Privacy

What data we collect

Why we collect this data

• Service delivery: account creation, processing purchases, providing access to products
• Security: fraud prevention and account protection
• Platform improvement: usage analysis and bug fixes
• Personalisation: relevant product recommendations
• Communication: notifications, support, and important updates
• Legal compliance: tax reporting and regulatory requirements

Profile visibility

Control who can see your profile in My Account → Privacy.

1. Public (default) — visible to everyone, indexed by search engines. Your products are visible to all visitors.
2. Members only — visible only to logged-in shookout users, not indexed by Google.
3. Private — visible only to you. Products are hidden from other users.

Your data rights

You have the following rights over your personal data at any time:

• Access: request a copy of all data we hold about you
• Correction: update or fix inaccurate information
• Deletion: request complete removal of your data ("right to be forgotten")
• Portability: receive your data in a machine-readable format
• Restriction: temporarily limit how we process your data
• Objection: opt out of processing for marketing or profiling purposes

Exporting your data

1. Go to My Account → My Data
2. Click Request archive
3. Select what to include: profile, purchase history, sales history, comments, favourites, messages
4. Click Create archive
5. A download link will be sent to your email within 24–48 hours. The link is valid for 7 days.
6. The archive is delivered in JSON and CSV formats

Updating your personal data

• Display name: My Account → Overview
• Email address: My Account → Overview (requires confirmation)
• Password: My Account → Password & 2FA
• Profile photo, About Me, location: My Account → Profile

Deleting your account

Account deletion permanently removes all your data. The process takes 30 days. Financial transaction records are retained for 7 years as required by law. See Account Deletion for full details.

Purchase privacy

Your purchases are private by default. Other users cannot see what you have bought. Your download library is visible only to you.

The only exception: reviews you post on products include your name and profile photo and are visible to everyone. You can post a review anonymously by selecting Publish anonymously when writing it — it will appear as "Anonymous buyer". The seller can still see your name in order to reply.

What sellers see about buyers

Visible to the seller:

• Buyer display name
• Email address (for product delivery)
• Products purchased and order amount

Not visible to the seller:

• Full payment card details
• Purchase history from other sellers
• Any personal profile information beyond the above

Privacy for sellers

As a seller you handle buyer data as part of order processing. You are required to:

• Use buyer data only for the order — do not add buyers to mailing lists without explicit consent
• Not share buyer data with third parties
• Not publish buyer names or order details

What is visible on your seller profile

Private (visible only to you): exact earnings, number of sales, buyer list, detailed analytics.

Public (visible to everyone): product rating, number of reviews, average rating, and an approximate sales count (e.g. "1000+").

Cookies

shookout uses four categories of cookies:

• Essential — required for the site to function (login session, cart). Cannot be disabled.
• Functional — remember your settings and preferences.
• Analytics — anonymous usage statistics (e.g. Google Analytics).
• Advertising — personalised ad targeting.

On your first visit you can choose which optional categories to allow. You can change this at any time in My Account → Privacy → Cookies.

How we protect your data

• HTTPS encryption — all traffic is encrypted via SSL/TLS
• Password hashing — passwords are stored using bcrypt
• Database encryption — sensitive data is encrypted at rest
• Two-factor authentication — available for all accounts
• Access controls — minimum privilege access for employees
• Regular security audits — ongoing vulnerability scanning

If a data breach occurs

We will notify affected users by email within 72 hours. The notification will explain which data was affected, how many users were impacted, and what steps we are taking.

What you should do immediately:

1. Change your password
2. Enable 2FA if not already active
3. Review your account activity in My Account → Devices
4. Change passwords on other services if you reused the same password

Checking for suspicious activity

Signs that your account may be compromised: logins from unknown devices, purchases you did not make, profile changes you did not make, or messages you did not send.

1. Go to My Account → Devices
2. Review the list of active sessions
3. End any sessions you do not recognise
4. Change your password immediately

Your legal rights

GDPR (European Union)

If you are located in the EU, you have all rights listed in the Privacy Policy including the right to access, correction, deletion, portability, restriction, objection, and the right to lodge a complaint with your national supervisory authority.

CCPA (California, USA)

California residents have the right to know what data is collected and why, request deletion of personal data, opt out of the sale of data (we do not sell data), and receive equal service regardless of whether they exercise these rights.

Frequently Asked Questions

Do you sell my data?

No. We never sell personal data to third parties.

Who has access to my data?

Only authorised shookout employees with the minimum access required for their role.

How long do you store my data?

While your account is active. After account deletion — 30 days (recovery window), then permanent deletion. Financial transaction records are kept for 7 years as required by law.

Can I hide my profile from search engines?

Yes — set your profile visibility to Members only or Private in My Account → Privacy.

Do sellers see my payment details?

No. Sellers see only your display name, email, and what you purchased. Payment processing is handled by Stripe — your card details are never shared with sellers.

Can I use shookout anonymously?

Registration requires an email address, but you can use a pseudonym as your display name and set your profile to private.

What happens to my data after I delete my account?

All personal data is deleted within 30 days. Financial records are retained for 7 years as required by law.

What should I do if I discover a security issue?

Contact security@shookout.com immediately. We investigate every report.