Privacy Policy

Privacy

Privacy Policy Introduction

Maintaining your privacy is really important to us. You entrust us with your information, and we take that responsibility seriously.

We may modify or update this Privacy Policy from time to time to reflect the changes in our business and practices, and so you should review this page periodically. When we change the policy in a material manner we will let you know and update the ‘last updated’ header as below.

This Privacy Policy was last amended on September 4th 2026.

The September 2026 update corrected our stated inactive-account period, which previously said 120 days and applied only to free accounts, named Paddle rather than Braintree as our subscription payment provider, set out separately the cookies used on shops built with freewebstore, and added three disclosures to our sub-processor list: Api2Pdf, which renders order invoices, Resend, which sends merchant onboarding email, and Google’s role in address validation and in our own analytics export. On 9 September 2026 we recorded that the JavaScript library used by shops is now served from our own servers rather than Google’s, that Google Fonts are not contacted at all by shops using a system font, and disclosed the browser storage item used by the Freewebstore bar on free stores. The August 2026 update corrected our list of sub-processors, replaced references to the EU-US Privacy Shield with the transfer mechanisms now in force, and corrected our stated backup retention period. It may be updated in the future and we will post the new version here on our website. We will never deviate from our overall philosophy of maintaining your privacy, though.

1. General Information

Freewebstore Inc and freewebstore Ltd ("we", "us", "our") take security and privacy seriously. This Privacy Policy explains how we collect, store and use personal data when you browse www.freewebstore.com (the "freewebstore website") use the freewebstore application (“freewebstore control panel”) or otherwise provide your personal data to us. Please read this Privacy Policy carefully to understand how we will treat your personal data.

This Privacy Policy should be read together with our Terms of Service, which together apply to your use of the freewebstore website and freewebstore application known as the “freewebstore control panel”.

2. What Information We Collect About You

2.1 Your Personal Data

When we say your "personal data", we mean any information that identifies any person that you provide to us as a free customer, after you subscribe, or that is contained in any other information that you provide to us (or that you authorize a third party to give to us on your behalf).

Your "personal data" may also be contained in information that we collect about you in connection with your use of the freewebstore website and/or freewebstore control panel or otherwise interact with us for example by electronic mail.

When it comes to your personal data, we comply with our obligations under the General Data Protection Regulation and any other applicable data protection legislation from time to time.

Your personal data includes the information you provide, or that you authorize someone else to provide provide information in your account profile, on the freewebstore website (including any forms you complete), control panel, or during a support enquiry about you and/or your organization.

Examples of this personal data include your name, your email address, address including postcode which you provide to us when you set up your account and subsequently amend in the My Account section; and any correspondence when you contact us.

We shall periodically check that the personal data we store for you is accurate and update our records accordingly. If you would like to update the personal data we hold about you, please login to your freewebstore account or contact us via our contact page at https://freewebstore.com/contact.html with your request.

We do not knowingly collect or solicit any personal data from anyone under the age of sixteen or knowingly allow such persons to register for freewebstore. Freewebstore is not directed at children under the age of sixteen. In the event that we learn that we have collected personal data from a child under age sixteen without verification of parental consent, we will delete that information as quickly as possible.

2.2 Your Customer Data

You (the store owner) may store personal information about your own customers on freewebstore. You retain all rights and ownership to your Customer Data and you have ultimate control over who has access to it. Freewebstore will use its best endeavours to keep Customer Data confidential and secure and in accordance with this policy (See Section 10).

It is your job to safeguard your password and account access. You will also need to make sure they you obtained any relevant consents or permissions necessary before you upload any personal data to freewebstore and for it to be used as set out in this policy.

For information on how we store your Customer Data and how we handle your Customer’s credit card data, please refer to Section 10.

2.3 People Who Email Us Or Contact Us Via Forms On Our Website

We use third party provider Google for our email services. Transport Layer Security (TLS) is used to encrypt and protect email traffic. If your email service does not support TLS, you should be aware that any emails we send or receive may not be protected in transit. Link to Privacy Notice

We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.

