Privacy Policy

We collect information in three ways: what you give us directly, what arises automatically from how you use eStore, and what we receive from third-party partners.

Information you provide

• Account details - your name, email address, and password when you register.
• Seller profile - display name, bio, payout method, tax identification number, and uploaded business documents required for seller verification.
• Payment information - billing address and payment details. Card numbers are handled exclusively by Stripe; eStore never stores raw card data.
• Listings and products - files, descriptions, pricing, and metadata that sellers upload to the platform.
• Communications - messages sent through our buyer–seller messaging system, support tickets, and any other correspondence with our team.

Information collected automatically

• Usage data - pages visited, search queries, products viewed, and time spent on the platform.
• Device and browser - IP address, browser type, operating system, screen resolution, and referring URL.
• Transaction records - order IDs, purchase amounts, download timestamps, and refund history.
• Cookies and similar technologies - see Section 4 for the full breakdown.

Information from third parties

• Payment partners - Stripe shares transaction status, fraud signals, and payout confirmations with us.
• Identity verification - our KYC provider shares a pass/fail status for seller document verification; we do not receive or store copies of your identity documents.

We share your information only in the limited circumstances below. We never sell it.

Service providers - companies that process data on our behalf under strict data processing agreements:

• Stripe - payment processing and fraud detection
• Amazon Web Services - file storage and content delivery (S3, CloudFront)
• Postmark - transactional email delivery
• Intercom - customer support messaging
• Persona - seller identity and document verification

Between buyers and sellers - when you complete a purchase, your display name is shared with the seller for record-keeping. Your email address and payment details are not shared with sellers.

Legal requirements - we disclose data when we have a good-faith belief that doing so is required to comply with a law, regulation, legal process, or enforceable governmental request; to protect the rights, property, or safety of eStore, our users, or the public; or to detect and prevent fraud.

Business transfers - if eStore is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you via email and a prominent notice on the platform before your data is subject to a different privacy policy.

We keep your data for as long as your account is active or as needed to provide services. Specific retention periods:

• Account data - kept until you delete your account, then purged within 30 days (subject to the exceptions below).
• Transaction and financial records - retained for 7 years to comply with tax and financial regulations in applicable jurisdictions.
• Seller tax documents - retained for 7 years after the calendar year in which earnings were generated.
• Support conversations - kept for 3 years after case closure to help resolve disputes.
• Usage logs - anonymized after 90 days; raw logs deleted within 12 months.
• Backups - encrypted backups are rotated and deleted on a 90-day cycle.

When an account is deleted, we remove all personally identifiable data from active systems on the above schedule. Financial records tied to legal obligations are retained separately and isolated from the primary database.

We take security seriously and implement layered technical and organizational controls:

• All data in transit is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted using AES-256.
• Passwords are hashed using bcrypt with a cost factor of 12 before storage. We never store plaintext passwords.
• Access to production systems is restricted to authorized personnel using multi-factor authentication and role-based controls.
• We run a responsible disclosure program. If you discover a vulnerability, contact security@estore.llc.
• We conduct annual third-party penetration tests and security audits.

eStore is not directed at children under 13 years of age, and we do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal data, we will delete that information promptly.

If you believe a child under 13 has created an account on eStore, please contact us at privacy@estore.llc so we can investigate and take appropriate action.

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Send an email notification to all registered users.
• Display a banner on the platform for 30 days after the change goes into effect.

Continued use of eStore after the effective date of a revised policy constitutes your acceptance of the changes. If you disagree with a change, you may delete your account at any time before it takes effect.