Privacy Policy — ShopPolicy
Last updated: 30 July 2026
Who we are
ShopPolicy (shoppolicy.eu) is operated by Sašo Špacapan s.p., Tominčeva ulica 10, 5250 Solkan, Slovenia — the controller for the processing described here. Contact for all privacy matters: hello@shoppolicy.eu.
What we process, and where it lives
- Your shop answers (shop name, URL, country, contact email, product types, platforms, payment methods, carriers, return window, tools): used to generate your documents. They are stored in your own browser (localStorage) so your form stays filled — we keep no copy in any database, and you can remove them by clearing your browser data.
- Document generation: your answers are sent to Anthropic (our AI processor) to fill our document templates. Generated documents are returned to your browser and are not stored on our servers — they are regenerated on demand.
- Purchases:the sale is made on Stripe's hosted checkout, where Stripe is the merchant of record and the seller. We never see your card details. Stripe processes your payment data under its own privacy policy as an independent controller — not on our behalf — and sends your receipt and any tax invoice directly. From Stripe we receive only your email address and a transaction reference, which we use to issue your unlock and send your unlock email (via Resend).
- Free-tier limits: we process your email address and IP address transiently to enforce the one-free-document limit and protect the service from abuse.
- Hosting logs: our hosting provider (Vercel) keeps short-lived technical request logs.
- Aggregate audience measurement: we use Vercel Web Analytics to count page views and see which pages and referrers bring people here. It sets no cookies and builds no profile of you: visitors are counted via a short-lived hash of the incoming request that is discarded after 24 hours. What is recorded is the page URL, referrer, approximate location from IP (country and region — the IP itself is not stored), and device, browser and operating-system type. We cannot identify you or follow you across sites from this.
Legal bases
- Contract (Art. 6(1)(b) GDPR): generating your documents, processing your purchase, delivering your unlock email.
- Legitimate interests (Art. 6(1)(f) GDPR): abuse prevention and service security (rate limiting), and aggregate, cookieless audience measurement to understand how the site is used. No consent is sought for the latter because it sets no cookies and processes no data that identifies you.
- Legal obligations (Art. 6(1)(c) GDPR): tax and accounting records for purchases.
Processors and transfers
We use Anthropic (AI generation), Resend (email), and Vercel (hosting and aggregate audience measurement) as processors acting on our instructions. Stripe is not our processor: as merchant of record it is the seller and an independent controller for your payment data, which it processes under its own privacy policy. Some of these companies are established outside the EEA (United States); where personal data is transferred, we rely on adequacy decisions (including the EU–US Data Privacy Framework where applicable) or Standard Contractual Clauses.
How long we keep data
- Shop answers: in your browser only, until you clear them.
- Generated documents: not stored by us.
- Purchase and receipt records: as long as statutory tax and accounting retention requires.
- Unlock authorizations expire 30 days after purchase.
- Audience measurement: the per-visit hash is discarded after 24 hours; only aggregate counts remain.
Cookies and local storage
We set no cookies at all — none for advertising, none for analytics, none for sessions. Our audience measurement is cookieless (see above), which is why this site shows you no cookie banner. We use your browser's local storage strictly to keep your answers and unlock state on your device; that stays on your device and is never sent to us as a tracking identifier.
Your rights
You have the GDPR rights of access, rectification, erasure, restriction, portability, and objection. Contact us at hello@shoppolicy.eu. You may also lodge a complaint with a supervisory authority — in Slovenia, the Information Commissioner (IP RS), or the authority of the EU country where you live or work.
ShopPolicy is a template-based document generator, not a law firm. Generated documents are informational and not legal advice.