2.4 People Who Call Our Telephone Line

We do not offer telephone support for customers. However, for corporate queries we use third party company AlldayPA. Link to Privacy Notice

2.5 People Who Contact Us To Purchase A Domain Or Redeem A Domain As Part Of Their Professional Or Powerseller Package

We use Realtime Register to purchase domains. Link to Privacy Notice

2.6 Information We Collect

We collect information about your website usage, to improve our service and to understand trends to enhance and customize. Some of this data may be "personal data", where it identifies a person. Here's the information that we collect and how we use it:

We monitor patterns of usage, such as login dates and volumes of data, so we can understand how people are using freewebstore to develop and improve our products.
We also monitor patterns of usage so that we can tailor any communications we may send you or advertising you may receive. For example, we may tailor your newsletter with information about product features that you haven't tried yet, instead of features that you use frequently.
For security reasons, to aid in monitoring patterns of usage and to improve user experience, we log your IP address when you use the website. This is your computer's individual identification number that is assigned to your computer when connected to the Internet.
We monitor traffic information when you visit our site or read our emails, including things like page visits, email clicks, referring sites, and video viewings. We use this information to improve our website, advertising, promotions, and to understand customer purchasing behaviour. Please see Section 9: Use of Cookies below regarding Cookies.
In addition to your personal data, we may also hold financial data that you enter into freewebstore. Examples of your financial data include your orders and sales data processed on your freewebstore. We hold this as part of our service to you - to enable you to track past orders, we also use it to tailor our product to your needs, and to understand our customer behaviour.

2.7 Information Others Provide To Us

We may receive information from others that you have authorized that third party to provide to us. This could include the information on whether a subscription payment was paid or declined.

3. How We Use The Information We Collect

3.1 We Use Your Personal Data To:

Enable us to register you and provide you with access to the freewebstore control panel. We use your personal data for legitimate business reasons, for example email you when you’ve received an order. It will also enable us to contact you by email, fax, post, SMS, social media or telephone where necessary concerning freewebstore; to record your personal preferences; to personalize our services to you (such as by pre-populating fields to make it easier for you to provide information when you return to the freewebstore control panel or the freewebstore website). It will also enable us to produce reports you request as part of the services we provide.

Should you choose to use parts of freewebstore that involve providing yours or your customers personal and/or financial data to third parties (for example, if you choose to download order data and give this to your accountant, work colleagues or third-party accountancy packages), then it is your responsibility to ensure you comply with the law concerning Data Protection. Such personal and / or financial data may include for example, general, financial data or personal data such as email address, address, VAT No. You are able to select or de-select certain fields when you choose to produce a data extract and download order details.

3.2 Improving Freewebstore

We will also use and analyse your personal data so that we can provide you with support to help your business grow, improve and develop our business, provide you with customer service and support about the features of the freewebstore website and freewebstore generally. We may use third parties to assist us in doing these things from time to time, and in those cases may pass on your personal data to them. We will only share your data with third parties that we trust, and where there are assurances in place as to how they will protect the data.

3.3 Contact You For Marketing Purposes

We may use your personal data to contact you by email, fax, post, SMS, social media and/or telephone to let you know about our other freewebstore and/or third-party services, content, offers or product ranges which may be of interest to you. We will only use your data in this way where you have provided consent, we have legitimate business reasons for doing so, or where we are otherwise entitled by law to do so. If you would like us to stop providing you with such notifications, just contact us using the details below. Please note, this may take up to one working day to take effect. To stop receiving emails from freewebstore itself (for example, a reminder that your subscription is expiring), you should cancel your freewebstore account by closing your store.

3.4 Cookies

We may further use, or permit selected third parties to use, your personal data to enable us to track and analyse freewebstore website traffic and visitor trends, improve your browsing experience and to personalize and enhance the content and advertising we display. For further details, please see Section 9: Use of Cookies below.

3.5 Legal Requirements

We may use your personal data to comply with any legal obligations to which we are subject.

