Skip to main content
Create your locator

Legal

Privacy Policy

This Privacy Policy explains how StoreRocket collects, uses, shares, and protects personal information when you visit our website, use our dashboard, install our widgets, interact with a StoreRocket-powered locator, or contact us.

Last updated: November 11, 2026

1. Who we are

StoreRocket Ltd ("StoreRocket", "we", "us", or "our") provides a hosted store locator platform for businesses. Questions about this Privacy Policy or your personal information can be sent to [email protected].

2. When this policy applies

This policy applies to personal information we collect through storerocket.io, the StoreRocket dashboard, embedded locator widgets, APIs, lead forms, analytics, support channels, and related services. It does not apply to websites, stores, apps, map providers, payment processors, or integrations we do not control.

Our customers are responsible for the location data, lead forms, tracking choices, privacy notices, and consent mechanisms they configure on their own websites and StoreRocket-powered experiences. If you are an end user interacting with a locator on a customer's website, that customer may also process your information under its own privacy policy.

3. Information we collect

  • Account information: name, email address, company, password, team membership, role, preferences, and login activity.
  • Billing information: plan, subscription status, billing email, invoices, payment status, tax-related details, and payment metadata from Stripe or Shopify. We do not store full credit card numbers.
  • Customer content: location names, addresses, coordinates, opening hours, phone numbers, websites, images, custom fields, filters, markers, imports, exports, sync configuration, and other data customers upload or configure.
  • Locator interaction data: widget loads, searches, approximate search areas, location-result clicks, referring pages, timestamps, and sampled browser performance information.
  • Location and geolocation data: addresses or places entered into search boxes, search coordinates, and browser geolocation only when an end user grants permission in their browser.
  • Lead form data: information submitted through customer-configured forms, such as name, email address, phone number, message, page URL, and search context.
  • Support and communications: messages you send us, support conversations, product feedback, survey responses, and related contact details.
  • Technical data: IP address, user agent, session identifiers, logs, error reports, authentication events, API usage, webhook activity, and security signals.
  • Integration data: data you authorize us to access, import, sync, or export through connected services such as spreadsheets, ecommerce platforms, APIs, or map/geocoding providers.

4. How we use information

  • Provide, operate, secure, maintain, and improve StoreRocket.
  • Create accounts, authenticate users, manage teams, and enforce permissions.
  • Display customer locations through widgets, APIs, and integrations.
  • Geocode addresses, calculate distances, power search/autocomplete, show maps, and provide directions links.
  • Process imports, exports, Google Sheets syncs, API requests, and other customer-directed workflows.
  • Capture, notify, export, and review leads where customers enable lead forms.
  • Generate analytics, reports, heatmaps, usage metrics, diagnostics, and product insights.
  • Process payments, manage subscriptions, prevent fraud, handle invoices, and comply with accounting or tax obligations.
  • Provide support, respond to requests, send service notices, and communicate about product updates.
  • Detect abuse, debug errors, monitor performance, protect accounts, and enforce our Terms.
  • Comply with legal obligations and protect the rights, safety, and security of StoreRocket, customers, end users, and others.

5. Legal bases for processing

Where UK or European data protection law applies, we process personal information based on one or more legal bases: performance of a contract, legitimate interests, consent, legal obligations, and, where necessary, to establish or defend legal claims. For customer-controlled locator data, lead data, and end-user interaction data, StoreRocket often acts as a service provider or processor on behalf of the customer.

6. Cookies and similar technologies

We use cookies, local storage, and similar technologies to keep you signed in, secure the Service, remember preferences such as theme, understand website traffic, attribute signups, improve product performance, and support embedded widget analytics. Some cookies are essential for the Service to work. Others, such as marketing or analytics tools on our public website, help us understand how people find and use StoreRocket.

Browser settings may let you block or delete cookies. Some StoreRocket features may not work correctly if essential cookies or storage are disabled.

7. How we share information

We do not sell personal information. We share information only where needed to provide, secure, support, or improve the Service, or where required by law.

