Privacy policy
This policy explains what personal data InvictusMall collects when you use the platform, why, and what you can do about it.
1. What we collect
- Account details: your name, email address, phone number (if you add one) and a hashed password.
- Orders and bookings: what you bought or booked, from which store, delivery address, notes you add, and times.
- Payments: handled by Stripe. We receive the payment status from Stripe; we never see or store your card number.
- Technical data: IP address and device information in server logs, used for security and to prevent abuse.
2. How we use it
- To create and secure your account and sign you in.
- To process orders, bookings, payments, refunds and payouts to stores.
- To send service emails: confirmations, receipts, booking codes, refunds and password resets.
- To prevent fraud and abuse, and to meet legal and accounting obligations.
We do not sell your personal data and we do not use it for third-party advertising.
3. Who we share it with
- The stores you order from or book with: your name, contact details and order or booking details, so they can fulfil it.
- Service providers acting for us: payment processing (Stripe), email delivery, hosting and file storage.
- Authorities, when the law requires it.
4. Cookies and similar storage
We only use cookies and browser storage that are strictly necessary for the site to work. We don't use analytics or advertising cookies, so there is no cookie banner.
| Name | Purpose | Lasts |
|---|---|---|
| im_access | Keeps you signed in (HttpOnly; not readable by scripts). | 15 minutes |
| im_refresh | Renews your sign-in without asking for your password (HttpOnly). | 30 days |
| im_signed_in | Tells the page that a session exists, so it can show your account menu. Holds no personal data. | 30 days |
| im_locale | Remembers the language you chose. | 1 year |
| __stripe_mid, __stripe_sid | Set by Stripe on the checkout page to prevent payment fraud. | 1 year / 30 minutes |
| Session storage (checkout) | Remembers the order numbers of a checkout until the payment is confirmed. | Until the tab closes |
5. How long we keep it
We keep account data while your account is open. Order, payment and payout records are kept for as long as tax and accounting law requires (typically several years). In-app notifications are deleted automatically after a while.
6. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, and to object to or restrict some uses. You can update your name and phone in your profile at any time. For other requests, contact us at [privacy contact email]; we will reply within the time the law requires.
7. Security
Passwords are stored only as salted hashes, sensitive settings and bank details are encrypted, and all traffic uses HTTPS. No system is perfectly secure; tell us at once if you think your account has been compromised.
[Data controller identity, contact details, international transfer safeguards and any region-specific sections (e.g. GDPR, CCPA) to be completed by counsel.]