4. Why Do We Use Your Personal Data?

We collect and use your personal data for a variety of reasons. We need some data to enter into and perform our contract with you and provide you with access to freewebstore – for example your contact details and other information requested during the freewebstore setup process. The lawful basis for processing your personal data is Consent as you have consented to provide your personal details to us to allow us to provide a service to you. If you fail to provide such data we will be unable to provide our service to you.

Other information we collect because we have legitimate business interests, for example, in:

Ensuring that we can onboard you as a customer, provide you with hints and tips on how to use freewebstore and manage your account;
Understanding how our customers use our products, services and websites;
Understanding and responding to customer feedback;
Researching and analysing the services our customers want;
Improving our product and better understanding how our customers use it.

5. How We Share Information We Collect

Except as described in this policy, freewebstore does not divulge any personal information gathered via its services to third parties.

We may share your personal data with third parties in certain circumstances:

We may disclose your data to any member of our group (which means our subsidiaries or our ultimate holding company);
In the event that we, our business, or substantially all of its assets are acquired by a third party (in which case personal information about customers will be one of the transferred assets);
If we are under a duty to disclose or share your personal in order to comply with any legal obligation; to cooperate with law enforcement officials in the investigation of unlawful activities of freewebstore website users or relating to freewebstore users; or in order to enforce or apply any contract with you; or to protect our rights, property, or safety of our employees, customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection or unlawful activity.

We also utilize a number of carefully selected third parties to help provide our services to you. Examples of these functions include email, providing marketing assistance and data analysis, data management, handling credit card transactions and providing customer service. In choosing to work with any such third parties, we will always ensure that the security policies and confidentiality arrangements of those third parties adhere to the same requirements we ourselves impose and expect, as a minimum. No ownership rights to the data will be transferred to any third party.

The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us, one of our group companies or for one of our suppliers. Such staff maybe engaged in, among other things, the processing of your payment details and the provision of support services. By submitting your data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

For a full list of sub processors and details of the adequate safeguards in place in respect of data transfers outside the EEA, please see below:

Sub-Processor	Location	Data Security Certifications	Use
Amazon Web Services EMEA SARL	Luxembourg. Infrastructure operated by Amazon Data Services Ireland Limited	ISO 27001, SOC 2, SOC 3. No transfer mechanism required — data remains in the EU (eu-west-1, Ireland)	All hosting, compute, storage, database and logging, including our encrypted backups.
Twilio Ireland Limited (SendGrid)	Dublin, Ireland	ISO 27001, SOC 2. Standard Contractual Clauses	Sending transactional email (not marketing email) from the freewebstore product to you and to your customers.
Google Ireland Limited / Google LLC	Dublin, Ireland. Mountain View, CA, USA	ISO 27001, SOC 2, SOC 3. EU-US Data Privacy Framework and Standard Contractual Clauses	Google Workspace as our email provider and for document storage — including the privacy@ and security@ addresses published in this policy. Google serves the web fonts (unless the merchant has chosen a system font) and the reCAPTCHA anti-spam check used by shops, so it receives the IP address, browser information and page address of shop visitors. Google Maps Platform checks that delivery addresses are valid and converts them into map coordinates, which is what lets a merchant see where orders are going and catches mistyped addresses — for this Google receives the delivery and billing address on an order. Google also provides analytics on our own websites and control panel, and we export that analytics data into Google BigQuery, a Google Cloud data warehouse held in the EU, to answer questions about our own sign-up process.
Api2Pdf	United States	Transfer safeguard being confirmed — see note below this table	Turns an order invoice into a PDF — the invoice a shop’s customer downloads or receives by email. It receives the rendered invoice, which contains the customer’s name, billing and delivery address, the items ordered, quantities and totals. The file is deleted from their platform immediately after we retrieve it.
Resend	United States	Standard Contractual Clauses	Sends the onboarding email a merchant receives when first setting up a store — welcome, getting-started and setup guidance. Separate from the email a shop sends to its own customers, which goes through Twilio/SendGrid. It receives the merchant’s own name and email address and the content of those messages, and no customer or visitor data.
The Rocket Science Group LLC (Mailchimp)	675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA	SOC 2 Type 2. EU-US Data Privacy Framework, with Standard Contractual Clauses as a fallback	Sending updates and useful information by email, including our newsletter. This is our own list. If you connect your own Mailchimp account to your store, that is your integration and your relationship with Mailchimp.
Paddle.com Market Limited	London, United Kingdom	PCI DSS compliant. UK adequacy decision	Subscription billing if you upgrade to one of our paid packages. We never see or store your card details.
Wonderchat	Singapore	GDPR Compliant	A.I. customer support and pre-sale enquiries on our website. We export these conversation logs daily for quality review by our support team.
Cloudflare, Inc.	San Francisco, CA, USA	ISO 27001, SOC 2. EU-US Data Privacy Framework and Standard Contractual Clauses	CDN, DNS and web application firewall in front of every storefront. Receives request metadata for every visit: IP address, user agent, requested URL and approximate country. Cloudflare also provides the Turnstile anti-bot check used on the contact form on our own websites and on shop forms such as contact, reviews, blog comments and stock notifications, and receives the IP address and browser signals of anyone who uses it.
Stripe Payments Europe, Limited	Dublin, Ireland	PCI DSS Level 1	Creating and maintaining your Stripe account. Your own business details, not cardholder data.
PayPal (Europe) S.à r.l. et Cie, S.C.A.	Luxembourg	PCI DSS compliant. Binding Corporate Rules	Creating and maintaining your PayPal account. Your own business details, not cardholder data.
Ryft Pay Ltd	Manchester, United Kingdom	PCI DSS compliant. UK adequacy decision	Creating and maintaining your Ryft merchant account. Your own business details, not cardholder data.
Realtime Register B.V.	Zwolle, Netherlands	ISO 27001. No transfer mechanism required — EU	Domain registration, where you register a domain through us. Registrant name, address, email and telephone, as required by ICANN.
Anthropic PBC	San Francisco, CA, USA	SOC 2 Type 2. Standard Contractual Clauses	Powering our AI features. Content you submit to those features.
Plausible Insights OÜ	Tartu, Estonia	No transfer mechanism required — EU-only infrastructure	Cookieless analytics on the freewebstore control panel. No cookies and no persistent identifier.
DoiT International	United Kingdom	ISO 27001. UK adequacy decision	Our reseller for Amazon Web Services and our cloud cost management provider. No access to store or customer data.

A note on Api2Pdf. Every other provider in this table has a transfer safeguard we have verified. For Api2Pdf we have established that the company is United States based, and we are confirming which mechanism is in force rather than assuming it matches the others. We would rather publish that plainly than state something we have not checked. We are also reviewing whether to move invoice rendering to an EU provider or to do it ourselves, which would remove the transfer question entirely.

Additionally, you may grant third-party access to your personal or financial data by using freewebstore’s API’s with third-party apps. At all times, this access is controlled by you. Whilst we attempt to facilitate access only to those third-party apps, we cannot take responsibility for the content or privacy policies of third-party apps you access via freewebstore. We encourage you to carefully review the privacy policies of any third-party apps you use.

6. How Long Do We Store Your Data For?

We only store your data for as long as necessary for the purposes of processing set out in this policy. When you cancel your account with freewebstore, you can either delete your customer data immediately, or we will automatically delete your data within 180 days.

If you are signed up to marketing communications, cancelling your freewebstore account will not cancel your marketing preference. If you would like to unsubscribe, you can do so using the unsubscribe link in the email received. Alternatively, please make your request via our contact page at https://freewebstore.com/contact.html

To ensure the integrity of our systems and your data, we utilize various technologies to continually take secure, encrypted backups. Data remains restorable from these backups for up to 35 days after deletion, after which it is overwritten in the ordinary course. We do not use backups to restore individual records.

7. How To Access And Control Your Information

You are free to change your personal details in the My Account section of your account at any time.

You can also ask us for a copy of your personal data that we hold. We may ask for proof of your identity before providing any information and reserve the right to refuse to provide information requested if identity is not established. Please see “Your Individual Rights” below. Generally, we will retain your personal data for a reasonable period, or for as long as the law requires.

