Privacy Policy

Version 4 · In effect from 27 October 2026

Version 4

This policy is published by STOREMINK LLP, a limited liability partnership registered with limited liability under the Limited Liability Partnership Act, 2008 (LLPIN ADC-5432), incorporated on 21 September 2026, with its registered office at Bala ji Colony, Faridkot, Punjab, India. In this policy, "StoreMink", "we", "us" and "our" mean STOREMINK LLP.

This policy is available in English and, on request at support@storemink.com, in any language listed in the Eighth Schedule to the Constitution of India.

1. Who we are, and the two roles we play

We decide how and why we use the personal data in this paragraph, so for it we are the Data Fiduciary (the controller): the accounts of merchants and their staff; our billing; how you use our dashboard, POS and Mink AI; people who visit storemink.com and our Help, Themes and POS sites; people who use our Help Centre assistant; and people who write to us.

For the personal data customers give to a store, such as names, addresses and orders, the merchant is the Data Fiduciary and we are its Data Processor: we handle that data for the merchant and on its instructions. If you shopped at a store built on StoreMink, see section 8.

For a few things we use shoppers' data for our own purposes, across all stores: running the sign-in service that stores use, keeping a single list of email addresses that bounced or were reported as spam so that no store keeps mailing them, using IP addresses to stop abuse, and keeping the record that a shopper accepted a store's policies.

In this policy, "you" means a merchant or a person who works on a merchant's store, except in section 8, which speaks to shoppers.

2. What we collect

We collect the following, and use each for the purpose given with it:

Account data: your name and email address; your password or, if you sign in with Google, your Google account's name and email address; your mobile number once you verify it with a code; your store's name and country; the business details you add for invoices, such as your legal or business name, address, state, GSTIN, billing email and phone; and whether you asked for product news. We use it to run your account, keep it secure, contact you and bill you. Your password is held by our sign-in provider, Google, in a form that cannot be read back. When you set or change your password, or confirm it before a sensitive change, our servers may pass it to Google; we never store it.
Staff data: for people you invite, their name, email address, role and the locations you assign them. For POS staff, also the mobile number they verify with a code and their 8-digit POS PIN, which we store in a form that cannot be read back. For POS we keep which devices were approved, by whom and when, and a record of sign-ins, failed sign-ins, discounts, price changes, refunds, cash movements and other exceptions, with the IP address used. We use it to give each person the access you chose and to show you who did what.
Store data: what you and your customers put into your store, including products, pages and files you upload; orders with delivery details and GSTIN; customer accounts and saved addresses; reviews and comments; enquiries; newsletter sign-ups; store credit; WhatsApp conversations and contacts with their messaging choices; and records of customers accepting your store's policies. We use it to run your store for you and your customers.
Usage and technical data: IP address, browser and device details, and records of requests, errors, and the emails and messages we send. Some of this is security evidence: we record the IP address and browser used when someone accepts our policies, and the IP address used when a POS device is approved. We use it to run the service, keep it secure and fix problems.
AI interactions: what you type or say to Mink AI, files and images you attach, what is on your screen when you send a message (see section 5), notes you ask it to remember, the context we gathered to answer, the answers, the changes you approve, and any rating or report you send us. We use it to answer you, to keep a record of the changes you approve, and to look into problems you report.
Payment data: we never store card numbers. We keep the payment provider's references, amounts, status and payment method type, and, for automatic payment, the maximum amount you approved. To set up automatic payment we give Razorpay your store's name, billing email address and mobile number. We use it to take and record your payments to us.
Support: what you tell us when you write to us. We use it to help you.
Visitors to our websites: IP address and browser details, and the questions you type into our Help Centre assistant. We use them to show our websites, stop abuse and answer your questions.

