Privacy policy

This policy explains what Mastore HQ ("Mastore", "we") collects, why, and what we do with it. Mastore is operated by Salekh Ventures Ltd, registered in England and Wales, company number 16500570, registered office 66 Gladstone Road, Sparkbrook, Birmingham, England, B11 1LW. We are the data controller for the information described here. Contact: security@mastorehq.com.

What Mastore is

Mastore is a multi-channel inventory and listing service for online sellers. A seller connects their marketplace accounts, and Mastore keeps their listings, stock and prices consistent across those marketplaces on their instruction.

Information we collect

• Account information. Your email address and, if you choose one, a password, so you can sign in. Your workspace name.
• Marketplace connections. When you authorise Mastore on a marketplace, the marketplace gives us an access token for your account. We store it encrypted and use it only to perform the actions you have asked for. We never see or store your marketplace password.
• Listing and stock data. Your products, listings, prices, quantities and cost prices, imported from your marketplaces or entered by you.
• Order data needed for stock. When an item sells, we record the marketplace's order and line identifiers, the item, the quantity and the price, so stock can be updated. We do not store buyer names, delivery addresses, email addresses or phone numbers.
• Service logs. Technical records of requests to our service, including IP addresses, for security and troubleshooting. Retained for 30 days.
• Billing. Payment card details are collected and held by our payment processor, Stripe. We store only your plan, your subscription status and the last four digits of the card.
• Where you found us. If you arrived from one of our ads or social posts, the short campaign tag in that link (for example "tt-mastore"), stored with your workspace. It identifies the ad, not you.
• Survey answers. If you answer a one-click question in one of our emails (for example how disappointed you would be without Mastore), we store your answer against your workspace.

Why we use it, and the legal basis

• To provide the service you signed up for: performance of a contract.
• To keep the service secure and to investigate abuse: our legitimate interests.
• To bill you and to keep accounting records: performance of a contract and legal obligation.
• To tell you about changes to the service, and to send emails about your trial, your plan and your weekly sales: performance of a contract. You can turn the weekly email off in your account. We do not send marketing email without consent.
• To learn which of our ads bring sellers to Mastore: your consent, given in the cookie banner. You can withdraw it at any time by clearing the "mastore_consent" cookie, which brings the banner back.

Marketplace data and platform policies

Data received from a marketplace is used only to provide Mastore's service to the seller whose account it came from. We do not pool it across sellers, sell it, or use it for advertising. Where a marketplace's developer policy imposes stricter requirements than this policy, we follow the stricter requirement.

Who we share it with

• The marketplaces you connect, to carry out your instructions.
• Service providers who host and run Mastore: Supabase (database, hosted in London), Vercel (application hosting and background jobs), Stripe (payments) and Resend (email delivery). Each is bound by contract to process data only on our instructions.
• Only if you accept advertising cookies: Meta Platforms Ireland and TikTok, through their pixels, which tell them that a visit, a sign-up or a plan choice came from one of our ads. We never pass them your name, email or any marketplace data.
• Only if you connect one: the AI assistant you choose (Claude, from Anthropic, or ChatGPT, from OpenAI). See "Claude, ChatGPT and other AI assistants" below.
• Authorities, where the law requires.

We do not sell personal data.

Claude, ChatGPT and other AI assistants

A workspace owner can connect an AI assistant to Mastore, so they can manage their shop by chatting. It is optional, and off until the owner connects it.

• How it connects. The owner signs in to Mastore and approves the connection on a Mastore page. The assistant never sees your Mastore password or your marketplace logins. It gets its own Mastore sign-in, which lasts an hour at a time and renews while the assistant is in use (it lapses if unused for 30 days). It can act only in that one workspace, and only while the owner is still its owner.
• What it receives. Only what your requests in the chat ask for: your products, stock, prices, photos, listings, sales totals, returns (with the marketplace's order number and the reason given) and recent activity. Mastore does not send it buyers' names, addresses or contact details.
• What it can do. The same things you can do in Mastore: add and edit products, add photos, change stock and prices, publish and end listings, and decide returns. It asks you before removing a product or ending a listing. Every change is recorded in your activity, as if you had made it.
• Photos you send it. Photos you add through the assistant are stored with your products, as if you had uploaded them in Mastore.
• Your chats. Your conversation is held by the assistant's provider under its own privacy policy (Anthropic or OpenAI), not by Mastore. Mastore keeps only the changes made in your workspace.
• Turning it off. On the AI assistants page in Mastore, "Disconnect AI assistants" signs every connected assistant out at once. You can also remove Mastore from the assistant's own settings.

International transfers

Your data is stored in the United Kingdom or the European Union. Some providers operate globally; where data leaves the UK, we rely on the UK International Data Transfer Agreement or adequacy regulations.

How long we keep it

• Account, catalogue and stock data: for as long as your account is open, then deleted within 30 days of closure.
• Order identifiers: 12 months, for stock reconciliation and dispute resolution.
• Marketplace tokens: deleted immediately when you disconnect a marketplace, and when your account closes (30 days after you ask to close it).
• Service logs: 30 days.
• Billing records: 6 years, as UK tax law requires.

Marketplace account deletion requests

If a marketplace notifies us that a user has deleted their marketplace account, we delete the data we hold that came from that account within 30 days and record that we did so.

Security

Marketplace tokens are encrypted at rest with keys held outside the database. All traffic is encrypted in transit. Access to production systems requires multi-factor authentication. We will notify affected sellers and any marketplace whose policy requires it without undue delay after becoming aware of a breach.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to or restrict processing, and ask for it in a portable form. Email security@mastorehq.com. You can also complain to the Information Commissioner's Office at ico.org.uk.

Cookies

Strictly necessary cookies, used whatever you choose:

• Sign-in cookies set by Supabase, to keep you signed in.
• A short-lived cookie that protects marketplace connections against forgery.
• "mastore_ws", which remembers the workspace you chose if you belong to more than one.
• "mastore_consent", which remembers your cookie choice for 6 months.

Advertising cookies, only if you press Accept: the Meta pixel ("_fbp") and the TikTok pixel ("_ttp" and related), which measure which ads bring sellers to Mastore. Press Reject and neither pixel loads.

Changes

We will post changes here and, for material changes, email account holders before they take effect.