Privacy Policy

This Privacy Policy explains how ururu LLC collects, uses, and discloses personal information. ururu plays two different roles, and your rights depend on which applies:

• —As a business/controller — for information about merchants who sign up for ururu and visitors to ururu.store. This policy governs that information.
• —As a service provider/processor — for information about shoppers that merchants collect through their stores. There, the merchant is the business/controller and their own privacy policy governs; ururu only processes that data on the merchant’s behalf to operate their store (see Section 5 and our Data Processing Addendum).

1. Information We Collect From Merchants and Visitors

• —Account information — your email address, store name, chosen subdomain, and authentication credentials (sign-in links and passkeys).
• —Subscription information — billing details processed by Stripe; we store identifiers and subscription status, not full card numbers.
• —Store and connected-service data — content you create and tokens for services you connect (for example, Stripe, Shippo, or Instagram), used to provide the features you enable.
• —Usage and device data — basic logs, IP address, and browser information collected when you use the dashboard, used for security and to operate the Service. Our own analytics are first-party and cookieless; we do not use third-party advertising trackers on the dashboard or marketing site.

2. How We Use Information

• —To provision, operate, and secure your store and account.
• —To process your subscription and send service-related emails.
• —To provide features you enable (payments, shipping, integrations).
• —To detect, prevent, and respond to fraud, abuse, and security issues.
• —To comply with legal obligations.

We do not sell your personal information or share it for cross-context behavioral advertising, and we do not use the contents of your store or your customers’ data to advertise to you.

3. Service Providers (Subprocessors)

• —Cloudflare — hosting, storage, and content delivery for the storefronts, store content, and images.
• —Vercel — hosting for the ururu.store dashboard and marketing site.
• —Turso — the database that stores account and store metadata.
• —Stripe — subscription billing and, via Stripe Connect, merchant payment processing.
• —Resend — delivery of transactional email, including merchant sign-in links and the order-confirmation and notification emails ururu sends to shoppers on a merchant’s behalf.
• —Integration providers you enable — third-party services a merchant chooses to connect (for example, Shippo for shipping or Meta/Instagram for marketing).

A current list of subprocessors that process shopper data on a merchant’s behalf is maintained in the DPA, which also describes how we notify merchants of changes.

4. Data Retention

We keep account and store information for as long as your account is active and as needed to provide the Service, then for a reasonable period afterward to meet legal, accounting, and security obligations. You can ask us to delete your account; some records may be retained where the law requires.

5. Shopper and Affiliate Data (ururu as Service Provider/Processor)

When a shopper buys from a store on ururu, the merchant — not ururu — is the business responsible for that shopper’s personal information. ururu processes shopper data (such as names, shipping addresses, and order details) only to operate the merchant’s store: to take orders, process payments through the merchant’s Stripe account, calculate shipping, and send order notifications, and only on the merchant’s documented instructions as set out in the DPA. Each store publishes its own privacy policy describing how that merchant handles shopper data. Shoppers with questions or data requests should contact the store they purchased from; ururu will support merchants in responding to such requests.

If a merchant enables the affiliate program, ururu also collects and processes limited information about that merchant’s affiliates — such as the affiliate’s name, email address, and payout (Stripe) account — on the merchant’s behalf, solely to record referred sales and administer commission payouts.

6. The ururu POS App (In-Person Sales)

ururu POS is a phone app a merchant uses to take card payments in person with Tap to Pay. A phone is connected to one store using a single-use pairing code issued from that merchant’s own dashboard; the app has no separate account and no sign-in of its own.

As with online orders, the merchant — not ururu — is the business responsible for the personal information of shoppers who buy in person, and ururu processes it on the merchant’s behalf under the DPA. In that role, the app and the services behind it handle:

• —Payment card data — read entirely by the phone’s built-in contactless payment system and by Stripe. Card numbers never reach the app or ururu’s servers; ururu receives only a Stripe payment identifier and the amount.
• —Shopper email address — optional. If a shopper asks for a receipt, the address is passed to Stripe, which sends it. If the merchant has turned on the mailing-list question and the shopper opts in, ururu also stores that address for that merchant so they can market to their own customers. Consent is recorded per store and an address is never shared between stores.
• —Device location — the app asks for location permission because Stripe’s card-reader software requires it to connect a reader and to help detect fraud. ururu itself does not read, store, or receive the device’s location.
• —Paired-device credential — a token identifying that phone to the merchant’s store, held on the device in the system keychain and on our servers only as a hash, alongside a device label the merchant chooses. The app uses no advertising identifier and contains no analytics, advertising, or tracking software.
• —Order information — the app shows the merchant their own orders, which can include a shopper’s name, email address, shipping address, and pickup code, so the merchant can fulfil orders and hand them over.

A merchant can disconnect a phone at any time from the app’s settings, or revoke it from their dashboard; either invalidates that device’s credential.

7. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, and to opt out of certain processing. Residents of California and other US states with privacy laws have rights under those laws, including the right not to be discriminated against for exercising them. We do not “sell” or “share” personal information as those terms are defined under California law.

To exercise a right, email privacy@ururu.store. We will verify your request (for example, by confirming control of the email associated with your account) and respond within the time required by applicable law, generally within 45 days. If you are a shopper, please contact the store you purchased from; as a service provider, ururu will assist that merchant in responding.

8. Cookies and Analytics

The dashboard uses cookies that are strictly necessary to keep you signed in. Our analytics are first-party and cookieless, so the dashboard and marketing site do not require a cookie-consent banner. Individual stores may use additional cookies or tracking technologies — for example, the Meta (Facebook) Pixel — if the merchant enables them; those are governed by the merchant’s own store privacy policy, and the merchant is responsible for any consent those technologies require.

Where a merchant has enabled the Meta Pixel, every page of that store carries a “Your Privacy Choices” link that turns the pixel off for your browser. We honor the Global Privacy Control browser signal automatically, and we do not load the pixel at all for visitors in the European Economic Area, the United Kingdom, or Switzerland.

Stores hosted on a ururu.store address share a single web domain. A cookie set on that domain by a tracking technology a merchant has enabled — for example the Meta Pixel’s browser identifier — is therefore readable by that same technology on other ururu.store stores. Where more than one merchant has enabled the Meta Pixel, Meta may receive the same browser identifier from each of them and may recognize a visitor across those stores. Merchants cannot see one another’s visitors or data, and ururu does not use this identifier to link shoppers or to combine information between stores. A store served on the merchant’s own custom domain does not share it.

9. Children

The Service is a tool for businesses and is not directed to children under 13, and we do not knowingly collect personal information from children. Stores hosted on ururu are responsible for their own compliance with laws protecting children, including where they knowingly deal with minors.

10. International Transfers

We operate in the United States and process information there. If we begin serving users outside the United States, we will update this policy and adopt appropriate transfer safeguards at that time.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the dashboard or by email, and the “Last updated” date above will change.

12. Contact

Questions or privacy requests? Contact us at privacy@ururu.store.