Privacy policy

This policy explains what Slop City collects, why, who processes it and how to have it deleted. Slop City is operated by Opsibyte ("we", "us"), the controller of the personal data described here. Contact: [email protected].

What we collect

• Account data: your email address, a password hash (never the password itself), your display name and your plan.
• Connected store and provider data: when you connect a store or a provider (for example a shop, a print partner or a social account) through OAuth or an API key, we store the access tokens. Tokens are encrypted at rest with AES-256-GCM and are never shown back to you.
• Order data: to fulfil an order we receive the buyer's name, delivery address and the items ordered. We pass this to the fulfilment provider that makes and ships the order and keep it only as long as needed for order sync and support, at most 90 days after delivery unless the law requires us to keep it longer.
• Your store content: listings, designs, prompts and settings you create in your city.
• Payment data: payments are handled by Stripe. We never see or store full card numbers; we keep the identifiers and plan status Stripe returns.
• Usage and technical data: basic request information such as network address, browser string and the pages requested, used for security and abuse prevention.
• Messages you send us, for example support email.

How we use it, and the legal bases

• To provide the service, run your city, connect your stores and fulfil orders: performance of the contract (GDPR Article 6(1)(b)).
• To take payment and keep billing records: performance of the contract and legal obligation (Article 6(1)(b) and (c)).
• To secure the service, prevent abuse and fix errors, including error monitoring: legitimate interests (Article 6(1)(f)).
• To measure which pages are visited with aggregate, cookieless analytics: legitimate interests (Article 6(1)(f)).
• To send service emails such as receipts, security notices and account messages: performance of the contract and legitimate interests.
• To answer your requests: performance of the contract or legitimate interests.

We do not sell personal data and we do not use buyer data for marketing.

Who processes data for us

We use the following processors. Each handles data only to provide its function to us.

• Stripe: payments and subscription billing.
• Resend: transactional email delivery.
• Sentry: error monitoring.
• Umami, self-hosted on our own infrastructure: page-view analytics. It sets no cookies and does not track you across sites.
• Our hosting provider: servers in the European Union.
• Fulfilment and print providers you choose to connect: they receive the buyer details needed to make and ship an order.
• The store and marketplace platforms you connect (for example Shopify, Etsy, Printful, Printify, Meta, Google, TikTok, Pinterest): they receive the listings and content you ask us to publish.

Where a processor is outside the European Economic Area, transfers rely on the European Commission's standard contractual clauses or an adequacy decision.

Retention

• Account data: kept while your account is open and deleted within 30 days after you close it, except records we must keep by law.
• Store and provider tokens: deleted when you disconnect the store or provider, and when your account is deleted.
• Buyer name and address: kept only as long as needed for order sync and support, and at most 90 days after delivery unless the law requires longer.
• Billing records: kept for the period tax and accounting law requires.
• Error reports: kept for up to 90 days.

Your rights

Under the GDPR you can ask us for access to your data, correction, erasure, restriction, objection, and a portable copy. You can withdraw consent at any time where we rely on it. Write to [email protected]; we answer within 30 days. You may also complain to your data protection authority. If you are a buyer whose order passed through a Slop City store, you can write to the same address, or to the store owner.

Data deletion

You can have your data deleted in these ways:

• Delete your account from Settings, or email [email protected] from the address on the account. We delete your account data within 30 days.
• Disconnect a store or provider in your city. Disconnecting revokes the access we hold and deletes its stored tokens.
• Shopify shop/redact and customer data requests are handled automatically: when a shop uninstalls the app or Shopify sends a redaction request, we delete that shop's tokens and data.
• Buyers can ask for their order data to be deleted by emailing [email protected]. We delete it unless the law requires us to keep it.

Children

Slop City is for people aged 18 and over who run a business. We do not knowingly collect data from children. If you believe a child has given us data, write to [email protected] and we will delete it.

Security

Tokens are encrypted with AES-256-GCM, connections use TLS, access to production data is limited, and write actions need your approval. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.

Changes

We may update this policy. The date at the top shows the latest version, and we will email account holders about material changes before they apply.

Contact

Opsibyte, operator of Slop City. Email [email protected].