Last updated: October 3, 2026
This policy explains how YourFirstStore collects, uses, shares, and retains information when merchants and their customers use the platform. It also explains how to contact us about your information.
Account Information
When you create a merchant account, we collect your email address and password, which we store as a password hash. We also collect your store details and settings, and record when and which version of our Terms of Service you accepted. If you buy a domain, we collect the legal registrant name, organization (if supplied), email, phone number, and postal address needed for registration.
Payment Information
Payment processing is handled entirely by Stripe. We do not store credit card numbers or sensitive payment details on our servers. Stripe's collection and use of your payment data is governed by the Stripe Privacy Policy.
Usage Data
We automatically collect information about how you interact with the Platform, including pages visited, features used, browser type, IP address, and device information. This helps us improve the service and provide analytics features.
If you allow measurement, we use first-party analytics on our marketing pages to understand the steps from a visit to a store launch. We store a random visitor identifier in your browser and record the landing page, campaign parameters, referring website hostname, and actions such as previewing a store or signing up. We do not include store ideas, email addresses, or full referring URLs in these events. We honor browser Do Not Track and Global Privacy Control signals for this tracking.
If you register after allowing measurement, we connect the visitor identifier to your account to count setup milestones, a first paid store order, and a later paid subscription invoice in aggregate reports. You can turn measurement off below; we then remove this browser's recorded visitor events when online.
Store Customer Data
When customers place orders on stores hosted on our Platform, we process order information including customer names, email addresses, shipping addresses, and order details on behalf of the store owner.
AI Feature Data
When you use AI features, we process the prompts and relevant store content needed to answer them. This can include product and store details, analytics summaries, and messages sent to a store's AI shopping assistant. Messages sent to our support inbox may also be classified by Gemini so we can answer common questions quickly. Please avoid entering sensitive information that is not needed for the task.
We use essential cookies to keep you signed in and maintain your session. If you allow first-party marketing analytics, we use browser local storage for a random visitor identifier and campaign attribution. We also remember your measurement choice locally so it continues to apply on later visits. We do not use tracking cookies for advertising. Store customers may receive cookies related to shopping cart functionality.
Marketing measurement: your choice has not been set
You can change your choice at any time. Turning measurement off removes this browser's recorded visitor events when online. Browser Do Not Track and Global Privacy Control signals override an earlier opt-in.
We share information with the following third-party services as necessary to operate the Platform:
Some of these providers may process information outside Australia. Contact us for more information about the providers and locations relevant to your data.
We do not sell your personal information to any third parties.
We retain account and store data while the account is active and as needed to operate the service. Cancelling a store subscription does not delete that data. You may start account closure and request deletion of eligible data from your signed-in account page, or email us. We review what can be deleted and what must be retained for legal, tax, fraud prevention, transaction, or domain registration purposes; we will explain the outcome of your request.
Order records may be retained for store records and tax or legal compliance. Domain contact information may be retained while a registration or transfer remains active. Backups may retain data for a limited period after deletion from the live service.
We implement industry-standard security measures to protect your data, including encryption in transit (TLS/SSL), secure password hashing, and access controls. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
Depending on your jurisdiction, you may have the right to:
To exercise any of these rights, please contact us at the email address below.
The Platform is not intended for children under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete that information.
We may update this Privacy Policy from time to time. We will post the updated policy and change the “Last updated” date. We will give notice of material changes where practicable.
If you have questions about this Privacy Policy or your personal data, please contact us at [email protected].