Storefront Labs, LLC ("Storefront Labs," "we," "us") is a Florida company based in Sarasota, Florida. This policy explains what information we collect, how we use it, and the choices you have when you use our products and services:
- Storefront Business Manager, our app for business owners and their teams (iOS and Android)
- Places, our consumer app for discovering nearby businesses (iOS and Android)
- Storefront signs, our connected in-store sign hardware
- storefrontworks.com and related services
The short version: we collect only what we need to run the service, we do not sell your information, we do not show ads, and you can delete your account and data at any time.
1. Information We Collect
Account and sign-in information. When you create an account, we collect the information you sign in with: your email address, your phone number, or an identifier from your Apple, Google, or X (formerly Twitter) account, depending on the sign-in method you choose. Sign-in with email, phone, Apple, Google, and X is handled by Privy, our identity provider. If you sign in to Places with X, we receive your X display name (used as your account name) and an internal account identifier from Privy. X does not share an email address with us, and your X profile photo is shown only inside the app on your phone; we do not store it on our servers. In Business Manager you can also choose "Continue with Facebook." Our own servers handle that sign-in directly with Facebook, and we receive your Facebook account ID, name, email address (if you have one on Facebook), and profile picture link. After sign-in, our own servers issue the credentials that keep you signed in, and we store those session records on our servers so we can revoke access when you sign out or delete your account. For business accounts we also collect your name.
Business information (Business Manager). Business profiles, locations, business hours and special hours, photos or logos you upload for your business, and records of the Storefront signs registered to your account.
Sign and device information. Connected Storefront signs send us periodic status reports ("heartbeats") that include a device identifier, connection status, and technical telemetry. We use this so you can see whether your sign is online and working, and so we can troubleshoot problems.
Connected platforms (Business Manager). If you choose to connect your Google Business Profile or your Facebook Page to Business Manager, we receive information about your business listings and Pages from Google or Meta. Section 3A explains exactly what we receive, what we do with it, and how to remove it.
Technical logs. Our servers keep technical logs of requests to our services, including IP address and device or app information, for security and troubleshooting.
Location information (Places). With your permission, Places uses your device's location to show businesses near you. Nearby search is powered by Apple Maps on iOS and Google Maps on Android, so your device location is used by those services to return nearby results. You can browse Places without granting location access, and you can turn location access off at any time in your device settings.
Content you provide. Favorites you save in Places, feedback you submit through our apps, sign content you create in Business Manager, and, if you use the optional AI assistant in Business Manager, the questions you type into that chat.
Payment information (Business Manager subscriptions). Subscription payments are processed by Stripe. Your card details are entered directly with Stripe and are never stored on our servers. We keep records of your subscription status and payment history, such as your plan, dates, and amounts, but we never see or store your card number.
What we do not collect. We do not sell personal information and we do not use advertising tracking, analytics SDKs, Google Analytics, or Meta Pixel. We do not use advertising SDKs of any kind, and we do not run third-party analytics beyond the standard aggregated statistics that Apple and Google provide to all app developers (including TestFlight beta statistics). We do not track you across other companies' apps or websites. Our website currently sets no cookies; see our Cookie Policy at https://www.storefrontworks.com/legal/cookie-policy.html.
2. How We Use Information
We use the information above to:
- Create and secure your account and sign you in
- Provide the core features of each app: managing business profiles, hours, locations, and signs; showing nearby businesses; syncing your favorites to your account
- Monitor connected Storefront signs and show you their status
- Connect Business Manager to the Google Business Profile and Facebook Pages you choose, confirm that you manage the business you add, import your hours from Google when you ask, and keep your Facebook Page's hours and open/closed status in step with Storefront (see Section 3A)
- Process subscription payments and maintain billing records
- Answer questions you ask the optional AI assistant, and respond to your feedback and support requests
- Maintain security, prevent fraud and abuse, and comply with legal obligations
We do not use your information for advertising, and we do not sell it to anyone.
3. Service Providers We Work With
We share information only with the service providers we need to run the platform, and only for the purposes described here. The six providers below are the only third-party processors of personal information we use:
- Privy handles sign-in and identity (email one-time codes, Sign in with Apple, Google sign-in, X sign-in, and phone sign-in).
- Stripe processes subscription payments for Business Manager. Stripe handles your card details under its own privacy policy.
- Amazon Web Services (AWS) hosts our servers and database in the United States, and connected Storefront signs communicate with us through AWS IoT.
- Apple provides Sign in with Apple, and Apple Maps nearby-business search on iOS. Your device location is used by the Maps service to return nearby results.
- Google provides Google sign-in, and Google Maps search on Android. Your device location is used by the Maps service to return nearby results.