3. Why we use it, and on what basis

We use personal data:

to provide the service you signed up for and the features you switch on, including Mink AI, because you asked for them;
to bill you and keep our accounts and tax records, because the law requires it;
to send you and your staff the messages the service needs: order alerts, security notices, billing, and notices about changes to the service;
to support you when you ask;
to keep StoreMink secure and to detect abuse and fraud;
to meet legal obligations and lawful requests from authorities; and
with your consent, to send you news about new features, if you said yes at signup.

You can withdraw a consent at any time. To stop product news, write to support@storemink.com. Withdrawing does not affect what we did before.

We do not sell personal data, and we do not use your data or your customers' data to train our own models.

4. Who we share it with

Providers who process data for us under contract, so that the service works:

Google Cloud: hosting, database and file storage.
Google Identity Platform: accounts and sign-in for merchants, staff and shoppers, the SMS codes used to verify a phone number, and Google reCAPTCHA checks that stop abuse of those codes.
Google Vertex AI: our AI features, including Mink AI, Generate with AI, Mink AI replies to customers on WhatsApp and the Help Centre assistant. See section 5.
A speech-to-text service: turning what you say to Mink AI into text. See section 5.
A text-to-speech service: reading Mink AI's answers aloud, when we use one. See section 5.
Resend: email delivery, including the emails stores send to their customers, and delivery outcomes such as bounces and complaints.
Razorpay: your payments to us for plans, extra locations and Mink credits, including automatic payments.
Meta (WhatsApp): when a store connects a WhatsApp Business number, messages to and from that number, with their photos and voice notes, pass through Meta, and we keep them for the store's inbox. If the store also uses the WhatsApp Business app on that number, messages sent and received there are copied into the inbox too.
Google Search Console: search performance for launched stores, their sitemaps, and the custom domains we verify for stores.
Our email service for support@storemink.com: the messages you send us, including complaints and requests about your data.

When a shopper taps "Use my current location", their browser sends the device's position to BigDataCloud, a free location service, to find the PIN code. BigDataCloud handles it under its own terms.

Where you connect an account of your own (a payment gateway, a logistics provider such as Shiprocket, an SMS provider such as Twilio, or an analytics or advertising tag), our software sends data to it on your instructions. Those providers act for you, under your agreement with them, and this policy does not govern what they do with it. Shipping a parcel sends your customer's name, address and phone to the carrier; sending an SMS sends their number and the message.

Some pages also load content from other companies, such as videos from YouTube or Vimeo, a font from Google Fonts and a country flag from GitHub; section 11 explains when.

We may also disclose data where the law requires or allows it: to a government agency authorised by law that asks in writing, to obey a court order, to enforce or defend a legal right or claim, to prevent, detect or investigate an offence, or to help in an emergency that threatens someone's life or health.

5. Mink AI and your data

When you use an AI feature, we send Google Vertex AI what that request needs: your store profile and brand settings, and the catalogue, sales, stock, order or Website Builder content the request is about. This can also include the earlier messages in that conversation, notes you asked Mink AI to remember, files and photos you attach, your store's own product photos, which may show people, and what you tell Mink AI when it redesigns your store.

If you speak to Mink AI, your recording is sent to a speech-to-text service, which turns it into text; the text is then handled like a message you typed. When we use a text-to-speech service to read answers aloud, the text of each answer is sent to it; otherwise your browser reads answers aloud with its own voice. We do not keep your recordings. These services may keep what they receive for a limited time, may use it to improve their own services, and may process it outside India, under their own terms.

When you send a message, Mink AI also reads what is on your screen, such as the rows of a list or the fields of a form you have open, so that it understands what you mean. Before what it reads is sent, it hides the email addresses, phone numbers and postal addresses it recognises there. It may not recognise every one, and names, order details and other information on screen may still be sent. It does not send password fields, or fields whose label names a password, secret, token, API key, OTP or PIN. When Mink AI looks up orders or customers itself, it uses only a customer's first name and the first letter of their last name. Files you attach are sent as they are, so do not attach screenshots that show customers' contact details unless your request needs them.

If a store lets Mink AI answer, or draft replies to, its customers on WhatsApp, the customer's message, the recent conversation and that customer's own orders are sent to Google Vertex AI to write the reply.

