Skip to content
Log inCreate my store

Privacy policy

Version in force as of 1 October 2026.

This policy describes how Komerxe collects and uses the personal data of visitors to its website, of Merchants and of their team members, and the rights of the persons concerned. It applies to the Komerxe presentation website, the Merchants’ dashboard and the emails sent by Komerxe.

1. Controller

Komerxe is the controller of the processing described in this policy. Any question or request may be sent to [email protected].

The data of a shop’s Buyers is the responsibility of the Merchant who runs that shop, with Komerxe acting on its behalf as processor (see section 9).

2. Data collected

Depending on how you use our services, we process the following categories of data:

  • account data: name, email address, password stored in hashed form, language and preferences; where applicable, the two-factor authentication secret (encrypted) and the public part of your passkeys;
  • data from Sign in with Google, if you choose this option: name, email address and its verification status, profile picture and Google account identifier. This data is used only to create your account and authenticate you; Komerxe has no access to your emails, contacts or Google files;
  • shop data: name, address, country, currency, time zone, published contact details, settings, products, content, orders and team members;
  • subscription payment data: Plan, period, amount, currency, date and payment reference. Payment is processed by Wajub; Komerxe has no knowledge of your card or mobile money account numbers;
  • technical and security data: IP address and browser associated with open sessions, log of actions taken in the shop (author, nature and date of each change), technical and error logs;
  • communication data: your exchanges with Komerxe, and your consent or refusal to receive our tips and news, with its date;
  • notification data, if you enable alerts: your browser’s subscription address or your Telegram chat identifier;
  • connected service data: the access tokens required by the services you link to your shop (payment, Google Calendar, email, WhatsApp); the data obtained from Google Calendar is described in section 10;
  • content submitted to automated tools: texts and images sent to the writing, translation or retouching tools;
  • presentation website data: if you subscribe to the newsletter, your email address, your first name if provided and the page language. The website also stores in your browser, without cookies, the currency you selected and, for 30 days, the shop that referred you.

3. Purposes and legal bases

  • Provision of the service (creating and managing the account and shop, subscription payment, support): performance of the contract.
  • Platform security, prevention of fraud and abuse, enforcement of the terms of use: Komerxe’s legitimate interest.
  • Service emails (welcome, onboarding, subscription expiry, security): performance of the contract and legitimate interest.
  • Tips and news: consent, which may be withdrawn at any time using the link in each email.
  • Aggregated statistics to improve the service: legitimate interest.
  • Accounting and responding to requests from the authorities: legal obligations.

Komerxe does not sell or rent your data and does not use it for targeted advertising. No decision producing legal effects concerning you is based solely on automated processing.

4. Recipients

Your data is accessible only to authorised Komerxe personnel, within the scope of their duties (support, security, billing) and subject to a duty of confidentiality. It is also processed, on Komerxe’s instructions, by the following processors:

  • OVHcloud, for hosting the servers and the database, in the European Union;
  • Amazon Web Services, for file storage (images, documents, backups) and email delivery, in the United States;
  • Lekalao, for sending Komerxe’s emails and managing its newsletter;
  • Wajub, for the payment of Plans and Packs;
  • Anthropic, for writing and translation suggestions, only when you request them, in the United States;
  • the image background-removal provider selected by Komerxe, only for the images you submit to it;
  • your browser’s notification service (Google, Apple or Mozilla), if you enable alerts;
  • Google, Telegram and any other service you choose to connect, to the extent required by that connection.

Your data may also be disclosed to the authorities where required by law and, in the event of a merger or sale, to any acquirer of Komerxe’s business, which will be bound by this policy.

5. Transfers outside your country

Komerxe is used in many countries and its processors are established in the European Union and the United States. Your data may therefore be processed in a country other than your own. These transfers are governed by the contractual data protection commitments entered into by each processor, such as the European Commission’s standard contractual clauses.

