Open Commerce Online
Log inSign up

Privacy

Who is responsible

Open Commerce Online (OCO) provides software that merchants use to take card and crypto payments. The merchant is the seller of record for goods and services sold on a tenant storefront. OCO is the controller of account data for operators who sign up on opencommerce.online. Vercel, Supabase, Stripe, Resend, and Sentry process data on our behalf as subprocessors — see Subprocessors.

Vercel’s Data Processing Addendum covers Vercel as a processor of deployment logs, environment configuration, and build artifacts. It is not a substitute for this notice.

What we collect

  • Operators: name, email, authentication identifiers, workspace membership, billing metadata, API keys (hashed or wrapped), gateway configuration, and audit events.
  • Shoppers (on hosted checkout): order contact details the merchant collects (typically email and name), cart contents, payment status, and fulfillment state. Card numbers never transit OCO servers — they go to Stripe Elements / Checkout. Crypto payments settle to merchant-derived addresses; we store public keys (xpubs), not spending keys.
  • Technical: cookies described in Cookies, IP and user agent as seen by Vercel Functions and our error reporter.

Why we use it

To operate checkout, settle payments, send transactional email, prevent abuse, bill the software subscription, and meet legal obligations. We do not sell personal data.

Access, export, and deletion

  • Merchants use Admin → Privacy (/admin/privacy) to export or purge tenant commerce history, with step-up on destructive actions.
  • Shoppers should contact the merchant that took the order. The merchant can use the same Privacy tools. Platform operators assisting a tenant use the Privacy support API after step-up.
  • Retention after subscription cancel follows the product freeze/disable window; physical deletion is a separate, audited action. Counsel must confirm the retention period (TOS still has [N days]).

International transfers

Infrastructure runs primarily on Vercel (AWS) and Supabase. Default Function execution may be in the United States unless a region is pinned. Counsel should confirm SCCs / DPF coverage for EU/UK shoppers.

Contact

Operators: use the in-app Privacy tools or the support path documented in the dashboard. Shoppers: contact the merchant named on the receipt.