Customer privacy

Open Settings › Customer privacy.

Cookie banner

Every store asks its visitors about cookies, in categories. Accept and Decline stay equally easy, and Choose opens the categories, with nothing ticked:

• Necessary: always on. The cart, the checkout and signing in need these.
• Analytics: your store’s own cookie, which remembers a visitor who agrees for 30 days, so that Growth › Attribution can show which links and ads lead to orders and the path to each purchase. Nothing is passed to anyone else. Every store asks about it.
• Marketing: asked while Meta or a pixel measures visitors (Settings › Customer events), and the banner names them. Only visitors who allow Marketing are measured by them.

Visitors in the United States are not asked first: the usual rule there is that a store may measure until a shopper says no. Your store remembers them and measures them with your pixels from their first page, and Cookie settings shows both categories ticked, On until you turn it off, so they can turn either off at any time. A browser that sends Global Privacy Control is asked first, as everywhere else. Where a visitor is comes from their connection, not from the country they choose for delivery; a visitor who travels is asked first wherever the rule is to ask. In the European Union and everywhere else, nothing changes: your pixels measure only visitors who allow Marketing.

A visitor is asked again when the banner asks about something they were never asked: visitors who accepted before the banner had categories are asked once about Analytics. A visitor who declined is not asked again for six months. Cookie settings, linked from your store’s footer, lets them change their choice at any time; taking Analytics back forgets the visits your store kept with it.

You choose where it sits and how it looks: Place (bottom in the centre, left, right or the full width, or the middle of the page) and Look (light, dark, or automatic, which follows the visitor’s device). Title, Text and the words of the Accept, Decline, Choose and Save buttons can be your own, in your store’s main language; leave them empty for Storeloom’s words. Write {services} in your text to name who measures. The categories' own descriptions are always Storeloom’s, so a shopper is told what each one does. Other languages use the translated words. The picture beside the form shows how it sits.

Cookies your store sets

Your previews and test orders use a few more, only in your own browser. Use this list when you write your privacy policy.

Do not sell or share page

A page where shoppers ask your store not to sell or share their personal information, with a link to it, Do not sell or share my personal information, on every page of your store. It is off until you tick Show the page and its link on your store and choose Apply in the bar at the top. While it is off there is no page and no link, and nothing is stopped.

While it is on:

• A shopper who asks on the page, or whose browser sends Global Privacy Control (a setting some browsers have, in any country), is no longer passed to advertising and measurement services: your Meta pixel, Google Analytics, TikTok, Pinterest, Snapchat, Microsoft Advertising, Reddit and custom pixels get nothing about them, and neither do Klaviyo’s browsing events (viewed product, added to cart, started checkout). Your store’s own browse and price-drop reminders leave them out too. Their cookie banner no longer offers Marketing.
• Their request is kept on their browser for 13 months, and on their account when they are signed in, so it applies wherever they sign in. An order they place marks them as a customer, so a later order with their email sends nothing to your pixels either, from any browser.
• Your email lists (Klaviyo, Mailchimp, Omnisend) and review invitations go on as before: a shopper’s unsubscribe controls those. Your store’s own visit counts and Attribution are not shared with anyone and are not affected.
• The card says what an opt-out stops in your store now and how many customers asked, and Open the page shows it. On a customer’s page, Selling and sharing records a request that reached you by email or phone.

If you sell to the United States. State privacy laws there, such as California’s, expect a store that shares shoppers' data for advertising to offer this page. While it is off, the card says so, and a market whose countries include the United States shows it as something worth a look before launch (it never blocks a launch). The page’s words are Storeloom’s, translated into every language your store speaks; they are not legal advice.

Age checks

For a store that sells what the law keeps from young people, such as alcohol, tobacco and vaping products, weapons where you hold the licence, or adult content. Everything here is saved with Apply in the bar at the top.

• Minimum age is your store’s one age, 18 to start with (from 12 to 25). Shoppers confirm it at checkout for products marked age-restricted, and visitors on the age page. If one product needs a higher age than another, set the higher one.
• Ask every visitor their age before they see your store shows a page of its own before any page of your store, with your heading and text (left empty, Storeloom’s words in each of your store’s languages, which the fields show in grey), Yes, I am 18 or older and No. A visitor answers once: their browser remembers a yes for 30 days (the sl_age cookie, a necessary one), and asks again if you raise the age. No says your store is only for people of that age and keeps nothing. Your theme cannot hide the page, and it needs no script. Search engines still read your pages, so your store stays in search results; the age page itself is never listed. Links in your emails to an order, a gift card or an invoice, and the withdrawal and “Do not sell or share” pages, open without it.
• Products marked age-restricted says how many you have. Mark a product with Age-restricted on its page, in Bulk edit, or with the Age Restricted column (TRUE or FALSE) of the product CSV. While a cart holds one, checkout asks the shopper to tick I confirm that I am 18 or older. before the order button; without the tick nothing is ordered, and the order’s page keeps the answer (see Orders). Apple Pay and Google Pay are not offered for such a product, because their sheet cannot ask.

What Storeloom does not do. Storeloom checks nobody’s identity: visitors and shoppers confirm their age themselves, and the card says so. Where the law asks for real age verification, such as an identity check online or on delivery (some countries do for alcohol, tobacco, vaping products or weapons), you must arrange it yourself, for example with your courier’s age check on delivery. Which products need an age, and which age, is yours to know.

The store assistant and AI connections can read these settings and see which products are marked, but only people change them.

Privacy policy

Shows Published when your privacy policy is written, else Missing. Write or edit it in Settings › Policies; the cookie banner links to it.

Marketing

Tick Double opt-in for marketing and choose Apply in the bar at the top (it says Unsaved changes while something is not saved) to ask shoppers to confirm their subscription. A shopper who subscribes with your signup form, or ticks the marketing box at checkout, then gets the Marketing confirmation email. They are subscribed only once they open its link and press Confirm subscription on your store. The link works for 7 days; opening it alone confirms nothing.

While it is on, the page says how many customers wait to confirm, and their page in Customers shows waiting for them to confirm by email. Turning it off subscribes shoppers at once again; those still waiting stay unsubscribed until they confirm.

Someone who unsubscribed and later ticks the marketing box at checkout is always asked to confirm by email first, whether double opt-in is on or not: anyone can type an address at checkout. Once they confirm, they are subscribed again, with the time and that it came from checkout; if they unsubscribe again later, that wins. Every email that is not about an order (campaigns, Autopilot, automations, reminders, review requests and the lists you sync) follows the same rule.

Texts about an order (see Text messages) are not marketing: whoever gives a phone number with an order gets the texts you switched on, the checkout says so by the phone field, and every text carries a way to stop. Say in your privacy policy that phone numbers are used to text updates about orders. A reply of STOP to one of them also withdraws that number’s consent to marketing texts.

Data requests

When a customer asks for a copy of their data, or to be forgotten, open them in Customers. Their page prepares the copy or erases them, and tells the apps that hold their data. The copy lists the texts about their orders; erasing them takes their number off the list of numbers that replied STOP.

Data storage location

Your store’s data is kept in the European Union.