Shopicat
Privacy policy
Last updated October 18, 2026
This policy explains what personal data Shopicat collects when you use https://nightly.shopicat.org and the stores built on it, why we collect it, and the choices you have. Shopicat is a platform that lets merchants build and run online stores and connect them to marketing channels such as Facebook and Instagram.
Data we collect
- Account data: your name, email address, password hash, and team membership when you sign up as a merchant.
- Store data: products, images, pages, orders, and customer details you or your shoppers enter into a store.
- Shopper data: when you buy from a store on Shopicat, the merchant receives the contact, shipping, and order details you provide at checkout.
- Technical data: IP address, browser type, and logs needed to run, secure, and debug the service.
Data from Facebook and Instagram
If a merchant connects a Facebook Page, Instagram professional account, or ad account, we receive the data Meta shares under the permissions the merchant grants. This can include the Page and account names and IDs, access tokens, posts and media, comments and direct messages sent to the business, insights and ad performance reports, and basic profile fields (such as name and profile picture) of people who message or comment on the business.
We use this data only to provide the features the merchant turned on: publishing posts, replying to comments and messages from one inbox, showing insights, and managing ads. We do not sell it, use it for our own advertising, or share it with third parties other than the infrastructure providers that host the service. Access tokens are stored encrypted.
How we use data
- To operate stores, process orders, and provide the features you use.
- To secure accounts, prevent fraud and abuse, and debug problems.
- To send service emails such as sign-in links, order notices, and important changes.
Sharing
We share data with service providers that host and run Shopicat (servers, storage, email delivery, and payment processors), with Meta when a merchant asks us to act on their connected accounts, and when the law requires it. Each provider may only use the data to provide its service to us.
Retention
We keep account and store data while the account is active. When a merchant disconnects a Meta account we stop using its tokens and delete the related data within 30 days, except where we must keep records for legal or accounting reasons.
Deleting your data
Merchants can delete stores and close their account from their settings, or ask us to do it. You can also remove Shopicat from your Facebook account under Settings & privacy → Settings → Apps and websites. When you do, Meta notifies us and we start deleting the data we received about you. Meta gives you a confirmation code, and you can check the status of the request at https://nightly.shopicat.org/api/integrations/meta/deletion-status/<code>.
Shoppers who want their order data removed should contact the store they bought from; we will help the merchant fulfil the request.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data and to object to some processing. Contact us to make a request.
Security
We use encryption in transit, encrypted storage for access tokens, and access controls to protect data. No system is perfectly secure, so we cannot guarantee absolute security.
Changes
We will post updates to this page and change the date above. If a change is significant we will tell merchants by email.
Contact
Questions or requests: reply to any email you have received from Shopicat.