Privacy Policy
Effective Date: February 17, 2026 Last Updated: February 17, 2026 This Privacy Policy describes how Headless Commerce (“Company”, “we”, “us”, or “our”) collects, uses, stores, and protects personal data when you use the Headless Commerce platform, including the API, Dashboard, SDK, CLI, and related services (the “Service”). This policy applies to Merchants and their team members who use our platform. For information about how we process data on behalf of Merchants (i.e., your end-customers’ data), see our Data Processing Agreement.1. Data Controller
The data controller for the personal data described in this policy is: Headless Commerce Email: privacy@headlesscommerce.io Address: [Company Address] Data Protection Officer / 개인정보 보호책임자: Email: dpo@headlesscommerce.io2. Data We Collect
2.1 Account Data
When you register and use the Service, we collect:| Data | Purpose |
|---|---|
| Name | Account identification, communications |
| Email address | Authentication, notifications, billing |
| Password (hashed) | Authentication (bcrypt hashed, never stored in plaintext) |
| Profile image | Dashboard display |
| OAuth tokens | Authentication via Google/GitHub (stored encrypted) |
2.2 Organization & Billing Data
| Data | Purpose |
|---|---|
| Organization name | Account management |
| Billing email | Invoice delivery |
| Stripe Customer ID | Payment processing (card data stored by Stripe, not by us) |
| Stripe Subscription ID | Subscription management |
| Plan type | Service entitlements |
2.3 Technical & Usage Data
| Data | Purpose |
|---|---|
| IP address | Security, rate limiting, abuse prevention |
| User agent | Compatibility, debugging |
| API request paths | Usage analytics, debugging |
| Request/response metadata | Troubleshooting, audit logging |
| Dashboard activity | Feature usage analytics |
2.4 Data We Do NOT Collect
- Credit card numbers — All payment card data is handled directly by Stripe. We never see, transmit, or store card numbers.
- End-customer passwords — Customer authentication credentials are hashed and never accessible in plaintext.
3. Data We Process on Your Behalf
As a data processor, we process the following data that your end-customers submit through your store via our API:- Customer names, email addresses, phone numbers
- Shipping and billing addresses
- Order details and history
- Cart contents and session data
4. Legal Basis for Processing
4.1 Under GDPR (EU/EEA)
| Legal Basis | Processing Activity |
|---|---|
| Contract performance (Art. 6(1)(b)) | Providing the Service, account management, billing |
| Legitimate interest (Art. 6(1)(f)) | Security, fraud prevention, service improvement, analytics |
| Consent (Art. 6(1)(a)) | Marketing communications (opt-in only) |
| Legal obligation (Art. 6(1)(c)) | Tax records, regulatory compliance |
4.2 Under Korean Personal Information Protection Act (개인정보 보호법)
| Legal Basis | Processing Activity |
|---|---|
| Consent (제15조 제1항 제1호) | Account creation, marketing |
| Contract performance (제15조 제1항 제4호) | Service delivery, billing |
| Legitimate interest (제15조 제1항 제6호) | Security, fraud prevention |
| Legal obligation (제15조 제1항 제2호) | Tax/financial record keeping |
5. Data Sharing & Sub-processors
We share personal data only with the following categories of recipients:5.1 Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Neon | PostgreSQL database hosting | US/EU |
| Upstash | Redis caching and rate limiting | Regional |
| Stripe | Payment processing and billing | US (global) |
| Resend | Transactional email delivery | US |
| Sentry | Error monitoring and debugging | US |
| AWS S3 | Media/file storage | Regional |
| Cloudflare | CDN and DDoS protection | Global |
| Inngest | Background job processing | US |
5.2 We Do NOT
- Sell your personal data to any third party
- Share data for advertising purposes
- Use your data for profiling or automated decision-making
5.3 Law Enforcement
We may disclose data when legally compelled (court order, subpoena) or when necessary to prevent imminent harm. We will notify you unless prohibited by law.6. International Data Transfers
Your data may be transferred to and processed in countries outside your jurisdiction:6.1 EU/EEA Transfers
For transfers outside the EEA, we rely on:- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where applicable
6.2 Korean Cross-Border Transfers
In accordance with the Personal Information Protection Act (개인정보 보호법 제17조, 제28조의2):- We obtain your consent for international data transfers
- We ensure that receiving parties maintain equivalent data protection standards
- Details of cross-border transfers are listed in the sub-processor table above
7. Data Retention
| Data Type | Retention Period | Basis |
|---|---|---|
| Account data | Until account deletion + 30-day grace period | Contract |
| API logs (IP, user agent, requests) | 90 days rolling | Legitimate interest |
| Billing/payment records | 7 years | Tax law compliance |
| Transactional records (Korean law) | 3 years | 전자상거래법 (Electronic Commerce Act) |
| Marketing consent records | Duration of consent + 3 years | Legal obligation |
8. Your Rights
8.1 Under GDPR
If you are in the EU/EEA, you have the right to:- Access your personal data
- Rectify inaccurate data
- Erase your data (“right to be forgotten”)
- Port your data to another service
- Restrict or object to processing
- Withdraw consent at any time
- Lodge a complaint with your local supervisory authority
8.2 Under Korean Law (개인정보 보호법)
If you are in Korea, you have the right to:- 열람 (Access) — Request access to your personal data
- 정정·삭제 (Rectification/Erasure) — Request correction or deletion
- 처리정지 (Restriction) — Request suspension of processing
- 동의 철회 (Withdraw Consent) — Withdraw previously given consent
- 개인정보보호위원회 신고 — File a complaint with the Personal Information Protection Commission (PIPC)
8.3 Exercising Your Rights
To exercise any of these rights, contact us at privacy@headlesscommerce.io. We will respond within:- GDPR: 30 days
- Korean law: 10 days
9. Security Measures
We implement appropriate technical and organizational measures to protect your data:| Measure | Detail |
|---|---|
| Encryption in transit | TLS 1.3 for all API and Dashboard communications |
| Encryption at rest | AES-256 via database provider (Neon) |
| Password hashing | bcrypt with appropriate work factor |
| API key security | Secret keys are hashed; rotation supported |
| Rate limiting | Redis-based rate limiting to prevent abuse |
| Access control | Role-based access (Owner/Admin/Staff/Viewer) |
| Audit logging | All admin actions logged with IP and user agent |
| PCI compliance | SAQ-A eligible — no card data touches our servers |
10. Cookies & Tracking
10.1 Cookies We Use
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| Session token | Essential | Dashboard authentication (JWT) | Session |
| CSRF token | Essential | Cross-site request forgery protection | Session |
10.2 What We Don’t Use
- No third-party advertising cookies
- No cross-site tracking pixels
- No fingerprinting technologies
11. Children’s Privacy
The Service is not directed to individuals under the age of 16 (or 14 in Korea under 개인정보 보호법). We do not knowingly collect personal data from children. If we become aware of such collection, we will promptly delete the data.12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via:- Email notification to your account email
- Dashboard notification
- At least 30 days before taking effect
13. Contact
For privacy-related inquiries:- General inquiries: privacy@headlesscommerce.io
- Data Protection Officer / 개인정보 보호책임자: dpo@headlesscommerce.io
- Address: [Company Address]
- Korean regulatory body: 개인정보보호위원회 (PIPC), https://www.pipc.go.kr