Privacy Policy

Last updated: 2 November 2026

1. Controller

ShopsDoor is operated by Namez AB, organisation number 559295-1007, Hagavägen 36, 784 40 Borlänge, Sweden, Sweden. Namez AB is the data controller for the personal data described in this policy. Contact: [email protected].

This policy explains how we process personal data when you visit shopsdoor.com, create a Seller account, or interact with a store hosted on ShopsDoor. Each Seller is a separate controller for the data of its own Customers (see section 7).

2. What data we process

• Account data – name, email address, password (hashed), language, two-factor settings, company details you enter.
• Store data – store name, domains, products, settings and the content you publish.
• Billing data – subscription plan, invoices and payment status. Card details are entered directly with Stripe and never reach our servers.
• Usage and security data – IP address, device and browser information, login events, security events and server logs.
• Communication – messages you send us through the contact form or by email.
• Customer data processed for Sellers – names, addresses, email addresses, phone numbers, order history and payment status of a store’s customers.

3. Why and on what legal basis

• Providing the Service (account, store, dashboard, payments, support) – performance of a contract, Art. 6(1)(b) GDPR.
• Billing and accounting – legal obligation (Swedish Accounting Act), Art. 6(1)(c).
• Security, fraud prevention and abuse handling – legitimate interest, Art. 6(1)(f).
• Service emails such as order notifications, password resets and important changes – performance of a contract.
• Marketing emails – only with your consent, Art. 6(1)(a); you can withdraw it at any time.
• Analytics cookies – consent, where used (see section 8).

4. Recipients and processors

We share personal data only with providers that help us run the Service, under data processing agreements:

• Stripe – payment processing and Seller payouts. Stripe is an independent controller for the data it needs to process payments; see stripe.com/privacy.
• Hosting and infrastructure providers within the EU/EEA for servers, databases, backups and file storage.
• Email delivery providers for transactional emails.
• Authorities, when we are legally obliged to disclose data.

Where a provider processes data outside the EU/EEA, we rely on an adequacy decision or the EU Standard Contractual Clauses.

5. Retention

• Account and store data: for as long as your account exists, then deleted within 90 days of closure unless we must keep it.
• Invoices and accounting records: 7 years after the end of the financial year, as required by Swedish law.
• Security and server logs: normally 12 months.
• Contact-form messages: up to 24 months after the matter is closed.
• Customer data inside a store: as instructed by the Seller, and deleted when the Seller deletes it or closes the store.

6. Your rights

Under the GDPR you have the right to access, rectify and erase your personal data, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. Contact us at [email protected] and we will answer within one month. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or the supervisory authority in your country.

7. Customers of stores hosted on ShopsDoor

When you buy from a store on ShopsDoor, the Seller who runs that store is the controller of your order data and decides why and how it is used. Namez AB processes that data as the Seller’s processor, solely to run the store (checkout, order emails, order history). Direct any request about your order data to the Seller first; we help the Seller fulfil it. Your payment is processed by Stripe.

8. Cookies

shopsdoor.com and the dashboard use strictly necessary cookies for login sessions, security (CSRF), language and consent preferences. Stores hosted on ShopsDoor use necessary cookies for the shopping cart and checkout. Optional analytics or marketing cookies are only set after you give consent through the cookie banner, where a Seller or we use them. You can withdraw consent through the banner or delete cookies in your browser; necessary cookies cannot be disabled without breaking the service.

9. Security

We protect data with encryption in transit (TLS), hashed passwords, optional two-factor authentication, access controls, audit logging and regular backups. No system is completely secure; tell us at [email protected] if you believe your data has been compromised.

10. Children

The Service is not directed at children under 16 and we do not knowingly collect their data.

11. Changes

We may update this policy. The date at the top shows the latest version; material changes are announced by email or in the dashboard.

12. Contact

Namez AB, Hagavägen 36, 784 40 Borlänge, Sweden, Sweden – [email protected].