Log in or sign up

Privacy policy

Last updated 2 November 2026

This policy explains what personal data Zepsell collects, why, who we share it with and the rights you have. It covers zepsell.com, the Zepsell dashboard and the services we run for merchants.

Who we are

Zepsell is run by Fikr Labs Limited, a company registered in England and Wales (company number 17166125), registered office Unit 3a Hastings Road, Leicester, England, LE5 0BT. For the data described here we are the data controller. Contact us about privacy at [email protected].

Merchants and their customers

When you run a store on Zepsell, your customers' details (names, addresses, emails, orders) belong to your business. For that data you are the controller and we are your processor: we store and process it only to run your store, on your instructions, as set out in our terms. Shoppers with questions about their data should contact the store they bought from. Each store should publish its own privacy policy.

What we collect

  • Account details: your email address. We don't use passwords. If you add a passkey we keep its public key; if you turn on an authenticator app we keep its secret, encrypted.
  • Your stores: store names, products, images, settings, domains and the other content you add, plus what you type into store creation and the assistant.
  • Billing: your plan, subscription status and a Stripe customer reference. Card details go straight to Stripe; we never see or store them.
  • Messages: emails you send us and the emails we send you (sign-in links, receipts, store notices).
  • Technical data: IP address, browser and request details in server logs, kept for security and troubleshooting. To prevent fraud, we keep a one-way fingerprint of the IP address you signed up from and the country it was in, and may check your IP address and email with a fraud-screening provider (IPQualityScore).
  • Usage statistics: pages visited, referrer, device type, country and page speed, collected with our own self-hosted Umami analytics. It sets no cookies, stores nothing on your device, removes IDs and sign-in tokens from page addresses before sending, and is not shared with anyone.

Why we use it

  • To create and run your account and stores, sign you in and keep them secure (performing our contract with you).
  • To bill you and keep financial records (contract and legal obligation).
  • To send service emails about your account, stores and billing (contract).
  • To understand how the site is used, prevent abuse and improve Zepsell (our legitimate interests).

We don't sell personal data, show adverts or use your data to profile you.

Cookies

We use only cookies that are needed for the site to work: zepsell_session keeps you signed in, and short-lived cookies hold a sign-in or passkey step while it's in progress. There are no advertising or tracking cookies, so there is no cookie banner.

Who we share it with

We use these providers to run Zepsell. Each handles data only on our instructions:

  • Stripe: subscription billing, and card payments in stores that use Stripe.
  • Cloudflare: network, DNS and protection for zepsell.com and store addresses.
  • Resend: sending sign-in and service emails, and store emails.
  • MXroute: our mailbox, when you email us.
  • Backblaze: off-site backups of store uploads.
  • Anthropic: AI features such as store creation and the assistant. What you type into those features is sent to Anthropic to generate a response.

We may also disclose data where the law requires it, or to a buyer if the business is sold.

International transfers

Some of these providers process data outside the UK, mainly in the United States. Where they do, we rely on UK adequacy regulations (including the UK–US data bridge) or the UK International Data Transfer Agreement or Addendum to protect it.

How long we keep it

  • Account and store data: while your account is open. When you close it we delete your stores and account; backups are overwritten on their normal cycle.
  • Billing records: six years, as UK tax law requires.
  • Server logs: a short period for security, then deleted.
  • Usage statistics: kept in aggregate; they don't identify you.

Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable format. Email [email protected] and we'll reply within a month. If you're unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.

Security

Traffic is encrypted, secrets such as payment keys and authenticator secrets are encrypted at rest, sign-in is by email link or passkey, and access to production systems is limited to the people who run Zepsell.

Children

Zepsell is a service for businesses and isn't meant for anyone under 18.

Changes

If we change this policy we'll update the date above, and email account holders about significant changes.