1. Scope and data roles
This Policy applies to ShopStart websites, ShopStart accounts, dealer and affiliate surfaces, support interactions, subscription administration and the ShopStart software service.
For operational business data that a subscribing shop enters into ShopStart — including its customer, quote, invoice, job, artwork, production and related records — the shop determines why that information is collected and used for its business. PLS generally processes that information to provide, secure, support and maintain ShopStart on the shop's behalf.
PLS separately determines how it uses information needed to administer ShopStart itself, including ShopStart account registration, subscription billing, security, fraud prevention, support, dealer and affiliate program administration, service telemetry and legal compliance.
2. Information you provide
We may receive account and contact details; business and shop information; dealer attribution; customer records; job, quote, invoice, production and installation information; artwork and uploaded files; communications; support requests; settings; and billing-related account references that you submit or authorize.
3. Information generated by use, cookies and privacy choices
ShopStart may generate or receive login and session information, IP-derived security information, device and browser details, feature and workflow activity, audit events, error logs, performance data, file metadata, notification history and other operational records needed to run, secure, troubleshoot and improve the service.
ShopStart uses necessary cookies and similar technologies for functions such as authentication, session continuity, security, fraud prevention, support sessions and remembering a visitor's privacy preference. These technologies may operate without optional analytics because they are used to provide or protect the requested service.
ShopStart stores the first-party cookie shopstart_privacy_choice for up to 180 days to remember whether the visitor selected necessary-only technologies or allowed optional analytics and affiliate attribution.
Optional analytics and affiliate-attribution technologies are disabled until a visitor selects Allow analytics & attribution. When enabled on public ShopStart pages, ShopStart may load Google Analytics 4 and use browser session storage to prevent duplicate analytics events within a browser tab. ShopStart configures advertising storage, advertising user data and advertising personalization as denied and disables Google Signals and advertising-personalization signals in its Google Analytics tag.
Affiliate referrals may use the first-party HttpOnly cookies shopstart_affiliate_ref and shopstart_affiliate_visit for up to the ShopStart attribution window, currently 90 days, so an approved referral can be credited if the visitor later purchases ShopStart. These affiliate-attribution cookies are treated as optional tracking and are not created when optional tracking is disabled.
Visitors can change their choice at any time through the Privacy choices control on public ShopStart pages. ShopStart is also designed to honor supported Global Privacy Control signals by disabling optional analytics and affiliate-attribution tracking for that browser.
4. Payment information
Payment-card details for the ShopStart subscription are collected and processed by the payment provider rather than stored as raw card numbers by ShopStart. ShopStart may retain provider customer, checkout, payment-method and subscription references needed to operate billing. A shop’s customer-payment flow is separate from the ShopStart software subscription.
5. How we use information
We use information to provide and secure ShopStart; authenticate users; enforce roles and tenant separation; provision accounts, trials and demos; process subscriptions; operate customer and production workflows; store files; send authorized service communications; provide support; prevent fraud and abuse; maintain backups and audit records; diagnose errors; comply with law; and improve product reliability and usability.
6. Dealer attribution and access
When an account is associated with an authorized dealer, we may retain dealer, salesperson, equipment and onboarding attribution for activation, program administration and partner compensation. Dealer users do not receive private shop operating data merely because the account is attributed to that dealer.
7. Aggregated and de-identified information
We may use aggregated or de-identified operational information to understand product and industry trends and to create benchmarks. We do not use an aggregated or de-identified result to expose a shop’s private customer records or intentionally re-identify an individual from information maintained as de-identified.
8. Service providers, subprocessors and disclosures
PLS uses service providers to help operate ShopStart. Depending on the function, these providers may process information for cloud hosting and databases, content delivery and security, private file storage, payment processing, email delivery, monitoring, analytics, support or other infrastructure functions.
Current ShopStart infrastructure may use providers such as DigitalOcean, Cloudflare and Stripe. Google may also receive information when optional Google Analytics is enabled or when certain Google-hosted public-site resources are requested. Service providers are permitted to process information only as appropriate to provide their services to PLS and are subject to applicable contractual, confidentiality, security and data-protection obligations.