Google Vertex AI processes what we send in order to return an answer. Google's terms for this service do not allow it to use what we send to train its models, and we do not use your data to train models of our own. Google may keep what we send for a limited time under its own terms: briefly, to deliver the service, and longer if its systems flag a request for an abuse check.

We keep each Mink AI conversation for about 3 months after you last use it, and then delete it. Using a conversation means sending a message in it or opening it. You can see and search all your conversations from that time. You can delete a conversation whenever you like, except while Mink AI is still answering you or still making a storefront redesign in that conversation. Deleting a conversation never undoes a change you approved or published from it: the change stays in your store, and we keep a record of what Mink AI proposed and what you approved for as long as your store exists. For a storefront redesign you applied, that record also keeps the answers you gave Mink AI for it. In your dashboard, your conversations are visible only to you, not to others who work on your store.

Notes you ask Mink AI to remember are kept for the 30, 90 or 365 days you choose, and then deleted. Product spreadsheets you attach are kept for 7 days. What Mink AI reads from a file or image you attach becomes part of the conversation.

Images you attach to Mink AI, and pictures Mink AI makes for you, such as product photos and the photos for a storefront redesign, are saved with your store's files, at a public web address that anyone can find and open. Deleting the conversation does not delete them, and they can stay until your store is deleted. Do not attach images of private documents or of customers' details.

Where our support team needs to look at a reported answer, the detail we store for that purpose is reduced first.

Public Help Centre answers work the same way: the question you type and the published guides we retrieved are sent to the model. Do not put passwords, card numbers or anyone else's personal details into an AI prompt.

6. Where it is held, and for how long

Most of your store's data and files are stored on Google Cloud in Mumbai, India. Some data may be handled outside India, under the providers' own safeguards and as Indian law allows:

requests to our AI features, which Google may process in any country where it runs Google Vertex AI, including the United States;
voice, which our speech services may process outside India;
sign-in accounts held by Google Identity Platform, and backup copies of our database; and
data handled by our email, WhatsApp and other providers.

We keep your account and store data while your store exists, including after a paid plan ends, so nothing is lost if you come back. This includes records with no set period, such as your POS activity record and the records of messages sent for your store. Some records are deleted on a schedule:

in-app notifications: 90 days;
our log of the emails we send, with a copy of each email: 90 days;
our log of the WhatsApp messages we send for your store, with a copy of each message: 90 days;
your store's activity log: 1 year;
raw records of storefront visits: 14 days, after which we keep only daily totals;
files you upload to import: deleted when the import finishes; import logs: 90 days;
product spreadsheets you attach in a Mink AI conversation: 7 days;
POS sales put on hold: 7 days;
Mink AI conversations: about 3 months after you last use them (section 5);
notes you ask Mink AI to remember: the 30, 90 or 365 days you choose;
WhatsApp conversations: kept while open, and deleted 2 years after the last message once closed; contacts and their messaging choices are kept while the store exists; and
search performance data: about 16 months.

We keep some records longer because the law or our own protection needs them: our invoices to you, which show your business name, address, GSTIN and billing email and record what you paid, the records of your payments for plans and extra locations, and the record of any payment to us that we are still checking, for as long as tax and company law require (at least 8 years), also after your store is deleted; records that you accepted our policies, also after your store is deleted; the list of email addresses that bounced or were reported as spam, so that no store mails them again; and the counters we use to stop abuse, some of which include an IP address.

When a store is deleted, its data is deleted with it, except the records in the paragraph above. Copies in our database backups, and our records of requests to our service, which include IP addresses, are removed later, on their own schedules.

7. Your rights and choices

You can ask us for a summary of your personal data and how we use it, and for the names of those we shared it with and what we shared with each; to correct, complete or update it; to delete it; and to stop using it where you gave consent. You can also name another person to use these rights for you if you die or cannot act yourself: tell us their name and email address. To ask, write to support@storemink.com from the email address on your account and tell us your store's address, so we can confirm it is you. We reply to a request or a question about your personal data within 10 working days. If you are not satisfied with our reply, see section 12.

