Plain-English privacy notice

Who controls the data

Storefront HQ is the controller. Privacy questions, objections and complaints can be sent to [email protected].

What is collected and why

For inbound requests: name, work email, company, public store URL, selected product, problem description and request history are used to assess fit, answer the enquiry, take payment and deliver the product or service. The lawful bases are steps requested before a contract and performance of a contract.

For public buyer-intent research: the system may store a public request URL, company name, store URL, role-address reply channel and a short excerpt. It does not harvest private contact details. The purpose is to respond to an explicit public request for relevant help; the basis is legitimate interests, balanced by source verification, channel rules, data minimisation and immediate objection handling.

Contact messages and feedback

Contact forms collect your name, email, topic and message, plus any optional company, public store URL or product context. Messages are stored privately on our Cloudflare-hosted site and emailed to our dedicated Google inbox so we can handle your request. A form submission does not verify email ownership, subscribe you to marketing or trigger an automatic email to the entered address.

Feedback forms also collect your rating, experience type and optional public display name. Your contact name, email and store URL are not included in the public review display. If you separately permit publication, we may display your chosen name, rating, feedback, product or free-tool context and submission month after moderation. Please do not include private information in your feedback text. Publication consent is optional and can be withdrawn by emailing us. We use your requested contact details to handle the enquiry or feedback; public review display relies on that separate permission.

Processors and sources

Public pages may be processed with Firecrawl. Email replies may be handled in a dedicated Google account. Calls may be booked through Cal.com. Payments and subscription status are processed by Stripe. Data comes from you, an explicit public buyer request, and those service events.

Retention

Unqualified research records are deleted within 30 days. Unsuccessful enquiries are deleted within 90 days. Contract, payment and delivery records are kept only as long as required for legal and accounting duties. A minimal suppression record may be kept to make sure an objection is honoured.

Contact and unpublished feedback records are removed from the site after 90 days. Published feedback is kept while permission remains valid and it remains relevant; email us to withdraw it. The notification email may remain in the business inbox under the same enquiry-retention policy, except where a contract, dispute or legal duty requires retention. Hashed anti-abuse counters are used to limit form spam and are cleared after their short operational window.

Your choices and rights

You can object to direct marketing at any time; the objection is effective immediately. You may also ask for access, correction, erasure, restriction or portability where applicable, and complain to the ICO. This site uses no advertising pixels or behavioural analytics.