- Anthropic powers the optional AI assistant in Business Manager. The content of your chat messages is sent to Anthropic's Claude API only when you choose to use this feature.
A current list of these subprocessors and what each one does is maintained at https://www.storefrontworks.com/legal/subprocessors.html.
Google and Meta as platforms you connect. When you connect Google Business Profile or Facebook in Business Manager, Google and Meta are not working for us as service providers. They are separate companies whose services you are linking to your Storefront account. We exchange information with them only to carry out what you ask for, as described in Section 3A, and their own privacy policies govern what they do with information on their platforms.
We may also disclose information if required by law (for example, in response to a valid legal request), or as part of a merger, acquisition, or sale of the business, in which case this policy will continue to apply to your information until you are told otherwise.
Bluetooth sign setup. When you set up a Storefront sign, the app sends your Wi-Fi network name and password directly from your phone to your own sign over Bluetooth so the sign can join your network. Your Wi-Fi password goes to your device, not to our servers.
3A. Connected Platforms: Google Business Profile and Facebook Pages
Connecting Google or Facebook is optional. Business Manager works without either. You connect them, and disconnect them, from the Platforms card on the Business Manager home screen.
Google Business Profile
What you approve. When you tap Connect on Google, Google asks you to sign in and to give Storefront Business Manager permission to manage your Business Profile on Google (Google's permission name is https://www.googleapis.com/auth/business.manage). This is the only Google permission we ask for. Google offers no smaller, view-only permission for Business Profile, so its approval screen describes it as "manage" even though we only read with it today.
What we read. Right after you approve, and each time you reconnect, we read the list of Business Profile locations your Google account can manage. For each location we read its Google location ID, business name, address, regular weekly hours, and its Google Maps place ID.
What we use it for. We use this information only to:
- confirm that you manage the business you are adding or claiming in Business Manager, by matching the business name or address; and
- make sure that hours you import come from your own listing, by checking that the business's Google Maps place ID matches one of your connected locations.
When you tap Import hours, we look up that place's current hours on Google Maps and show you a preview. Nothing changes until you tap Apply Hours. Then the hours are saved to your Storefront business and sent to your Storefront signs.
What we change on Google. Nothing. Business Manager does not currently edit, publish, post, reply to reviews, or delete anything on your Google Business Profile.
How we store it. We keep the Google access credentials (an access token and a refresh token), the location details listed above, and the date and the Business Manager user who connected. They are stored in your business's connection record in our database on Amazon Web Services in the United States. The data is encrypted in transit and at rest. We never send your Google credentials to the app or to anyone else.
How long we keep it. For as long as the business stays connected to Google.
How to remove it. An owner or editor can tap Disconnect next to Google on the Platforms card. This permanently deletes the business's Google connection record, including the credentials and location details, from our live database right away. Residual copies in encrypted backups roll off on our standard backup cycle. Disconnecting does not remove Storefront Business Manager from your Google Account's list of connected apps. To do that too, go to your Google Account settings (https://myaccount.google.com/connections), choose Storefront Business Manager, and remove its access.
Limited Use. Storefront Business Manager's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In plain terms, we use Google Business Profile data only to provide the Business Manager features described above. We do not sell it, use it for advertising, or share it with anyone except as needed to provide those features, for security, or to comply with the law. We do not use it to train AI models. No person at Storefront reads it unless you ask us to for support, it is needed for security or to comply with the law, or it has been aggregated and anonymized for internal operations.
Facebook Pages
What you approve. When you tap Connect on Facebook, or choose Continue with Facebook to sign in, Facebook asks you to let Storefront Business Manager see the Pages you manage (pages_show_list), manage your Pages' settings (pages_manage_metadata), see the business portfolios you belong to (business_management), and see your email address (email). Facebook shows you which ones you are approving, and you can decline any of them.
What we read.
- Your basic Facebook profile: account ID, name, email address, and profile picture link.
- Which of these permissions you approved.
- The Pages you manage. For each Page we read its ID, name, category, your role on the Page, address and location, and a Page access credential (a Page access token) that Facebook issues for that Page.
- Only if Facebook returns no Pages that you manage directly, and you approved business_management: the business portfolios you belong to (their ID and name), and the Pages those portfolios own or manage for clients, with the same Page details.
We do not read your ads, ad accounts, Page insights, posts, comments, messages, followers, or friends.
What we use it for. To let you pick which Page belongs to your business, to confirm that you manage it, and, if you used Continue with Facebook, to sign you in to Business Manager.
What we change on Facebook. Only your selected Page, and only in two ways:
- When you save your weekly hours in Business Manager while Facebook is connected, we update the hours on that Page.
