Privacy Policy

Last updated: October 19, 2026

This Privacy Policy explains how ShopsBuilder ("ShopsBuilder", "we", "us") collects, uses, shares and keeps personal information when you use the ShopsBuilder store builder, the stores created with it, and the ShopsBuilder MCP server that lets AI agents manage a store (together, the "Services").

ShopsBuilder is a platform for building and running online stores. A merchant creates a store and decides what it sells, which payment providers it uses, and which AI agents can manage it. For personal information about a store's customers, the merchant is the controller and ShopsBuilder processes that information on the merchant's behalf.

The Telegram bot version of ShopsBuilder has its own privacy policy.

Information we collect

Your account

You sign in to ShopsBuilder through our identity service at id.shopsbuilder.app. When you create or use an account we collect:

• your email address, name and password (the password is stored only as a hash);
• if you sign in with Telegram, your Telegram user ID, name and username;
• sign-in sessions and security events, such as login time, IP address and browser type.

Your store

When you build and run a store we store the content and settings you provide, including the store name, profile, branding, products, prices, stock, categories, shipping zones and rates, promotions and payment settings.

Orders and customers

When customers buy from your store we process the data needed to complete the order: name, email address, phone number, shipping and billing address, the items ordered, amounts, payment status and order history. Payment card details are entered with the payment provider and do not reach ShopsBuilder.

AI agents connected to your store

You can connect an AI agent (for example Claude) to your store through the ShopsBuilder MCP server at https://mcp.shopsbuilder.app/mcp. The agent signs in with OAuth as you, so it can only reach the stores your account can reach. Depending on what you ask it to do, a connected agent can:

• read your stores, products, prices, stock, categories, promotions, warehouses, shipping, channels, orders, order counts, sales summaries and customers;
• change your store: create a store, create and update products, variants, categories, prices, stock, media, promotions, channels and shipping rates, publish products, and update the store profile. Agents are asked to show you a preview and get your confirmation before changes such as creating a store.

For each tool call we record an audit log entry: the account, the store, the tool name, the names (not the values) of its inputs, the outcome and the time. When you tell an agent about something the Services can't do yet, we keep that request after removing email addresses and phone numbers.

Usage and device data

We collect basic usage data on our websites and apps (pages viewed, referrer, device and browser type, approximate location from the IP address) with a privacy-focused analytics tool that we host ourselves. We use cookies and local storage that are needed for sign-in, language and preferences.

How we use information

We use personal information to:

• provide the Services: create and host stores, process orders, send order and account emails, and run the tools that a connected AI agent calls;
• secure the Services: authenticate users, prevent fraud and abuse, and investigate errors and incidents (including through the MCP audit log);
• bill subscriptions and keep accounting records;
• support you when you contact us;
• understand how the Services are used and improve them;
• comply with legal obligations.

We don't sell personal information, and we don't use store or customer data to train AI models.

Storage and security

Your data is stored on servers operated by our hosting providers. We protect it with encrypted connections (HTTPS), access controls and separate data for each store. No system is completely secure, so please use a strong password and keep your sign-in methods safe.

Sharing

We share personal information only as needed to run the Services:

• The AI client you connect. When you connect an AI agent, the data the agent reads through the MCP server is sent to that AI client (for example Anthropic for Claude) and processed under that provider's terms and privacy policy. You choose which client to connect and can disconnect it at any time.
• Hosting and infrastructure providers that host our servers, deliver our websites and send email for us.
• Payment providers. Subscription payments for ShopsBuilder plans are processed by our payment provider, which acts as merchant of record. Store orders are paid through the payment providers the merchant connects, which receive the payment details they need.
• Telegram, if you sign in with Telegram or run your store in Telegram.
• Legal and safety reasons, when required by law or to protect the rights and safety of users and ShopsBuilder.
• Business transfers, if ShopsBuilder is involved in a merger or acquisition, in which case this policy continues to apply.

Retention

• Account data is kept while your account is active. When you ask us to delete your account, we delete it within 30 days.
• Store, order and customer data is kept while the store exists and is deleted within 30 days after the store is deleted, unless the merchant must keep order records for tax or accounting reasons.
• MCP audit logs are kept as long as we need them for security, abuse investigation and troubleshooting.
• Billing records are kept as long as tax and accounting law requires.
• Backups are overwritten on a rolling schedule, normally within 30 days.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to or restrict its processing. You can change most account and store data in the builder yourself. For anything else, email us at the address below.

If you are a customer of a store built on ShopsBuilder, please contact that store first; we will help the merchant with your request.

Children

The Services are not directed to children under 16, and we don't knowingly collect their personal information.

International transfers

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards for these transfers.

Changes

We may update this policy. We will change the "Last updated" date above and, for significant changes, notify account holders by email or in the builder.

Contact

Questions or requests about privacy: [email protected].