Privacy Policy
Last updated: June 2026
This Privacy Policy is a general template. It is not legal advice. Please have a qualified lawyer review it before publication.
1. Who we are
Short-site ("we", "us") operates the website www.short-site.com and the related Service that lets sellers publish a simple public store page. This policy explains what personal data we process, why, and your rights.
2. Data we collect
- Account data: email address, authentication identifiers, and password hashes (handled by our authentication provider).
- Profile data: display name and any details you choose to add.
- Store and product content: store name, descriptions, contact details you publish, product information, and images you upload.
- Consents: a record of the legal terms you accepted at onboarding, with timestamp and version.
- Usage and analytics: basic, privacy-respecting metrics such as page views of your store, used to show you simple stats.
- Technical data: IP address, browser, device, and similar information collected in server logs for security and abuse prevention.
- Abuse reports: when a buyer reports a store, we store the store identifier, the reason given, and the reporter's IP address, used solely for abuse prevention and platform safety.
- Cookies and local storage: see our Cookies Policy.
3. How we use your data
- To create and maintain your account and store, and to display your public store page to people with your link.
- To enforce our Terms, Acceptable Use Policy, and Seller Agreement, and to keep the Service secure.
- To provide basic analytics to you about your own store.
- To send service-related communications (e.g. security alerts, important changes).
- To comply with legal obligations.
4. Legal bases (GDPR)
- Contract: to provide the Service you signed up for.
- Consent: for the consents collected at onboarding and any optional features.
- Legitimate interests: to secure the Service, prevent abuse, and improve reliability.
- Legal obligation: when we must retain or disclose data by law.
5. Sharing your data
We do not sell your personal data. We share data only with the following service providers that help us operate Short-site, each acting as a data processor under a Data Processing Agreement:
- Supabase (supabase.com) — database, authentication, and file storage, hosted in the EU.
- Stripe (stripe.com) — payment processing. Stripe is PCI DSS compliant.
- Anthropic (anthropic.com) — AI-powered support chat. Only your chat messages are sent; no account data is shared.
- ImprovMX (improvmx.com) — email forwarding for support@short-site.com.
We may also disclose data when required by law or to protect the rights and safety of users.
6. Public information
Information you publish on your store page (store name, description, images, contact details, products) is public by design: anyone with the link can view it. Store pages are not indexed by search engines. Do not publish anything you are not comfortable making public.
7. International transfers
Your data may be processed in countries outside your own. When that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
8. Retention
We keep your data while your account is active. When you delete your account:
- Your profile, stores, products, and analytics data are deleted immediately.
- Your uploaded images and files are deleted from storage within 24 hours.
- Your legal consent records are retained for up to 3 years to demonstrate compliance with our obligations.
- Abuse reports containing your IP address are retained for up to 12 months for safety purposes, then deleted or anonymized.
- Payment records are retained by Stripe per their own retention policy and applicable financial regulations.
9. Your rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten").
- Export your data in a portable format.
- Object to or restrict certain processing.
- Withdraw consent at any time (without affecting processing already carried out).
- Lodge a complaint with your local data protection authority.
You can exercise most of these rights directly from your Account page (export and delete), or by emailing support@short-site.com.
In Romania, you may also lodge a complaint with the national data protection authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) at www.dataprotection.ro.
10. Children
The Service is not directed at children. You must be at least 18 to use Short-site. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Security
We use reasonable technical and organizational measures to protect your data, including encryption in transit and access controls. No method of transmission or storage is 100% secure, however.
12. Changes
We may update this policy from time to time. Material changes will be announced through the Service or by email.
13. Contact
For privacy questions or requests, email support@short-site.com.
Last updated: July 2026