Privacy Policy

The 10mShop platform ("Platform") is operated by, and the controller responsible for the data processing described here is:

scriptsCanFly by Simon Laube
Bifangstrasse 4
5610 Wohlen AG, Switzerland
UID: CHE-401.907.123
Email: info@scriptsCanFly.ch

This Privacy Policy explains how we collect, use, and protect personal data when you use the Platform. We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

This Privacy Policy covers the Platform itself (the 10mShop website, dashboard, and related services). Shops created by merchants on the Platform are operated by the respective merchants, who act as independent data controllers for the personal data of their customers. Each merchant is responsible for providing their own privacy policy for their shop. If you shop at a merchant store, please refer to that merchant's privacy policy.

Where we process customer data on behalf of merchants (e.g. hosting order data), we act as a data processor for the merchant.

• Account data: name, email address, password (stored in hashed form)
• Shop data: shop name, content, products, images, and settings you create, and the orders and sales figures of your shop, which we see in aggregated form (revenue, order counts, subscriptions) to operate the Platform, support you and prevent abuse
• Payment data: subscription and billing information processed via Stripe (we do not store full card details)
• Usage data: log data, IP address, browser type, pages visited, and interactions with the Platform
• Shop visitor analytics: when you visit a merchant shop, we collect aggregated, cookieless usage events on behalf of the merchant (e.g. page views, product views, cart and checkout events, referrer, UTM parameters, and device type). A random session identifier is kept in memory only for the duration of the page visit and is never stored in cookies or on your device.
• Communication data: messages you send us, e.g. support requests
• Domain registration: when you buy a domain through the Platform, the owner details you confirm for it (name, company, address, email address and phone number), which are passed to our registrar and the registry of the domain ending to register the domain in your name
• Landing page demo: a product photo you upload to try the AI without an account, the product text the AI writes from it, the shop details you enter (name, description, language, currency, design wishes), and a hashed form of your IP address used only to count demos per day. The photo is analysed by OpenAI (see section 5) and deleted after 7 days, or as soon as it becomes the first product of the shop you sign up for

• To provide, operate, and improve the Platform
• To process payments and manage subscriptions
• To register and renew domains you buy through the Platform
• To provide AI-assisted features (e.g. generating product descriptions or layouts)
• To communicate with you about your account and the Platform
• To prevent fraud and abuse and to ensure security
• To comply with legal obligations

We use selected third-party providers to operate the Platform, including:

• Supabase (database, authentication, and file storage)
• Stripe (payment processing and payouts)
• Resend (email delivery: account, order and shop emails)
• OpenAI (AI-assisted content and image generation)
• Vercel (hosting and content delivery; domain registration when you buy a domain through the Platform, passing your owner details on to the registry of the domain ending)
• Google (Google Fonts delivered from Google servers; sign-in with Google where you choose it)
• Pexels and Unsplash (stock photos and videos: their services are queried when you or the AI look for media, and media from them is delivered from their servers where a shop uses it)
• Lorem Picsum (placeholder images delivered from its servers while a design still shows one)

These providers may process data outside Switzerland or the EU/EEA. Where required, we rely on appropriate safeguards such as standard contractual clauses.

We use cookies and similar technologies that are necessary for the operation of the Platform, such as keeping you signed in and remembering your preferences (e.g. dark mode). You can control cookies through your browser settings; disabling essential cookies may limit functionality.

Our built-in shop analytics works without cookies or similar tracking technologies: no analytics identifiers are stored in cookies, local storage, or otherwise on your device.

Merchants on a Pro plan may additionally enable advertising tracking for their own shop (Meta Pixel, Google Ads conversion tracking). Where a merchant has done so, that shop asks you for your consent in a cookie banner before any such service is loaded: if you decline, no script from these providers is loaded and no data is sent to them. Your decision is stored locally in your browser so the shop can respect it, and you can change or withdraw it at any time through the "Cookie settings" control in that shop. The merchant is the data controller for this tracking and describes it in their own privacy and cookie policies; we only provide the technical means.

We retain personal data for as long as your account exists or as needed to provide the Platform, comply with legal obligations, resolve disputes, and enforce agreements. When you delete your account, we delete or anonymize your personal data unless we are legally required to retain it.

A landing page demo that is not turned into a shop is deleted together with its photo 7 days after the upload; once it has become a shop's first product, the demo record is kept for 90 days for our usage figures and the photo lives on only as that product's picture.

Subject to applicable law, you have the right to:

• Request access to the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Receive your data in a portable format

To exercise these rights, contact us at info@scriptsCanFly.ch.

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, and misuse, including encryption in transit and access controls. No system is completely secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. The date of the latest revision is shown at the top of this page.