> ## Documentation Index
> Fetch the complete documentation index at: https://docs.headlesscommerce.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy Policy

> How Headless Commerce collects, uses, and protects your data

# Privacy Policy

**Effective Date:** February 17, 2026
**Last Updated:** February 17, 2026

This Privacy Policy describes how Headless Commerce ("Company", "we", "us", or "our") collects, uses, stores, and protects personal data when you use the Headless Commerce platform, including the API, Dashboard, SDK, CLI, and related services (the "Service").

This policy applies to **Merchants and their team members** who use our platform. For information about how we process data on behalf of Merchants (i.e., your end-customers' data), see our [Data Processing Agreement](/legal/data-processing-agreement).

***

## 1. Data Controller

The data controller for the personal data described in this policy is:

**Headless Commerce**
Email: [privacy@headlesscommerce.io](mailto:privacy@headlesscommerce.io)
Address: \[Company Address]

**Data Protection Officer / 개인정보 보호책임자:**
Email: [dpo@headlesscommerce.io](mailto:dpo@headlesscommerce.io)

## 2. Data We Collect

### 2.1 Account Data

When you register and use the Service, we collect:

| Data              | Purpose                                                   |
| ----------------- | --------------------------------------------------------- |
| Name              | Account identification, communications                    |
| Email address     | Authentication, notifications, billing                    |
| Password (hashed) | Authentication (bcrypt hashed, never stored in plaintext) |
| Profile image     | Dashboard display                                         |
| OAuth tokens      | Authentication via Google/GitHub (stored encrypted)       |

### 2.2 Organization & Billing Data

| Data                   | Purpose                                                    |
| ---------------------- | ---------------------------------------------------------- |
| Organization name      | Account management                                         |
| Billing email          | Invoice delivery                                           |
| Stripe Customer ID     | Payment processing (card data stored by Stripe, not by us) |
| Stripe Subscription ID | Subscription management                                    |
| Plan type              | Service entitlements                                       |

### 2.3 Technical & Usage Data

| Data                      | Purpose                                   |
| ------------------------- | ----------------------------------------- |
| IP address                | Security, rate limiting, abuse prevention |
| User agent                | Compatibility, debugging                  |
| API request paths         | Usage analytics, debugging                |
| Request/response metadata | Troubleshooting, audit logging            |
| Dashboard activity        | Feature usage analytics                   |

### 2.4 Data We Do NOT Collect

* **Credit card numbers** — All payment card data is handled directly by Stripe. We never see, transmit, or store card numbers.
* **End-customer passwords** — Customer authentication credentials are hashed and never accessible in plaintext.

## 3. Data We Process on Your Behalf

As a **data processor**, we process the following data that your end-customers submit through your store via our API:

* Customer names, email addresses, phone numbers
* Shipping and billing addresses
* Order details and history
* Cart contents and session data

This processing is governed by our [Data Processing Agreement](/legal/data-processing-agreement). You (the Merchant) are the **data controller** for this data and are responsible for obtaining appropriate consent from your end-customers.

## 4. Legal Basis for Processing

### 4.1 Under GDPR (EU/EEA)

| Legal Basis                         | Processing Activity                                        |
| ----------------------------------- | ---------------------------------------------------------- |
| Contract performance (Art. 6(1)(b)) | Providing the Service, account management, billing         |
| Legitimate interest (Art. 6(1)(f))  | Security, fraud prevention, service improvement, analytics |
| Consent (Art. 6(1)(a))              | Marketing communications (opt-in only)                     |
| Legal obligation (Art. 6(1)(c))     | Tax records, regulatory compliance                         |

### 4.2 Under Korean Personal Information Protection Act (개인정보 보호법)

| Legal Basis                         | Processing Activity          |
| ----------------------------------- | ---------------------------- |
| Consent (제15조 제1항 제1호)              | Account creation, marketing  |
| Contract performance (제15조 제1항 제4호) | Service delivery, billing    |
| Legitimate interest (제15조 제1항 제6호)  | Security, fraud prevention   |
| Legal obligation (제15조 제1항 제2호)     | Tax/financial record keeping |

We obtain separate, specific consent for each purpose as required by Korean law. Consent is freely given and may be withdrawn at any time.

## 5. Data Sharing & Sub-processors

We share personal data only with the following categories of recipients:

### 5.1 Sub-processors

| Sub-processor | Purpose                         | Location    |
| ------------- | ------------------------------- | ----------- |
| Neon          | PostgreSQL database hosting     | US/EU       |
| Upstash       | Redis caching and rate limiting | Regional    |
| Stripe        | Payment processing and billing  | US (global) |
| Resend        | Transactional email delivery    | US          |
| Sentry        | Error monitoring and debugging  | US          |
| AWS S3        | Media/file storage              | Regional    |
| Cloudflare    | CDN and DDoS protection         | Global      |
| Inngest       | Background job processing       | US          |

### 5.2 We Do NOT

* Sell your personal data to any third party
* Share data for advertising purposes
* Use your data for profiling or automated decision-making

### 5.3 Law Enforcement

We may disclose data when legally compelled (court order, subpoena) or when necessary to prevent imminent harm. We will notify you unless prohibited by law.

