Shop Suit by Building Suit

Privacy Policy

This Privacy Policy explains how Shop Suit by Building Suit collects, uses, stores, and protects information when you use our website and software service.

Last updated: 15 October 2026

1. Information we collect

  • Account information, such as your name, email address, authentication information, and business details.
  • Operational information entered by you or authorized team members, including shops, locations, customers, vendors, products, services, sales, payments, expenses, inventory, appointments, and related records.
  • Subscription and billing metadata, including plan details, transfer notices, transfer references, payment status, and operator review records.
  • Technical and security information needed to operate and protect the service, such as device/browser information, request metadata, logs, and security events.
  • Support requests, including reply email, category, subject, message, consent, and related account context where available; notification and delivery-status records.

2. How we use information

  • To create and operate your Shop Suit account and shop workspace.
  • To provide shop operations, reporting, collaboration, subscription, and support functionality.
  • To manage authentication sessions and refresh authorized workspace data using shop/location-scoped change signals. Session identifiers and account/workspace context are used to scope subscriptions and clear local workspace state when the session ends.
  • To verify subscription payments, review historical payment notices, activate confirmed access, and maintain billing records.
  • To secure the service, prevent abuse, investigate incidents, and maintain auditability.
  • To improve reliability, usability, and performance and comply with applicable obligations.

3. Payments

New subscription payments use X-Pay hosted checkout when available. X-Pay collects payment details on its own page; Shop Suit does not collect card numbers or security codes. Checkout may remain unavailable while setup is completed.

Shop Suit retains plan, amount, currency, payment identifiers and status needed to confirm and audit subscriptions. Previous manual transfer notices and receipt evidence remain in billing history. A browser return page does not confirm payment; paid access requires a verified server-side paid result.

4. Service providers

The contact form records your request before email delivery. The support notification uses Resend to send your reply email, subject, message, category, priority, and request reference to our support mailbox. We retain the notification payload, provider message identifier, and delivery status for delivery tracking and retries. Recording a request does not guarantee email delivery or a response time.

We use service providers for infrastructure, database and authentication, email delivery, and monitoring. They process information only as needed to provide their services and under their own security and privacy obligations.

5. Security and retention

We use reasonable technical and organizational measures designed to protect information. No internet service can guarantee absolute security, so users must also protect their credentials and devices.

We retain information as needed to provide the service, protect its integrity, maintain legitimate business and audit records, resolve disputes, and meet applicable legal requirements. Retention periods may vary by data category.

6. Your choices and rights

Subject to applicable law and the nature of the data, you may ask to access, correct, update, export, restrict, or delete personal information associated with your account. Some records may need to be retained for security, billing, audit, legal, or dispute-resolution purposes.

To make a privacy request, contact support@building-suit.com.

7. Children

Shop Suit is business software and is not intended for children.

8. Policy changes

We may update this policy when the service, providers, or applicable requirements change. The current version and its update date will remain available on this page.

9. Cookies, browser storage and optional analytics

Necessary storage keeps authentication sessions (Supabase, product/environment-scoped cookies), your selected language (building-suit-locale cookie), theme (building-suit.theme and legacy theme localStorage keys), and your privacy choice (bs-shop.privacy localStorage). Auth cookies default to an 8-hour lifetime that may renew, subject to session/token validity and runtime settings; sign-out clears the current session. the locale cookie normally lasts one year. Theme preferences stay until cleared. Privacy choices expire after 180 days or when the consent version or purposes change. Operational offline drafts and pending actions may also remain on this browser until synchronized or cleared by the application; these are not analytics.

Optional Google Analytics 4 is disabled unless this production site has been configured and you accept optional analytics. Rejecting does not prevent use. Before acceptance we do not load Google Analytics or send analytics requests, including cookieless consent pings. Staging and preview environments do not send analytics. After acceptance, Google receives allowlisted public page views, pricing CTA clicks and successful new-shop signup completion, plus its standard session and engagement metadata using sanitized page fields. We do not measure paid subscription activation in this version. We do not send account/user identifiers, names, emails, phone numbers, shop or customer records, form contents, payment identifiers, query strings, fragments or operational URLs.

Google Analytics can process browser/device and network information and assign browser identifiers. Its _ga and measurement-specific _ga_* first-party cookies are configured for up to 180 days without renewal. A consented signup deduplication marker (bs-shop.analytics.signup) lasts for the tab session and is removed on withdrawal. Analytics runs in a separate document with sanitized public URLs. Advertising signals, advertising storage and ad personalization are disabled. The provider can process data outside your country under its own policies; optional analytics is not anonymous. Server and security logs necessary to operate the service are separate from this optional analytics choice.

Use Privacy settings at any time to reject optional analytics or change your choice. Withdrawal removes the analytics document, discards pending events and attempts to expire accessible GA cookies without clearing sign-in cookies. Browser restrictions and previously sent provider data cannot be undone by this control. If local storage is unavailable, the choice lasts only in memory and will be asked again after reload. Browser settings can clear storage. Google Analytics retention and enhanced measurement must be configured by the operator before analytics is enabled.

10. Contact

Shop Suit by Building Suit — Cairo, Egypt. Email: support@building-suit.com.