Política de privacidad

• Account data: name, email address, password (stored only as a secure hash), and settings.
• Storefront data: the links, text, images, products, and files you publish.
• Lead and customer data you collect through the Service (for example, email addresses from your lead-capture form, or a buyer’s email for delivery of a purchase).
• Usage and analytics data: pages viewed, clicks, and basic device/browser information, used to operate and improve the Service and to give you storefront analytics.
• Communications: messages you send us, such as support requests.
• Blog sign-ups: if you leave your email on one of our blog checklists, we keep that email, the page and checklist you signed up on, your language, your approximate country, and the campaign that first brought you to our site, if any.
• Payment-connection data: the identifiers of the Stripe or MercadoPago account you connect in order to sell. For MercadoPago we also store the access and refresh tokens that authorize charges on your account, encrypted at rest — MercadoPago cannot accept a payment on your behalf without them. Stripe Connect Standard needs no such credential, so for Stripe we store none. We use them only to operate selling on your behalf: creating checkouts on your account, looking up the payments your customers make so we can record the order and deliver it, issuing the refunds you ask for, reconciling your own sales, checking with MercadoPago that your connection still works so we can show you whether your store can accept payments, and renewing the tokens themselves so your store keeps selling.

We do not collect or store full payment card details. Payments are handled by Stripe or by MercadoPago, depending on the market your store sells in. In both cases the payment details are entered on the processor’s own hosted checkout and never touch our servers.

• To provide, maintain, and secure the Service and your account.
• To process subscriptions and to enable your connected Stripe or MercadoPago account to accept payments.
• To provide analytics about your storefront’s performance.
• To send service and transactional messages (for example, receipts, download links, security notices).
• If you signed up on a blog checklist, to write to you occasionally about new guides. Reply to any of those emails to stop them.
• To detect, prevent, and respond to fraud, abuse, disputes, and violations of our terms.
• To comply with legal obligations.

Where the GDPR or similar laws apply, we process data on the bases of performance of a contract (providing the Service), our legitimate interests (securing and improving the Service, preventing abuse), your consent (where required, for example certain communications), and compliance with legal obligations.

We share the minimum data necessary with providers who help us run the Service, under contracts that require them to protect it:

• Stripe — subscription billing in US dollars and, for creators in that market, payment processing on their own connected Stripe account.
• MercadoPago — subscription billing in Argentine pesos and, for creators in that market, payment processing on their own connected MercadoPago account.
• Our email provider — to send transactional and service email.
• Our cloud storage and hosting providers — to store uploaded files and run the Service.
• Meta and TikTok — advertising measurement, through pixels that run on OUR marketing pages only. They receive that you visited one of our pages and whether you created an account, so we can tell which of our advertising works. They are not present on any creator's storefront.
• YouTube (Google) — only when a creator has added a video to their storefront AND a visitor presses play. Nothing is requested from YouTube before that: the thumbnail shown on the page is served from our own storage. Once playback starts, YouTube receives the visitor's IP address and browser details, as it would on any site embedding a video.

We do not sell your personal data. We self-host the fonts used on public storefronts, so viewing a storefront does not send requests to third-party font services, and the advertising pixels above never load there either. If your browser sends a Global Privacy Control or Do Not Track signal, we do not load them at all.

Our providers may process data in countries other than yours. Where required, such transfers are covered by appropriate safeguards such as Standard Contractual Clauses.

We keep personal data for as long as your account is active and as needed to provide the Service, then for any period required to meet legal, tax, accounting, or dispute-resolution obligations. Raw analytics events are retained for a limited period and then aggregated or deleted.

Depending on your location, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can exercise many of these directly in your account settings, or contact us at https://tuqui.store/contact. You may also lodge a complaint with your local data protection authority.

If you are a customer of a creator’s storefront and want to exercise rights over data that creator holds, contact the creator directly; we will assist them as their processor.

We use technical and organizational measures to protect personal data, including encryption in transit, hashed passwords, encryption at rest for the payment-provider credentials you connect, and access controls. No method of transmission or storage is completely secure, but we work to protect your information and to respond to incidents.

The Service is not directed to children under the age required to consent in your jurisdiction, and we do not knowingly collect their data.

We may update this Policy and will post the new effective date here. For privacy questions or requests, use the contact form at https://tuqui.store/contact.