You can export a copy of your data whenever you like - this will include your customer data; your order data or product data and you can delete your customer data at any time in the freewebstore control panel. After you delete your data, we may not immediately delete residual copies from our active servers and may not remove information from our backup systems.

We highly recommend that you export your data before cancelling, since many countries (including the UK) require you retain your business records going back many years, even if you have finished trading.

If you do not have an active paid subscription and you do not log into your freewebstore account for 180 days, we assume you are no longer active and your store is suspended, which means it stops being visible to visitors. Your data is still held at that point. If you still have not logged in, your account and its data, including your customer data and order data, are then permanently deleted approximately 30 days after that – around 211 days after your last login. We email you a number of reminders during this period, and a final warning before anything is deleted, to the email address you provide on setup and which you can change in the My Account section. Logging in at any point stops this process and restores your store.

If you are signed up to marketing communications, closing your store will not cancel your marketing preference. If you would like to unsubscribe, you can do so using the unsubscribe link in the email received. Alternatively, please make your request via our contact page at https://freewebstore.com/contact.html

8. Your Individual Rights

You can exercise any of the rights below by emailing privacy@freewebstore.com. You do not need a Freewebstore account to do so — this route is open to anyone, including customers of stores built on Freewebstore. We will respond within one month, as required by data protection law. We may ask you to verify your identity before we release any personal data.

Access to your personal data: You can ask us to confirm if we are processing your personal data and you may request a copy of your personal data by contacting us at https://freewebstore.com/contact.html.
Right to change or withdraw your consent: Where you have given us consent to make use of your personal data for any of the purposes outlined in this policy, you may withdraw that consent at any time via our contact page at: https://freewebstore.com/contact.html. If you wish to change your contact preferences or no longer wish to be contacted for marketing purposes, use the Unsubscribe link in the email or get in touch via our contact page at: https://freewebstore.com/contact.html.
Right to Rectification: You may ask us to update out of date or inaccurate information we hold about you. To do so, please log on to your freewebstore account and update your information in the My Account section and we will make the necessary updates to our system, or get in touch via https://freewebstore.com/contact.html.
Right to Erasure: In certain circumstances you may ask us to erase your Personal Data. If you would like us to erase the personal data we hold about you, please get in touch via https://freewebstore.com/contact.html.
Right to Data Portability: In certain circumstances you may ask us to provide you with the personal data that we hold about you in a structured, commonly used, machine readable form, or ask for us to send such personal data to another data controller.
Right to object: In certain circumstances you may object to our processing of your personal data. Please get in touch using our contact page at https://freewebstore.com/contact.html.
Right to restrict processing: You can ask us to restrict the processing of personal data we hold about you in certain circumstances. Please get in touch using our contact page at https://freewebstore.com/contact.html.
Make a complaint: You may make a complaint about our data processing activities, please contact us via our contact page at https://freewebstore.com/contact.html.
Getting in touch: To make enquiries and/or to exercise any of your rights in this privacy policy, email us at privacy@freewebstore.com, or use our contact page at https://freewebstore.com/contact.html.

9. Use Of Cookies

We may send a small file to your computer when you visit our website. This will enable us to identify your computer, track your behaviour on our website and to identify your particular areas of interest so as to enhance your future visits to this website. We may use cookies to collect and store personal data. We do not automatically log data or collect data you specifically provide to us. You can set your computer browser to reject cookies but this may preclude your use of certain parts of this website. You can do this by changing your browser settings via the Help section of your browser.

Cookies on our own websites and control panel. These are the cookies used on freewebstore.com, freewebstore.co.uk and the freewebstore control panel.

What cookie is used?	Details	What type of cookie?
Freewebstore	Facilitates store creation and management	Session
Google Analytics (Signup)	Analytics Data	Tracking
Ahoy	Analytics/Marketing Data. Records initial visitor id	Tracking
Affiliate	Referral tracking system	Tracking

Cookies on shops built with freewebstore. These are different, and they are the ones that matter if you are a shopper on a merchant’s store, or a merchant writing your own privacy policy. Google Analytics, Ahoy and Affiliate above are not used on shops. The cookies below are set by the shop itself.