You can download your products, categories, stock and orders as spreadsheet files from your dashboard. For anything else, including your customer list, write to us and we will help you get a copy within 30 days.

To delete your store, write to support@storemink.com from the store owner's email address. Deleting a store is permanent: it removes the store's records, its uploaded files, and the sign-in accounts used only for that store; an account also used elsewhere is kept. Some records cannot be deleted on request; a record that you accepted our policies, or an invoice we must keep for tax, are examples (see section 6).

Deleting a customer from your dashboard also deletes their orders and saved addresses, so keep any records the law requires first. If you need an account or its order history removed and are unsure how, write to us first.

8. If you shopped at a store built on StoreMink

The merchant decides what to collect and why; we process it for them. Ask them first: they can change or remove your details, and we will help them do it.

Signing in to a store sends a one-time code to your mobile through Google, with a check to stop abuse. We run this sign-in for every store: if you sign in at a store on a storemink.com address, you are also signed in at other stores on storemink.com addresses. When you create an account or place an order, we keep a record that you accepted the store's policies, with your IP address and browser, as evidence of what you agreed to.

A merchant may add their own analytics or advertising tags to their storefront. Those send data to the merchant's own accounts, not ours, and only after you allow that category on their site. You can withdraw that choice on the same site at any time. A merchant can also add code of their own to a page, and that code may load content from other companies without asking you first.

A store on our Pro plan may also measure visits through StoreMink, but only after you allow analytics on that store. This measurement does not store an identifier in your browser; it uses a code that changes every day. It records the pages you view and the shopping steps you take, the type of device you use (desktop, mobile or tablet), the website or tagged campaign link that brought you, and your approximate location (country, state and city) as reported by your network. If you place an order, that day's visit is linked to your order. For this measurement we do not keep your IP address, your browser details or the full address of the page that referred you.

We use IP addresses to stop abuse, for example too many sign-in attempts. If an email to you bounces because the address does not work, or you mark one as spam, we stop sending email to that address from every store on StoreMink.

For the things we do with your data for our own purposes, which section 1 lists, you can ask us for a summary of that data, the names of those we shared it with and what we shared with each; ask us to correct or delete it; and name another person to use these rights for you if you die or cannot act yourself, by telling us their name and email address. Some records, such as the record that you accepted a store's policies, are kept as evidence and cannot be deleted on request. Write to support@storemink.com with the mobile number or email address you used and the web address of the store, so we can confirm it is you. We reply within 10 working days. If you are not satisfied with our reply, see section 12.

If you message a store on WhatsApp, the store keeps the conversation, including photos and voice notes, while it is open and for 2 years after the last message once it is closed, and keeps a record of your messaging choices. At checkout a store may ask whether you want order updates and offers on WhatsApp; the order updates box starts ticked, and you can untick it. Replying STOP turns off offers; order updates continue. If you have an account at the store, you can turn order updates and offers off on your account page. If the store lets Mink AI answer, or draft replies to, its customers, your message, the recent conversation and your own orders are sent to Google Vertex AI to write the reply, and a person from the store can take over.

If you buy at a store's counter, the store records your mobile number and your name, and your email address if you give one, and may send a code to your phone to confirm a pickup or a return. If you give an email address, the store may email you about your purchase. If you later create an account at that store with the same number, your in-store orders appear in it.

If you tap "Use my current location", your browser sends your device's position to BigDataCloud to find your PIN code. We keep only the PIN code, city and state, in your browser.

A store's pages may show videos from YouTube or Vimeo, and store blog pages load a font from Google Fonts. The mobile number box on a store's sign-in and enquiry forms shows a country flag loaded from GitHub. When you open such a page or form, your browser contacts those companies, which receive your IP address (see section 11).

