Privacy Policy

Two different relationships

tooo.market sits in the middle of two groups of people, and the rules are different for each.

Merchants. If you run a store here, we decide how your account information is handled, and this policy describes that.

Shoppers. If you bought something from a store built on tooo.market, your information belongs to that merchant. They decide what happens to it; we only process it on their instructions. Requests about your data should go to the store you bought from — their contact details are on their site. If you reach us instead, we will pass it along.

What we collect from merchants

• Account details: name, email, password hash, phone if you give one.
• Store details: name, address, support contacts, branding.
• Billing details for your subscription.
• Security and audit records: sign-in times, IP addresses, and a log of admin actions.
• Support conversations.

What we store on a merchant’s behalf

Running a store means holding its customers’ data: names, email addresses, shipping and billing addresses, phone numbers, order history, and any notes the merchant adds.

We use it to run the store — showing order history, sending the emails the merchant has configured, calculating tax and shipping. We do not sell it, rent it, or use it to market anything of our own to a merchant’s customers.

Payment information

We never see or store full card numbers. Card details are entered directly into a payment field hosted by our payment provider and go straight to them. They never reach our servers, and there is no card number, expiry, or security code anywhere in our database.

What we keep is a reference to the payment (an identifier from the provider), the amount, the currency, and whether it succeeded — enough to show an order history and issue a refund, and nothing more.

Who we share with

We use a small number of service providers to run the platform: hosting, email delivery, and payment processing. Each of them gets only what they need to do their part. We do not sell personal information to anyone.

We will disclose information if the law requires it. If we are legally able to tell you first, we will.

Cookies

Storefronts set a small number of cookies that are needed to work at all: one to keep track of a shopping cart, one to keep a shopper signed in, and one to remember a chosen language. Merchant admin sessions use a signed session cookie.

A merchant may add their own analytics or advertising tags to their storefront. Those are the merchant’s, governed by the merchant’s own policy, and outside our control.

How long we keep things

Store data stays as long as the account is open. After an account closes we keep it for 30 days so it can be exported, then delete it; backups roll off on their own schedule after that.

Some records have to outlive the account — invoices and payment records, for tax and accounting.

Your choices

Merchants can view, correct, export, or delete their data from the admin, or ask us to do it. Marketing emails from us always have an unsubscribe link; service messages about your account and billing do not, because you need them.

Shoppers: contact the store you bought from. Merchants have tools in their admin to export or delete a customer’s record.

Security

Passwords are hashed, traffic is encrypted in transit, and each store’s data is isolated from every other store’s at the database layer. Admin actions are logged. No system is perfectly secure, but if a breach affects your data we will tell you.

Children under 13

Shopper accounts are not for children under 13. When you create an account we ask for your date of birth before we create anything, and if you are under 13 we do not create the account and do not keep what you entered. We do not offer verifiable parental consent, so there is no path for a child under 13 to shop here.

If you believe a child under 13 has given us information anyway, email us and we will delete the account and the data. We do not need you to prove you are the parent before we delete it.

Shoppers aged 13 to 17

If your date of birth tells us you are under 18, then for as long as that is true:

• We do not send you marketing email, and we do not sign you up for it even if a subscribe box was ticked.
• We do not sell or share your personal information, and we do not include you in audiences used for targeted advertising.
• Individual stores may require you to be older than 13 to order at all, and some products — alcohol, tobacco and vape products, and others — have their own legal minimum that we enforce at checkout.

These restrictions lift on their own when you turn 18. We work your age out from your date of birth each time rather than storing a label, so nothing needs to be updated by hand.

A note on what we can and cannot know: we apply these protections when we have your date of birth. Accounts created before we started asking do not have one, and for those we have no way to tell. If you have an older account and want it treated as a minor’s account, email us.

Date of birth

We ask for it to work out whether we are allowed to sell to you, and nothing else. We do not use it for advertising or share it with the stores’ advertising tools.

Guests who are not signed in are only asked for a date of birth when the order actually contains something age-restricted. If an order needed an age check, we keep the date of birth and the age threshold we checked against on that order, because the store may have to show a regulator that it checked. Orders that did not need an age check have no date of birth stored against them.

Changes and contact

If we change this policy materially we will email merchants before it takes effect. Questions or requests: [email protected]