Privacy Policy

1. Who we are

Storepairing is operated by Foresight ehf. (registration number 430226-1180, VAT number 160518), registered in Iceland. We are the data controller for the personal data described below.

2. What we collect

Online sellers: business name, email, password (stored hashed, never in plain text), a legal contact person, website, and a legal/business registration ID with a link to the official registry entry.

Pickup locations: the above except website, plus address, postal code, phone number (optional), opening hours (optional), and up to four photos (map location, building front, counter, storage area) used only to help confirm the location during review, never shared or published.

Customers (of our online sellers): name, phone number, and postal code/address, passed to us by an online seller solely to route and complete a delivery. If an online seller connects a Shopify store, this data is read automatically from the shipping details of orders placed through that store, rather than entered by hand. We are not the party a customer buys from, the online seller is.

3. Why we collect it, and legal basis

To perform the contract with you (creating your account, routing and completing deliveries), to verify legal identity for review/approval, and to meet legal obligations. Where none of those apply, we rely on legitimate interest (e.g. fraud prevention) or your consent.

4. Who we share it with

We use third-party services to run Storepairing, each acting as a data processor on our behalf: hosting and infrastructure (Vercel), transactional email (Resend), address lookup for delivery routing (Google Maps Geocoding API), payment processing (a licensed third-party payment processor), and, for online sellers who choose to connect a Shopify store, Shopify Inc. as the source of order shipping details (customer name, phone, and address) needed to create a delivery. We only request the minimum order/shipping scope needed for this, never full order or payment details, and this connection is entirely optional. We do not sell personal data, and we do not share it with anyone for their own marketing purposes. Each of these processors acts under its own standard data-processing terms as a condition of providing its service to us.

5. How long we keep it

We keep account and delivery records for as long as the account is active. Records tied to a financial transaction (a delivery charge, a top-up) are kept for seven years after the close of the accounting year they fall in, as required by Iceland's Accounting Act (Act No. 145/1994) for bookkeeping records. Other personal data not covered by that requirement, including registration details and customer delivery data, is deleted within 90 days of account closure or a verified deletion request, except where we are required to keep it longer to comply with the law or resolve an active dispute.

6. How we protect it

Customer contact details (name, phone, address) are masked by default in our dashboard. Full, unmasked values are only visible to staff who need them for that specific purpose (e.g. resolving a delivery issue). Everyone else only ever sees a masked form (e.g. "J*** S***"). Passwords are stored hashed, never in plain text.

7. Your rights

As an EEA resident, you have the right to access, correct, or request deletion of your personal data, and to object to or restrict certain processing. To exercise any of these, email us at the address below.

8. Shopify data requests

If an online seller disconnects or uninstalls our Shopify integration, or a customer exercises a data request or deletion right directly with Shopify, we receive and act on Shopify's standard compliance notifications: a shop-level disconnect clears our stored connection details for that store automatically, and a customer-level data or deletion request is reviewed and actioned by us within Shopify's required 30-day window. Contact us at the address below to make either request directly.

9. Contact

Questions about this policy, or a data request? Email support@storepairing.com.