6. Retention periods

  • Account: for as long as you are registered; it is erased as soon as you delete it from your profile.
  • Closed shop: 90 days from closure, to allow pending disputes and payments to be settled, then permanently deleted.
  • Plan and Pack payments: 10 years, in accordance with accounting obligations.
  • Login sessions: until they expire.
  • Shop action log: 1 year.
  • Detailed visit statistics: 90 days, after which only daily totals are kept.
  • Page performance measurements: 90 days.
  • Files moved to the bin: 30 days.
  • Events read from a connected calendar: until the first synchronisation after they are removed from the calendar or more than one day after they end, and in any case no longer than until the calendar is disconnected.
  • Database backups: 14 days.
  • Newsletter: until you unsubscribe.

7. Security

Komerxe implements appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), password hashing, two-factor authentication and passkeys, storage of private files out of public reach with time-limited links, an encrypted daily backup of the database and restriction of internal access to authorised personnel.

In the event of a data breach likely to result in a risk to your rights, Komerxe informs you and the competent authorities under the conditions and within the time limits set by law.

8. Your rights

Under the conditions set by the law applicable to you, you have the right to access, rectify and erase your data and to restrict its processing, the right to object, including at any time to direct marketing, the right to data portability, and the right to withdraw your consent at any time.

Several of these rights can be exercised directly from the dashboard: editing your profile, exporting orders and customers, closing your shop and then deleting your account. For any other request, write to [email protected] from the address associated with your account. Komerxe responds within 30 days and may ask you to prove your identity.

You may also lodge a complaint with the data protection authority of your country.

9. Buyers in Komerxe shops

Each shop is run by an independent Merchant, who is responsible for the data you provide to it (name, email address, phone number, delivery address, orders, reviews, appointments). Komerxe hosts and processes this data on the Merchant’s behalf and does not use it for its own purposes. Please read the shop’s privacy policy and send your requests to the shop; any request received by Komerxe is forwarded to the Merchant concerned.

On every Komerxe shop:

  • the Merchant can export your data or erase it at your request, in which case orders and invoices are kept without the information that identifies you;
  • marketing emails and cart reminders are sent only with your consent and include an unsubscribe link;
  • advertising pixels load only after your consent;
  • visit statistics rely on a random session identifier, without recording your IP address;
  • access to your customer account is through a single-use link, and the corresponding session is erased one week after it expires;
  • payment is processed by the shop’s payment provider, and Komerxe has no knowledge of your card details.

10. Google Calendar

A Merchant who links its Google Calendar account to its shop authorises Komerxe to view and edit the events in its primary calendar. Komerxe uses this authorisation only for the following purposes:

  • adding the sessions booked on the shop to the calendar, moving them when they are rescheduled and deleting them when the Merchant cancels them. Each event contains the name of the service, the date, time and length of the session, its place or its online link, the notes left by the Buyer and, if provided, the Buyer’s email address, added as a guest;
  • creating a Google Meet room for online sessions that have no link of their own, when the Merchant has turned this option on;
  • not offering Buyers a slot that is already taken. To this end, Komerxe reads the events in the primary calendar from the previous day to three months ahead, and keeps only their identifier, start and end times and their busy or free status. The title, description, location and guests of these events are not kept.

The access tokens issued by Google are stored encrypted and are never displayed. At each synchronisation, events read that have been removed from the calendar or that ended more than one day earlier are erased. Disconnecting the calendar from the dashboard erases the tokens and all events read; sessions already added to the calendar remain there. The Merchant may also revoke this access at any time from its Google account settings.

Data obtained from Google Calendar is not sold, not used for advertising and not used to train artificial intelligence models. It is not disclosed to any third party, except the hosting and backup processors listed in section 4. No Komerxe personnel reads it, except at the Merchant’s request, for security purposes or to comply with a legal obligation.

Komerxe’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

11. Cookies

The dashboard uses only cookies that are strictly necessary for it to work: a session cookie, a cookie protecting against request forgery and two display preference cookies (light or dark theme, side menu state). No advertising cookies are set. Cookies on the presentation website and on shops are described on the Cookies page.

12. Minors

The Komerxe dashboard is reserved for persons aged 18 or over. Komerxe does not knowingly collect data relating to minors on its own behalf.

13. Changes to this policy

Komerxe may amend this policy. The version in force is the one whose date appears at the top of the page. Any material change is notified to you by email or in the dashboard before it takes effect.

Create my store for free