Privacy Policy
Last Updated: September 16, 2026 Effective Date: September 16, 2026
1. Who We Are
Retail Front ("Retail Front," "we," "us," or "our") is operated by Chen Hao, a sole trader registered in Portugal (NIF: 253240956), with its principal place of business at:
Avenida Serpa Pinto 756, H-74 4450-279 Matosinhos Portugal
Contact:
- Support: support@retail-front.store
- Privacy: privacy@retail-front.store
- Legal: legal@retail-front.store
We operate the website https://retail-front.store (the "Service"). We are the data controller for personal information collected through the Service.
2. Information We Collect
2.1 Information You Give Us Directly
Account Data:
- Name
- Email address
- Password (hashed with bcrypt)
- Age
- Gender
Business Data:
- Store name and address
- Business type
- Design goal
- Best-selling item name and description
- Social media handle
- Customer insights (ideal customer, competitors, foot traffic, conversion rate)
- Budget and timeline preferences
Photos:
- Storefront photos
- Best-seller photos
Questionnaire Data:
- Answers to onboarding steps 7 through 9
Payment Data:
- Handled by PayPal. We receive a transaction ID, amount, and status. We do not store your full card number.
2.2 Information Collected Automatically
- IP address
- Browser type and version
- Device type and operating system
- Pages viewed, time on page, referring URL
- Cookies and similar technologies (see Cookie Policy)
2.3 Information From Third Parties
- Google Places API: When you type your store address, Google returns business name, business type, and related place data.
- PayPal: Payment confirmation and fraud signals.
- Vercel: Hosting logs and Blob storage metadata.
3. How We Use Your Information
| Purpose | Legal Basis |
|---|---|
| Create and manage your account | Contract |
| Generate your Free Audit and Premium Report using Google Gemini AI | Contract |
| Process payments via PayPal | Contract |
| Send transactional emails (receipts, report delivery) | Contract |
| Send abandoned-checkout reminder emails | Legitimate interest |
| Improve the Service | Legitimate interest |
| Comply with legal obligations | Legal obligation |
| Marketing emails (only with your consent) | Consent |
We do NOT sell your personal information for money.
4. AI Processing Disclosure
We use Google Gemini (a generative AI service) to analyze your storefront photo and questionnaire answers and produce your audit and report.
- Your photo, business data, and questionnaire answers are sent to Google's Gemini API.
- We use the paid Gemini tier, which does not use your data to train Google's foundation models.
- AI outputs may be inaccurate, incomplete, or biased. They are not professional architectural, legal, financial, or safety advice. See our Terms of Service for the full AI disclaimer.
- We retain AI inputs and outputs to deliver your report and for customer support.
5. How We Share Information
| Recipient | Purpose | Category |
|---|---|---|
| PayPal | Payment processing | Service provider |
| Google (Gemini, Places API) | AI analysis, address enrichment | Service provider |
| Vercel (Blob, hosting) | Photo storage, site hosting | Service provider |
| Neon | PostgreSQL database hosting | Service provider |
| Resend | Transactional email delivery | Service provider |
| Law enforcement | When legally required | Legal |
We do not share your data with advertisers.
6. Data Retention
| Data | Retention Period |
|---|---|
| Account data | Until account deletion, then 30 days |
| Photos | Until deletion or account closure, then 30 days |
| Reports | 24 months after purchase, or until account deletion |
| Payment records | 7 years (tax and legal requirement) |
| Server logs | 90 days |
| Marketing consent records | Until withdrawn, plus 3 years |
7. Your Privacy Rights
7.1 California Residents (CCPA/CPRA)
You have the right to:
- Know what personal information we collect, use, and share
- Delete your personal information
- Correct inaccurate personal information
- Opt out of the "sale" or "sharing" of personal information
- Limit use of sensitive personal information
- Non-discrimination for exercising your rights
7.2 Other US State Residents
Residents of Colorado, Connecticut, Virginia, and Utah have similar rights under their state laws.
7.3 EU/EEA Residents (GDPR)
You have the right to access, rectify, erase, restrict processing, data portability, and object to processing. You also have the right to lodge a complaint with your local supervisory authority (in Portugal: CNPD).
7.4 How to Exercise Your Rights
Email privacy@retail-front.store with your request. We will respond within 45 days (extendable by 45 days for complex requests).
Authorized agents: You may designate an agent to submit requests on your behalf with written permission.
Appeals: If we deny your request, you may appeal by replying to our decision email. We will respond within 45 days.
8. Do Not Sell or Share My Personal Information
We do not sell personal information for money. If we deploy analytics or advertising cookies that constitute "sharing" under CPRA, you can opt out via:
- The "Do Not Sell or Share My Personal Information" link in our footer
- The Global Privacy Control (GPC) signal — we honor GPC
- Email privacy@retail-front.store
9. Children's Privacy
The Service is not directed to children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact privacy@retail-front.store and we will delete it.
10. Security
We use:
- HTTPS/TLS for all traffic
- Password hashing (bcrypt)
- SHA-256 hashing for password-reset tokens
- Access controls on our database
- Vercel's encrypted Blob storage
No system is 100% secure. If we suffer a breach affecting your rights, we will notify you as required by applicable law.
11. International Data Transfers
We are based in Portugal. If you access the Service from outside the EU, your data will be transferred to and processed in Portugal and the United States (via our service providers: Vercel, Google, Neon, Resend).
For EU-to-US transfers, we rely on Standard Contractual Clauses with our service providers.
12. Changes to This Policy
We will post changes here and update the "Last Updated" date. Material changes will be announced by email or in-app notice at least 14 days before they take effect.
13. Contact
Chen Hao Avenida Serpa Pinto 756, H-74 4450-279 Matosinhos, Portugal Email: privacy@retail-front.store