Privacy, in plain language.

What this page covers

This page covers this website (storerounds.com), the waitlist, and the StoreRounds product: the read-only connector, the briefing service, and the phone capture feature. It is the formal companion to the Trust and Security page, which explains the technical model in depth.

One status line, stated plainly: StoreRounds today is a working product prototype, and production connectors are being proven with the founding cohort. The commitments below are the rules that product is built to, not a description of a mature enterprise stack.

What this website collects today

The landing page makes no external requests except the form you choose to submit. There are no advertising pixels and no third-party analytics scripts on it.

• The waitlist form collects your email address, an optional store-count band, and, if you arrived from an ad, the campaign tags on the link you clicked. That is all.
• Waitlist data is stored with our email service provider (Kit) and used for one purpose: the waitlist emails we said we would send. No spam, ever, and you can unsubscribe with one click in any email.

The data the product handles, and the data it deliberately does not

The capture path is the sensitive one and we say so at full volume: photographed slips carry bank and personal details, the exact class of data the connector never touches. Captures are attributed by login, never by face or fingerprint, and are held to stricter handling than the connector's totals. The capture section of the Security page spells out the rules.

How we use data, and the promises that bind that use

• We use your data to run, secure, and support the service, and to build your own Chain Memory, walled to your account.
• Never sold. We do not sell or share your data as those terms are used under privacy law, and we do not give it to data brokers, advertisers, or your competitors. Our business is the subscription.
• Never trains a shared model without consent. Your data is not folded into any model shared with other customers unless your owner opts in, in writing, to the named StoreRounds Index program. Off is the default. Withdrawing consent stops all future inclusion, though it cannot un-compute a benchmark already published.
• Where we ever publish aggregated figures, we use the words "aggregated and de-identified," not "anonymized," unless the legal de-identification standard is actually met.

Your rights and controls

• You own your data. Export it and delete it yourself, from Settings, then Data, without asking us. When you delete, we remove it from our side on a stated timeline, not held quietly in a backup forever.
• You can revoke access yourself, in seconds, by dropping the read-only database credential or removing the connector. No support ticket required.
• State privacy rights. Depending on your state (California and a growing list of others), you may have rights of access, deletion, correction, and opt-out. Write to us and we will honor them; the counsel-reviewed policy will spell out the formal process, including California's coverage of workforce data.
• Waitlist: every email has a one-click unsubscribe, and you can ask us to delete your waitlist record entirely.

Security, retention, and breach

• TLS in transit, encryption at rest, read-only least-privilege database access, credentials in the machine's protected store, per-user least-privilege roles inside the product.
• Each data type is kept only as long as the service needs it or the law requires. Capture images are retention-limited to the reconciliation window, not kept forever.
• If a security incident affects your data, we will notify you without undue delay, consistent with applicable breach-notification law. Captured bank and routing numbers are treated as the highest-sensitivity trigger in that plan.

The full technical model, including what you can audit yourself, is on the Trust and Security page.

Subprocessors

We use a small number of vendors to run the service: cloud hosting and storage, error and uptime monitoring, transactional email, and payment processing. The full named list, with what each vendor does and what data it can touch, is published before any customer connects a store, and we give notice before adding a subprocessor that can touch customer data.

Today, the one vendor touching website data is Kit, which stores waitlist emails.

Contact

Questions about privacy, or a rights request: [email protected]. It reaches the founder.