Privacy policy

DistroBay (“we”, “us”, “our”) provides product listing tools for makers and small stores, with an early focus on Australian sellers. This policy explains what personal information we collect on the DistroBay website (www.distrobay.com), through the waitlist, and in the DistroBay product application (the “App”), including when you connect a store such as Shopify.

For most personal information about you (the seller), DistroBay is the data controller. For personal information about your own customers that we receive from a store you connect (for example, order or customer details from Shopify), you are the controller and DistroBay acts as your processor / service provider, handling that data only on your instructions and as described below.

Who we are

DistroBay is operated for the DistroBay product at www.distrobay.com, founded in Sydney, Australia by Ben Radcliffe. For privacy questions, data access, or deletion requests, contact our privacy contact at privacy@distrobay.com. General enquiries: hello@distrobay.com.

What we collect

• Waitlist: email address, optional source page, referrer, UTM parameters, and a timestamp when you join.
• App accounts: name, email, and profile details from Firebase Authentication (for example Google Sign-In or email and password), plus workspace and role information.
• Workspace content: listings, product photos you upload, product titles, descriptions, prices, and settings you configure.
• Connected store data: when you connect a store, we access data through that store’s APIs to perform the actions you ask for. For Shopify this can include shop and account details, product and inventory data, and — only where required for a feature you use — limited order or customer information. We request the minimum access scopes needed and only process this data to provide the App.
• Connection metadata: store domain, access tokens (stored encrypted), and sync status for stores you connect.
• Technical data: IP address, user agent, device/browser data, and basic usage logs needed to run and secure the service.
• Analytics and cookies (when enabled): aggregated page and event data via Google Analytics 4. See Cookies and tracking.

How we use information

• To operate the waitlist and send access invitations.
• To provide the App — generate listing drafts, enhance and store images, and push drafts to the stores you connect.
• To sync catalog data you request between connected stores and your DistroBay workspace.
• To improve the product, prevent abuse, and secure accounts and APIs.
• To meet legal, tax, and compliance obligations.
• To communicate about access, product updates, and (with consent where required) marketing.

Shopify and connected store data

When you install or connect DistroBay to a Shopify store, our access to your store data is governed by the permissions (scopes) you approve and by Shopify’s API terms and Protected Customer Data requirements. We commit to:

• Minimum necessary access. We request only the scopes needed for the features you use and avoid customer or order data unless a feature you enable requires it.
• Use limited to the service. We use connected store data only to provide and operate DistroBay for you — not to build unrelated profiles, and never to sell it.
• Encryption. Store access tokens are encrypted at rest, and all data is transmitted over TLS/HTTPS.
• Retention limits. We retain connected store data only as long as needed to provide the App or as required by law, and delete or anonymise it after that.

DistroBay supports Shopify’s mandatory data-protection webhooks. If a store owner or their customer makes a request, we respond to:

• customers/data_request — provide a copy of the stored data we hold about a customer of a connected store.
• customers/redact — delete stored personal data about a specific customer of a connected store.
• shop/redact — delete store and related data after a store uninstalls DistroBay (typically processed within 48 hours of the request, and no later than Shopify’s required window).

You can disconnect a store at any time from the App’s integrations settings, or by uninstalling DistroBay from your store admin. Uninstalling revokes our access and triggers deletion of the associated store data.

Cookies and tracking

The website uses essential cookies/local storage to run core features, and — when enabled — Google Analytics 4 for aggregated, privacy-conscious usage measurement. You can control cookies through your browser settings; blocking some cookies may affect site functionality. The App uses cookies/tokens strictly necessary for authentication and security.

Sharing and subprocessors

We do not sell your personal information. We share data only with service providers (subprocessors) that help us run DistroBay, and with the stores and APIs you choose to connect:

• Google Cloud / Firebase — hosting, authentication, database (Firestore), storage, and Cloud Functions.
• Google Gemini (Google AI) — generating listing text and enhancing product images from the content you submit.
• Resend — transactional and invitation emails.
• Connected commerce platforms (for example Shopify, and later Etsy and eBay) — to read and write listings and perform actions you request.
• Google Analytics 4 — aggregated website analytics, when enabled.

We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, and security of DistroBay, our users, and the public.

International transfers

DistroBay Cloud Functions are deployed in Australia (australia-southeast1). Some subprocessors (for example Google and Resend) may process data in other regions under their own terms and safeguards, including standard contractual clauses where applicable.

Retention

Waitlist emails are kept until you ask to be removed or we wind down the list. Account and workspace data is kept while your account is active and deleted or anonymised within a reasonable period after a deletion request, subject to legal retention needs. Connected store data is deleted after you disconnect or uninstall, as described in Shopify and connected store data.

Security

We protect information with TLS/HTTPS in transit, encryption of sensitive credentials at rest, scoped access controls keyed to your workspace, and infrastructure provided by Google Cloud / Firebase. No method of transmission or storage is completely secure, but we work to protect your information and review our practices as the product grows.

Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth). Where the EU/UK GDPR applies, our legal bases are consent, performance of a contract, legitimate interests, and legal obligations. Where US state laws (such as the CCPA) apply, we do not sell or “share” personal information for cross-context behavioural advertising.

• Request access, correction, or deletion via privacy@distrobay.com. We aim to respond within the timeframes required by applicable law.
• Unsubscribe from marketing emails using the link in those emails.
• Disconnect store connections inside the App at any time.
• If you are unsatisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) or your local data protection authority.

Merchant responsibilities

If you connect a store and process your own customers’ personal information through DistroBay, you are responsible for having a lawful basis and appropriate notices/consents in place with those customers, and for handling their rights requests. We will help you respond to such requests, including via Shopify’s data-request and redaction webhooks.

Children

DistroBay is aimed at business sellers. We do not knowingly collect information from children under 16. If you believe a child has provided us personal information, contact privacy@distrobay.com and we will delete it.

Changes

We may update this policy as the product evolves. Material changes will be noted by updating the date above and, where appropriate, notifying waitlist or account holders.