to sellers and required for our staff;
- payment credentials, two-factor secrets and license keys stored encrypted, license keys with a separate key for each store;
- each store's data kept apart in the database by row-level security;
- roles and permissions for store teams, and activity logs;
- signed webhooks and rate limits; and
- staff access limited to what support, safety and billing need: every change our staff make is recorded in an audit log, and looking inside a store for support is read-only, time-limited and logged.
No system is perfectly secure. If we learn of a personal data breach, we act on it and tell the people and authorities we must, as the law requires.
Cookies and browser storage
shopfa.st and the documentation
No cookies of our own. Your browser keeps, and never sends to us: your theme choice (sf:theme), whether you have seen the opening animation in this browser session (sf:splash:home), and the code language you picked in the documentation (sf:docs:lang). If you use the API console in the documentation, the test key and base URL you type are kept for that tab only, and sent only with the requests you make.
Verifying for ShopFast's Discord server sets one short-lived cookie on api.shopfa.st (sf_cverify): a random value that ties Discord's answer to the browser that started, deleted when you come back from Discord and after 10 minutes at most.
On every ShopFast site, Cloudflare may set a short-lived security cookie when it checks whether a visitor is a bot. These are cookies such as __cf_bm and cf_clearance, which last at most a day and are needed for security.
The ShopFast dashboard
A cookie that keeps you signed in, a short-lived cookie during Sign in with Google, and browser storage for your preferences and unsaved drafts. All of them are needed for the dashboard to work. One more item, kept for the current browser tab only and deleted when it closes (sf:activity), holds an ID that groups the pages of your current visit for the usage records described underSellers and their teams.
Stores
Stores on ShopFast set these first-party cookies:
| Cookie | What it is for | How long |
|---|---|---|
| sf_cart, sf_cart_n | Your cart, and the number of items shown in the header | 30 days |
| sf_buyer | Keeps you signed in to your account at the store | Until the sign-in expires (30 days at most) |
| sf_orders | Lets this browser reopen the orders you placed on it | 90 days |
| sf_login, sf_reg | Carries a sign-in or sign-up step to the next page | 15 minutes |
| sf_tickets | Lets this browser reopen the support requests you sent | 180 days |
| sf_code_note | Shows the result of a discount link you opened | 60 seconds |
| sf_pw | Remembers that you entered the password of a password-protected store | 7 days |
| sf_dev | A random device ID that Fraud Shield uses to spot repeated or risky checkouts | 400 days |
| sf_ref | The affiliate who referred you, so the store can credit them | Set by the store's affiliate programme, 1 to 365 days |
| sf_src | Where your visit came from (campaign tags or the referring site), to credit sales to it | 30 days |
| sf_aff, sf_wh | Keeps affiliates and wholesale buyers signed in to their portal | 180 days |
| sf_dnonce, sf_dverify, sf_dverify_q | Linking your Discord account to a purchase | 30 minutes at most |
| sf_preview, sf_seller, sf_store_preview, sf_dev_theme | Previews for the store's own team | 24 hours at most |
Stores also keep a few things in your browser's storage: your recent searches, announcements and pop-ups you closed, your consent choice (sf:consent), and, only as described under Buyers and store visitors, the analytics visitor ID (sf:vid). Tools a store adds, such as analytics or chat widgets, set their own cookies; the store's consent banner and privacy policy describe them. The sf_src and sf_ref cookies only remember where a visit came from for the store's own statistics; stores that serve visitors in the EU or the UK should include them in their consent banner.
Changes to this policy
We update this policy when what we do with personal data changes. The date at the top shows the last change. If a change matters for you, we tell you by email or in the dashboard before it takes effect.
Contact and representatives
Swifty LLC1942 Broadway St. STE 314C, Boulder, CO 80302, United StatesRegistered in Colorado, United States, number 20241506844[email protected]Our representative in the EU (Art. 27 GDPR): being appointed; until then, write to [email protected].
Our representative in the UK (Art. 27 UK GDPR): being appointed; until then, write to [email protected].
For anything that is not about personal data, write to [email protected].