PLS may change providers as the ShopStart platform evolves. Where applicable law or a customer agreement requires notice regarding a material new subprocessor, PLS will provide the required notice or updated disclosure.
PLS may also disclose information when required by law, legal process or government request; to protect the rights, security or integrity of ShopStart, its users or others; in connection with a merger, financing, acquisition, reorganization or sale of relevant business assets; or when the customer or individual directs or authorizes the disclosure.
9. Sale, targeted advertising and privacy signals
PLS does not sell a shop's private customer or operating data for monetary consideration and does not use that private operational data for third-party targeted advertising.
ShopStart does not enable Google advertising storage, advertising user data or advertising personalization through its public-site analytics configuration. Optional analytics and affiliate attribution can be disabled through the ShopStart Privacy choices control.
Where a supported browser sends Global Privacy Control, ShopStart treats that signal as an instruction to keep optional analytics and affiliate-attribution tracking disabled. If ShopStart's practices change in a way that triggers an additional notice, consent or opt-out right under applicable law, PLS will update this Policy and provide the required control.
10. Data retention
PLS retains information for periods reasonably necessary for the purpose for which the information is processed, including providing ShopStart, maintaining account and financial records, protecting security, investigating abuse, resolving disputes, complying with law and enforcing agreements.
Customer Data is generally maintained while the applicable ShopStart account is active. Following termination, an account owner may generally have an approximately 30-day opportunity to export available Customer Data, subject to security, fraud, legal-process, nonpayment or technical restrictions described in the ShopStart Terms of Service. After the applicable export period, PLS may delete or de-identify Customer Data from active systems.
Some records may be retained longer where reasonably necessary, including subscription and financial records, legal acceptance records, security and audit records, fraud-prevention records, support history, dispute records or information subject to a legal hold.
Information deleted from active systems may remain for a limited period in encrypted backups, logs or disaster-recovery systems until those systems expire through their normal rotation. PLS does not retain backup copies indefinitely solely because active data has been deleted.
11. Access, correction, export and deletion
Account owners and individuals with applicable privacy rights may request access, correction, a portable copy or deletion of eligible personal data through authenticated ShopStart tools when available or through ShopStart Support. PLS may verify identity, account ownership and authority before acting on a request.
When a privacy request concerns information that a particular shop collected about its own customer, the request should generally be directed to that shop because the shop controls that customer relationship and determines the business purpose for the data. Where required, PLS will reasonably assist the shop in responding to applicable privacy requests involving Customer Data processed through ShopStart.
Requests concerning information that PLS controls directly — such as ShopStart account, subscription, support, security, dealer, affiliate or platform-administration information — may be submitted directly to PLS through ShopStart Support.
PLS will respond within the time required by applicable law and will explain when a request is denied or limited because an exception applies.
12. Appeals and privacy complaints
If applicable law gives you a right to appeal a privacy-request decision, you may submit the appeal through ShopStart Support and identify the earlier request. If an appeal is denied, we will provide any further complaint information required by applicable law.
13. Security
PLS uses administrative, technical and organizational safeguards designed to protect the confidentiality, integrity and availability of information. These safeguards may include role-based access, tenant separation, server-side authorization, protected credentials and secrets, secure transport, controlled infrastructure, audit logging, backup procedures and security testing.
No method of storage, transmission or software operation can guarantee absolute security. Customers are responsible for protecting their credentials, assigning appropriate user permissions, removing access when personnel no longer need it and promptly reporting suspected unauthorized access.
14. International users
Privacy rights vary by location. Where laws such as the GDPR apply, rights may include access, correction, deletion, restriction, objection and portability, subject to legal exceptions and the role PLS has for the particular data. Requests may be submitted through ShopStart Support.
15. Changes to this Policy
We may update this Policy as ShopStart, our providers or legal requirements change. The effective date above identifies the current posted version. Material changes will receive additional notice where required.
16. Contact
Privacy questions, requests and appeals can be submitted through ShopStart Support.