What cookie is used?	Details	How long it lasts
fwsId	Identifies your browsing session so the shop works. Strictly necessary.	Session
ASP.NET_SessionId	Session identifier used by the shop software. Strictly necessary.	Session
fws-cart-id-<store>	Remembers your basket for that shop so it survives between pages and visits. Strictly necessary.	7 days
_fws_attr	Records how you arrived at the shop — the referring website, any campaign tags in the link, and the name of the advertising network (for example “gclid”), but never the individual click identifier. Used to give the merchant their traffic sources.	30 days
_fws_rd	Prevents redirect loops. Strictly necessary.	30 seconds
fwsPowerBarId	Browser local storage, not a cookie. Free stores on our classic designs only: remembers that you closed the Freewebstore bar so it stays closed. Strictly necessary.	Until you clear your browser storage
fws_consent / cookieconsent_status	Remembers your cookie choice, where the merchant has enabled a cookie banner.	Set by the banner
ageCookie	Remembers that you passed an age check, where the merchant uses one.	Set by the merchant
pref_per_page, pref_sort	Remembers how you chose to sort and page product lists.	Session

A merchant may add their own Google Analytics, Meta Pixel or TikTok Pixel to their shop. Those are the merchant’s own tools and are off unless the merchant turns them on. Where the merchant has enabled our cookie banner, the Meta and TikTok pixels are held back until a visitor consents.

Information we record without using cookies. On every shop we record page views to produce the merchant’s store statistics and to run and improve the platform. This record contains the page address, the referring address, the browser user-agent, any search terms typed into the shop, and the visitor’s IP address in pseudonymised form — it is converted to an irreversible value before it is stored. It is kept for 365 days. Separately, and for security only, we record raw IP addresses of shop traffic to detect and block attacks, bots and abuse; those are deleted after 7 days. Our web servers also keep standard access logs containing IP addresses for 30 days. Cloudflare, our CDN and security provider, receives the IP address, browser and requested address of every visit in order to serve and protect the shop. Some shop forms are protected by Google reCAPTCHA or Cloudflare Turnstile, which receive the visitor’s IP address and browser signals in order to tell a person from a bot. We rely on our legitimate interests in operating and securing the platform for this processing, and we honour the Global Privacy Control (Sec-GPC) signal on every shop.

10. Data Security

We take security and privacy seriously. We will endeavour to take all reasonable steps to keep your personal data secure once it has been transferred to our systems. We adopt appropriate, industry standard data collection, storage and processing practices and security measures to protect against unauthorised access, alteration, disclosure or destruction.

Freewebstore uses a third-party vendor and hosting partner to provide the necessary hardware, software, networking and storage to run its services. This provider has been selected for their high standards of both physical and technological security, including ISO and SSAE16 certifications.

When payments are processed via credit card, freewebstore uses third-party vendors that are PCI-DSS compliant. At no point does freewebstore have access to your credit card information. For further information on how we meet industry standards for credit card information security, please see our PCI Compliance page.

Your credit card details for subscription payments – This information is passed directly to our payment service provider (Paddle - https://www.paddle.com/legal/privacy) over an encrypted link and is never stored on our system. We handle ongoing billing by passing a token to Paddle that identifies your account.

You should bear in mind that submission of information over the Internet is never entirely secure. Freewebstore cannot guarantee the security of information you submit whilst in transit over the Internet and any such transmission is at your own risk.

Where we have given you (or where you have chosen) a password which enables you to access certain parts of the freewebstore control panel, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

11. Getting In Touch

For any data protection query, including a request to exercise any of the rights set out above, email us at privacy@freewebstore.com. To report a security vulnerability, email security@freewebstore.com.

If you have any queries relating to this Privacy Policy or freewebstore’s use of your personal or financial data, you can also contact us via our contact page at https://freewebstore.com/contact.html or alternatively write to:

International Enquiries:
Freewebstore Ltd.
Slater Terrace,
On The Banks,
Sandygate,
Burnley,
Lancashire,
United Kingdom,
BB11 1BU

Privacy policy.