Privacy Policy | Store Steward

Legal operator

Store Steward is a trading name used by Bruno Ponce de Leão, the business operator and data controller established in Portugal.

What this policy covers

This policy explains how Store Steward handles personal data when you:

visit storesteward.com;
contact Store Steward;
purchase a Store Check;
submit or approve a Single Fix request;
receive a service or communicate about one;
receive an individual business introduction from Store Steward.

It does not replace the privacy policy of your own Store or the policies of Shopify, Stripe and other services you choose to use.

Personal data we collect

Information you provide

Depending on your interaction with Store Steward, we may collect:

your name, role and work email;
the name of your Store;
your public Store URL;
the permanent myshopify.com address when Shopify access is required;
information about the affected page or problem;
the result you expect;
screenshots, recordings or other evidence you choose to send;
correspondence, approvals and service instructions;
billing details and payment status.

Do not send passwords, authenticated sessions, authentication codes, customer information or other sensitive data.

Website and security information

The hosting provider may process technical information needed to deliver and protect the website. This can include an IP address, browser information, request time and server or security logs.

At launch, Store Steward does not use analytics cookies, advertising cookies, pixels or behavioral profiling.

Information from public business sources

Store Steward may use limited professional information available on public business websites, Store websites and professional profiles. This may include a business contact's name, role, professional email, company and public Store URL.

We use this information only for relevant, individual business contact. Store Steward does not use automated outreach, purchased mass mailing lists or email open tracking.

You can object to this contact at any time by replying to the message or emailing hello@storesteward.com.

How we use personal data

Store Steward processes personal data for the following purposes and legal grounds.

To respond and prepare a service

We use contact and Store information to answer questions, review a request and prepare a proposed scope.

The legal ground is taking steps at your request before entering into a contract and Store Steward's legitimate interest in managing genuine business inquiries.

To provide a service

We use the information needed to deliver a Store Check or an approved Single Fix, communicate about the work, document approvals, test the agreed result and provide the relevant report.

The legal ground is performance of the service contract.

To process payments and keep financial records

Stripe processes payment card information. Store Steward does not receive your full card number or card security code.

Store Steward receives the payment status, amount, currency, billing information and transaction references needed to confirm the purchase and keep business records.

The legal grounds are performance of the contract and compliance with accounting and tax obligations.

To operate and protect the business

We may keep limited records to protect the website, prevent misuse, maintain service history and establish, exercise or defend legal claims.

The legal ground is Store Steward's legitimate interest in operating and protecting the business.

To make relevant business introductions

Store Steward may contact a business when a public Store appears relevant to its services. Contact is individual and based on limited professional information from public sources.

The legal ground is legitimate interest where this contact is permitted by applicable law. You have the right to object at any time and without charge.

When you give permission

Store Steward asks for express written permission before publishing identifiable client work, testimonials, screenshots or before and after evidence.

You may withdraw permission for future use. Withdrawal does not make earlier lawful use invalid.

Store Check information

A Store Check requires:

contact name and work email;
Store name and public URL;
confirmation that the storefront will remain publicly accessible during the review;
payment confirmation.

The review covers the published storefront. Store Steward does not request Shopify Admin access or make changes to your Store.

Single Fix information and Shopify access

A Single Fix request may include contact details, the affected page, visible symptoms, relevant conditions, the expected result and optional screenshots or recordings.

If the request is accepted, Store Steward records the approved scope, price, payment, permissions, testing evidence and written publication approval.

Shopify access is requested only after the scope is approved and payment is confirmed. Store Steward sends a collaborator request through its own Shopify Partner account and requests only the permissions needed for the agreed work.

Store Steward never asks for your Shopify password, an authenticated session, a two-factor authentication code or a shared account.

When Shopify requires a four-digit collaborator code, Store Steward uses it only to send the request. We then delete it and never include it in a service report or permanent project record.

Store Steward does not request access to customers, orders, payments, billing, finances or users for the Single Fix services offered at launch.

If personal data becomes incidentally visible during authorized work, Store Steward does not copy or use it unless this is strictly necessary for the approved service. Work that requires processing customer data must be separately assessed and agreed before it proceeds.

Store Steward removes collaborator access after the guarantee and once the work is closed, unless another service or continuing access has been expressly approved.

Who receives personal data

Store Steward shares personal data only when needed with:

Hostinger, for website hosting and business email;
Stripe, for payment processing;
Shopify, when collaborator access is required;
accounting, legal, document storage or technical providers used to operate the business;
a freelancer who has been identified and approved by the client in writing;
public authorities when disclosure is required by law.

An approved freelancer must use an individual account and receives only the information and access needed for the assigned work.

Store Steward does not sell or rent personal data.

You can read the relevant provider information in the Hostinger Privacy Policy, Stripe Privacy Center and Shopify Privacy Policy.

International transfers

Some providers operate in several countries and may process personal data outside the European Economic Area.

Where the GDPR applies, these transfers must rely on an adequacy decision, Standard Contractual Clauses or another lawful safeguard. You can contact Store Steward for information about the safeguard relevant to your data.

How long we keep personal data

Store Steward applies the following retention periods:

inquiries that do not become paid work are kept for up to 12 months after the last substantive contact;
professional outreach records are reviewed or deleted within 12 months after the last contact;
a minimal suppression record may be retained to respect an objection to future contact;
project correspondence, approvals, reports and evidence are normally kept for up to 24 months after the service closes;
information needed for a legal claim may be kept for the applicable limitation period;
invoices, payment records and supporting tax documents are kept for 10 years when Portuguese law requires it;
collaborator codes are deleted after the request is sent;
files received by mistake that contain credentials or unrelated sensitive information are deleted as soon as they are identified;
technical logs follow the hosting provider's security and retention settings.

Store Steward may anonymize data instead of deleting it when it can no longer identify a person.

Public examples and client work

Store Steward's initial public samples use controlled work created with the Tern & Oak test Store. They do not represent a commercial client or a client result.

Store Steward does not make real client work, testimonials, reports, screenshots or before and after evidence public without express written permission.

Security

Store Steward limits access to personal data and uses individual accounts, minimum Shopify permissions and two-factor authentication where supported.

No online system can guarantee absolute security. If you believe personal data has been exposed or misused, contact hello@storesteward.com.

Your rights

Depending on the law that applies, you may have the right to:

access your personal data;
correct inaccurate or incomplete data;
request deletion;
restrict processing;
receive data in a portable format;
object to processing based on legitimate interests;
object to direct marketing at any time;
withdraw consent where processing depends on consent.

Send requests to hello@storesteward.com. Store Steward may request enough information to confirm your identity.

Store Steward handles requests without undue delay and normally within one month. This period may be extended when a request is complex or Store Steward receives numerous requests, as permitted by law.

You may also lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados.

Automated decisions and children

Store Steward does not use personal data for automated decisions or behavioral profiling.

The services are intended for businesses and are not directed at children.

Changes to this policy

Store Steward may update this policy when its services, providers or legal obligations change. The current version and its last updated date will remain available on this page.