Privacy Policy

This policy explains what we do with personal data when you visit this website or subscribe to the service. It is about you, our customer.

If you are a shopper who bought from a shop built on this platform, the shop is the controller of your data, not us. Read that shop's own privacy policy, and contact the shop to exercise your rights. We process that data only on the shop's instructions — see our Data Processing Agreement.

1. Controller

1.1 SetupShop Ltd, trading as SetupShop, is the controller of the personal data described here.

1.2 Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

1.3 Privacy enquiries: raise a ticket at support.setupshop.online, or write to the registered office above.

2. What we collect about you

Category	Data
Account	Your name, email address and password (stored hashed).
Your shops	Shop name, address, subdomain or custom domain, plan and settings.
Billing	Subscription, invoices, payment outcomes, and the last digits and type of the card used. We do not receive or store full card numbers.
Stripe connection	Your Stripe account identifier and whether it can take payments, so we can tell you when something needs your attention.
Facebook connection	Where you connect one: your Facebook user identifier, the Page you chose and its name, any Instagram business account linked to that Page, and the access tokens Meta issues us. We use them only to publish the posts you set up, and we never see your Facebook password.
Support	Messages you send us and our replies.
Technical	IP address, browser and device information, and pages visited on this website.

3. Why we use it, and our legal bases

Purpose	Legal basis
Providing the service, hosting your shops and supporting you	Performance of a contract
Taking payment and keeping billing records	Performance of a contract; legal obligation
Keeping accounting and tax records	Legal obligation
Securing the service, preventing fraud and abuse	Legitimate interests: protecting the platform and its customers
Understanding how the website and service are used, in aggregate	Legitimate interests: improving what we offer
Sending service messages about your account, billing or outages	Performance of a contract
Sending marketing about the platform	Consent, or our legitimate interest in marketing to existing business customers; withdrawable at any time
Non-essential cookies	Consent

4. Marketing

4.1 Every marketing email carries an unsubscribe link, and you can change your preference in your account.

4.2 Unsubscribing does not stop service messages about your account, billing or security. Those are part of providing the service and cannot be opted out of while you have an account.

5. Cookies

5.1 This website uses cookies. What they are and how to control them is set out in our Cookie Policy.

6. Who we share it with

6.1 We do not pass your personal data to another company to use for its own purposes. The service runs on infrastructure operated by the supplier below, so your data is stored on their equipment. They act only on our instructions, under a contract holding them to the same duties we owe you:

Supplier	What for
20i Limited	Hosting the servers the service runs on, including the database and the mail server

6.2 We also share data where required by law, and in connection with a sale or reorganisation of our business.

6.3 We do not sell personal data.

6.4 Where you connect a Stripe account to a shop, Stripe receives personal data in connection with that account and processes it under Stripe's Privacy Policy.

6.5 Where you connect a Facebook Page, Meta receives the posts we publish on your behalf and the requests we make to identify your Pages, and processes data under Meta's Privacy Policy. What we send is the content you created in your shop. We do not send your Shoppers' personal data to Meta.

7. International transfers

7.1 Some suppliers process personal data outside the United Kingdom.

7.2 Where data goes to a country without an adequacy decision, we rely on standard contractual clauses or another lawful transfer mechanism. Details on request.

8. How long we keep it

Data	Retained for
Billing and tax records	The period required by law, ordinarily six years.
Your account	While you have a subscription, and 12 months after your last one ends.
Shop data	30 days after a subscription ends, then deleted from live systems.
Facebook connection	Until you disconnect it, remove our application from your Facebook account, or ask Meta to delete your data — whichever comes first. We delete the connection and any post we had queued.
Support correspondence	2 years from the last message.
Website technical data	90 days, after which only daily totals that identify nobody remain.

9. Your rights

9.1 You have the right to be informed, of access, to rectification, to erasure, to restrict processing, to data portability, to object to processing based on legitimate interests, and to object to direct marketing at any time. Where we rely on consent you may withdraw it at any time.

9.2 To exercise a right, raise a ticket at support.setupshop.online or write to the registered office above. You do not need an account to do either. We respond within one month, extendable by two further months for a complex request; we will tell you if that applies.

9.3 We may ask for enough information to satisfy ourselves who you are.

9.4 Records we must keep by law are retained for the remainder of that period and used for nothing else.

10. Automated decision-making

10.1 We do not take decisions with legal or similarly significant effects about you by automated means alone.

11. Complaints

11.1 Please raise any concern with us first at support.setupshop.online or by post to the registered office above.

11.2 You may also complain to the Information Commissioner's Office, at ico.org.uk.

12. Changes

12.1 The current version is always on this page, with the date it last changed at the top. Where a change materially affects how we use your data we will tell you.