## 6. International Data Transfers

Your data may be transferred to and processed in countries outside your jurisdiction:

### 6.1 EU/EEA Transfers

For transfers outside the EEA, we rely on:

* **Standard Contractual Clauses (SCCs)** approved by the European Commission
* Adequacy decisions where applicable

### 6.2 Korean Cross-Border Transfers

In accordance with the Personal Information Protection Act (개인정보 보호법 제17조, 제28조의2):

* We obtain your consent for international data transfers
* We ensure that receiving parties maintain equivalent data protection standards
* Details of cross-border transfers are listed in the sub-processor table above

## 7. Data Retention

| Data Type                           | Retention Period                             | Basis                            |
| ----------------------------------- | -------------------------------------------- | -------------------------------- |
| Account data                        | Until account deletion + 30-day grace period | Contract                         |
| API logs (IP, user agent, requests) | 90 days rolling                              | Legitimate interest              |
| Billing/payment records             | 7 years                                      | Tax law compliance               |
| Transactional records (Korean law)  | 3 years                                      | 전자상거래법 (Electronic Commerce Act) |
| Marketing consent records           | Duration of consent + 3 years                | Legal obligation                 |

After the retention period, data is permanently deleted or anonymized.

## 8. Your Rights

### 8.1 Under GDPR

If you are in the EU/EEA, you have the right to:

* **Access** your personal data
* **Rectify** inaccurate data
* **Erase** your data ("right to be forgotten")
* **Port** your data to another service
* **Restrict** or **object to** processing
* **Withdraw consent** at any time
* **Lodge a complaint** with your local supervisory authority

### 8.2 Under Korean Law (개인정보 보호법)

If you are in Korea, you have the right to:

* **열람 (Access)** — Request access to your personal data
* **정정·삭제 (Rectification/Erasure)** — Request correction or deletion
* **처리정지 (Restriction)** — Request suspension of processing
* **동의 철회 (Withdraw Consent)** — Withdraw previously given consent
* **개인정보보호위원회 신고** — File a complaint with the Personal Information Protection Commission (PIPC)

### 8.3 Exercising Your Rights

To exercise any of these rights, contact us at [privacy@headlesscommerce.io](mailto:privacy@headlesscommerce.io). We will respond within:

* **GDPR**: 30 days
* **Korean law**: 10 days

## 9. Security Measures

We implement appropriate technical and organizational measures to protect your data:

| Measure               | Detail                                            |
| --------------------- | ------------------------------------------------- |
| Encryption in transit | TLS 1.3 for all API and Dashboard communications  |
| Encryption at rest    | AES-256 via database provider (Neon)              |
| Password hashing      | bcrypt with appropriate work factor               |
| API key security      | Secret keys are hashed; rotation supported        |
| Rate limiting         | Redis-based rate limiting to prevent abuse        |
| Access control        | Role-based access (Owner/Admin/Staff/Viewer)      |
| Audit logging         | All admin actions logged with IP and user agent   |
| PCI compliance        | SAQ-A eligible — no card data touches our servers |

## 10. Cookies & Tracking

### 10.1 Cookies We Use

| Cookie        | Type      | Purpose                               | Duration |
| ------------- | --------- | ------------------------------------- | -------- |
| Session token | Essential | Dashboard authentication (JWT)        | Session  |
| CSRF token    | Essential | Cross-site request forgery protection | Session  |

### 10.2 What We Don't Use

* No third-party advertising cookies
* No cross-site tracking pixels
* No fingerprinting technologies

## 11. Children's Privacy

The Service is not directed to individuals under the age of 16 (or 14 in Korea under 개인정보 보호법). We do not knowingly collect personal data from children. If we become aware of such collection, we will promptly delete the data.

## 12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via:

* Email notification to your account email
* Dashboard notification
* At least 30 days before taking effect

## 13. Contact

For privacy-related inquiries:

* **General inquiries**: [privacy@headlesscommerce.io](mailto:privacy@headlesscommerce.io)
* **Data Protection Officer / 개인정보 보호책임자**: [dpo@headlesscommerce.io](mailto:dpo@headlesscommerce.io)
* **Address**: \[Company Address]
* **Korean regulatory body**: 개인정보보호위원회 (PIPC), [https://www.pipc.go.kr](https://www.pipc.go.kr)