- When you mark your business closed for today, we set the Page's temporary status to "temporarily closed." When you reopen, or after that day ends, we set it back to "operating as usual."
We never post, comment, message, or change anything else on your Page.
How we store it. We keep the Facebook access credentials (your access token and a Page access token for each Page we read), the Page and portfolio details listed above, your basic Facebook profile, which Page you selected, and a record of the last hours and status we sent to Facebook along with Facebook's reply. They are stored in your business's connection record in our database on Amazon Web Services in the United States, encrypted in transit and at rest. We never send Facebook credentials to the app or to anyone else.
How long we keep it. For as long as the business stays connected to Facebook.
How to remove it. Tap Disconnect next to Facebook on the Platforms card. This permanently deletes the business's Facebook connection record, including all credentials, the Page list, and your Facebook profile details, from our live database right away. Residual copies in encrypted backups roll off on our standard backup cycle. To also remove the app from your Facebook account, go to your Facebook settings, open Business integrations, and remove Storefront Business Manager. If you signed in with Facebook, your Storefront account itself is deleted the way Section 5 describes.
When you delete your account
Google and Facebook connections belong to the business, not to one person, so they are not removed when one member deletes their personal account. If you are the only person on a business and want its connections removed too, tap Disconnect for each platform before deleting your account, or email hello@storefrontworks.com and we will delete them.
4. How Long We Keep Information
We keep your information for as long as your account is active. Billing records may be retained after that where tax, accounting, or other legal requirements apply. Sign telemetry is kept for operations and troubleshooting. When you delete your account, we delete your information as described in Section 5.
Technical request logs are kept for up to 30 days.
5. Deleting Your Account and Data
You can delete your account in two ways:
- In the app: use the delete-account option in your account settings (open your account or profile settings and choose Delete Account). If you do not see the option, your app version does not include it yet — use the request path below.
- By request: email hello@storefrontworks.com from the email address on your account, or follow the instructions at https://www.storefrontworks.com/legal/account-deletion.html.
When your account is deleted, we delete your user record, your favorites, your feedback submissions, and your business memberships; we revoke your sign-in sessions and refresh tokens; and we deactivate any API keys tied to your account. Some billing records may be retained where the law requires it, for example tax records held by us or by Stripe.
Full step-by-step instructions, verification details, and timing are at https://www.storefrontworks.com/legal/account-deletion.html.
6. Your Rights and Choices
Anyone can:
- Review and update account and business information in the apps
- Delete their account and data as described in Section 5
- Control location access through device settings (Places works without it)
- Simply not use the optional AI assistant; no chat content is sent to Anthropic unless you use the feature
California residents. Under the California Consumer Privacy Act (CCPA/CPRA), you have the right to know what personal information we collect, to access it, to correct it, to delete it, and to opt out of the sale or sharing of personal information. We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done either in the preceding 12 months. We do not use or disclose sensitive personal information for purposes that would require a right to limit. To exercise your rights, email hello@storefrontworks.com; we will verify your request using the email address on your account (for accounts created with a phone number or third-party sign-in, by confirming control of that sign-in method). You may use an authorized agent, and we will never discriminate against you for exercising your rights. The categories of personal information we collect are described in Section 1: identifiers and contact information, commercial information (subscription and payment history), geolocation (Places, with permission), and user content.
Residents of the European Economic Area and the United Kingdom. We process your information on these legal bases: performance of our contract with you (providing accounts and app features), our legitimate interests (securing and operating the service), and your consent (device location access and the optional AI assistant), which you can withdraw at any time. You have the right to access, correct, delete, restrict, or object to our processing of your information, the right to data portability, and the right to lodge a complaint with your local supervisory authority. Our services are operated from the United States and your information is processed and stored there.
To exercise any of these rights, email hello@storefrontworks.com. We respond to all requests within the timelines required by applicable law.
7. Security
We protect your information with encryption in transit between our apps and our servers, and between your signs and our servers, along with access controls on our systems. Sign-in sessions are managed server-side so we can revoke them if needed. No online service can guarantee perfect security, so if you have a security concern, contact us at hello@storefrontworks.com.
8. Children
Storefront Business Manager is built for business owners and their staff. It is not directed to children, and you must be old enough to enter a binding contract on behalf of a business (18 in most U.S. states) to create a business account.
Places is a general-audience app for discovering local businesses. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us at hello@storefrontworks.com and we will delete it.
9. Changes to This Policy
If we change this policy, we will post the updated version at https://www.storefrontworks.com/legal/privacy-policy.html with a new effective date. For material changes, we will also notify you in the app or by email before the change takes effect.
10. Contact Us
Storefront Labs, LLC
1642 Burgos Dr
Sarasota, FL 34238