  • Service providers: companies that provide hosting, infrastructure, payment processing, email delivery, customer support, analytics, error monitoring, file storage, security, and similar services.
  • Map and geocoding providers: providers such as Google Maps or Mapbox may receive addresses, coordinates, search queries, IP addresses, device information, or map interaction data when needed to provide maps, autocomplete, geocoding, and directions.
  • Customer-directed integrations: when a customer connects Google Sheets, Shopify, an API, or another integration, we share or receive data as directed by that customer.
  • Customer accounts: information submitted through a customer's locator, such as lead form submissions and locator analytics, may be visible to that customer and its authorized team members.
  • Legal and safety: we may disclose information if required by law, legal process, fraud prevention, security investigation, or protection of rights, property, or safety.
  • Business transfers: information may be transferred as part of a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality protections.

8. International transfers

StoreRocket and our service providers may process information in countries other than where you live. Where required, we use appropriate safeguards for international transfers, such as contractual protections or other mechanisms recognized by applicable data protection laws.

9. Data retention

We keep personal information for as long as needed to provide the Service, maintain business records, comply with legal obligations, resolve disputes, enforce agreements, prevent abuse, and maintain backups. Retention periods vary depending on the type of data, account status, customer settings, legal requirements, and operational needs.

Customers should export any data they need before deleting a project or cancelling an account. Deleted data may remain in backups for a limited period before being overwritten or purged.

10. AI assistants you connect

You can connect an AI assistant, such as Claude or ChatGPT, to your StoreRocket account through our connector at storerocket.io/mcp. You sign in with your StoreRocket login. Nothing connects unless you choose to connect it.

  • What the assistant can see: when you ask it, or approve a request, we return data from your account: locations (names, addresses, hours, categories, custom fields, and buttons), filters, your install code, and locator analytics (views, searches, clicks, leads, top searches, and searches with no results). It cannot see billing details or change your plan, password, or team.
  • Who receives it: the AI provider you connected, such as Anthropic or OpenAI, receives the data we return to it. That provider handles it under its own terms and privacy policy.
  • What we record: the name, time, and outcome of each request, which assistant made it, how many locations it read or changed, and which fields or filters it used, never what they contain. We use this to run and secure the service, show you your connected assistants, and improve StoreRocket. We never receive or store your conversation with the assistant.
  • How long access lasts: access passes last 1 hour and renew automatically for up to 90 days of use.
  • Your controls: you can disconnect any assistant at any time from the AI assistants page in your dashboard (Integrations, then AI assistants). Resetting your password also disconnects every assistant.
  • Retention: we keep this information for the same periods as the rest of your account data, as described in section 9, Data retention.

11. Security

We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. No internet service is perfectly secure, so we cannot guarantee absolute security. You are responsible for using strong passwords, protecting API keys, limiting team access, and keeping your connected services secure.

12. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to the processing of your personal information, and to withdraw consent where processing is based on consent. You can update much of your account information directly in StoreRocket. You can also contact us at [email protected].

If your information was submitted to a StoreRocket-powered locator operated by one of our customers, we may direct your request to that customer or help the customer respond, depending on the nature of the request and our role.

We respond to rights requests as required by applicable law. If you are in the UK, the European Economic Area, or another region with a data protection authority, you also have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concerns directly first, so please consider contacting us before you do.

13. Marketing communications

We may send product, onboarding, educational, or marketing emails to customers and people who ask to hear from us. You can opt out of marketing emails using the unsubscribe link or by contacting us. We may still send transactional or service messages, such as billing, security, account, or important product notices.

14. Children

StoreRocket is not directed to children and should not be used by anyone under 16. We do not knowingly collect personal information from children.

15. Changes to this policy

We may update this Privacy Policy from time to time to reflect product, legal, or operational changes. If changes are material, we will take reasonable steps to notify customers, such as posting the updated policy on our website or sending an email.

16. Contact

Questions, requests, or concerns about privacy can be sent to [email protected].