9. Security

We encrypt data while it travels between your device and our servers. We keep each store's data separate from every other store's data, and passwords and POS PINs are held only in a form that cannot be read back. The people you invite get only the access that the role you give them allows. People who work for StoreMink can open any store's data when they need to: to help merchants, to fix a problem, to keep the service running and secure, or to meet a legal duty. Credentials you give us for a provider you connect are encrypted before storage and are never shown back to you.

Files you upload to show on your store, such as product photos, are stored at public web addresses that anyone can find and open. So are images you attach to Mink AI and photos Mink AI makes for you.

No system is perfectly secure. If a breach affects your personal data, we will tell you without delay, by email or in your dashboard: what happened, when it happened and how much of your data it affected; what it may mean for you; what we are doing about it; what you can do; and who to contact. We report security incidents to the authorities as Indian law requires.

10. Children

You must be 18 or over to open a StoreMink account, to work on a store's dashboard or to use a store's POS, and we do not knowingly collect children's data for our own purposes. Stores built on StoreMink decide who may shop with them, and they are responsible for following the law on children's data.

11. Cookies and browser storage

We use cookies that the service needs to work: to keep you signed in, to check the email code while you sign up, to remember a store password you entered, to keep a shop's POS signed in and its device approved, to confirm a customer's code in POS, and to remember that you hid a preview in your dashboard. We do not use cookies for advertising.

In your browser we keep your sign-in, your cart and any discount code you applied, the delivery PIN code, city and state you chose, your privacy choices, and, if you react to a blog post, a random code so that your reaction counts once. In the dashboard and in POS we keep layout preferences, the Mink AI conversation you have open, a form Mink AI filled in for you, and a copy of the catalogue and of the sale in progress. On our Help Centre we keep the width of the assistant panel and whether you found a guide helpful.

Other companies may set their own cookies, or receive your IP address and browser details, in these cases:

a store's analytics and advertising tags, only after you allow that kind;
other companies whose content a store puts on its pages, such as a picture stored on another website, or content that the store's own code loads;
Google, when you sign in, with a password, a code or your Google account, or verify your mobile number;
Razorpay, when you pay;
Meta, when you connect a WhatsApp number from your dashboard;
BigDataCloud, when you tap "Use my current location";
GitHub, when a form shows a country flag beside the mobile number box, because the flag is loaded from there;
YouTube or Vimeo, when you open a page that shows one of their videos, even before you press play; and
Google Fonts, when you open a store's blog pages.

12. Complaints and our Grievance Officer

If you have a complaint about StoreMink, about something published on a store built on StoreMink, or about how we handle personal data, write to our Grievance Officer:

Anurag Goyal, Grievance Officer, STOREMINK LLP

Email: support@storemink.com

Registered office: Bala ji Colony, Faridkot, Punjab, India

Tell us who you are, how we can reach you, what the complaint is about, and the web address of the store or page it concerns.

We acknowledge every complaint within 24 hours and resolve it within 7 days. We resolve within 36 hours a request to remove content of a kind listed in section 2 of our Acceptable Use Policy, unless the only reason given is that the content belongs to someone else, infringes a patent, trademark, copyright or other right, or breaks any other law.

If content shows you, or a person you act for, fully or partly naked, with private parts exposed, or in any sexual act or conduct, or if it pretends to be you or that person, for example in a faked or morphed image, we remove it or block access to it within 2 hours of receiving your complaint. Write "Urgent" in the subject line so that we see it at once.

If you are not satisfied with our decision, or we do not resolve your complaint within these times, you can appeal to the Grievance Appellate Committee at gac.gov.in within 30 days.

For a request about your own personal data, see section 7. If we do not resolve a complaint about your personal data, you can complain to the Data Protection Board of India, which works online, once that right comes into force.

13. Changes and contact

We publish each version of this policy with a version number and the date it takes effect. When we publish a new version, we show it in your dashboard and ask you to accept it. We keep every earlier version and will send you a copy if you ask. Questions or requests: support@storemink.com.