Privacy Policy

This page is maintained by Ganbo to explain what personal information we collect when you use our website and ecommerce build service, how we use it, and the choices you have. Please review it alongside our Terms of Service and Refund Policy.

Data controller

For the purposes of GDPR, UK GDPR and equivalent laws, the data controller for personal information collected through this service is Ganbo ("Ganbo", "we", "our", "us"). To exercise your rights, contact us via the contact page. Where a data protection officer is required, requests sent through the contact page will be routed appropriately.

Information we collect

• Account information you provide when signing up: name, email address and password.
• Business brief you submit through your job order: niche, target market, design preferences, add-on selections and any notes.
• Payment information for optional upfront fees (e.g. domain registration). Payments are processed by Stripe — Ganbo never stores full card details.
• Communications: support messages, community posts and email replies.
• Technical information: IP address, device and browser type, and basic usage analytics.

Legal bases for processing (GDPR)

• Contract — to deliver the build service you ordered and provide access to your Ganbo console.
• Legitimate interests — to secure the service, prevent fraud, and improve product quality.
• Consent — for non-essential analytics cookies and any optional marketing communications.
• Legal obligation — where we need to retain records for tax, accounting or other statutory reasons.

How we use your information

• To build and deliver the ecommerce package you ordered.
• To create and operate accounts on your behalf with providers you've selected (e.g. Shopify, Base44, Stripe, Klaviyo).
• To send transactional emails about your build status, receipts, and support replies.
• To improve our service and troubleshoot issues.
• To comply with legal obligations.

Subprocessors we use

We share the minimum information required with the following categories of subprocessors:

• Supabase — authentication, database and file storage for the Ganbo console.
• Cloudflare — hosting, CDN and DDoS protection for the Ganbo website.
• Stripe — payment processing for upfront pass-through fees.
• Resend / email delivery providers — sending transactional and account emails.
• Provider accounts created on your behalf (e.g. Shopify, Base44, Klaviyo, TikTok, Meta) — we transmit your business details and email to create the account, after which it belongs to you and is governed by that provider's own privacy policy.

Some subprocessors are located outside your country. Where personal data is transferred internationally, we rely on Standard Contractual Clauses or equivalent safeguards.

Data retention

We keep your account and job data while your account is active and for up to 24 months after deletion or last activity to support handover, receipts, dispute resolution and legal obligations. Support and billing records may be retained for longer where required by law.

Your rights

• Access, correct or export your personal information.
• Request deletion of your account and associated data (see the "Delete account" section in your console settings).
• Object to or restrict certain processing.
• Withdraw consent for marketing communications and analytics cookies.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us via the contact page. We respond to verified requests within 30 days.

Cookies and analytics

We use essential cookies to keep you signed in and remember preferences. With your consent (see the cookie banner) we also use analytics cookies to understand how the site is used. You can withdraw consent at any time by clearing site data in your browser.

Security

Access to personal data is restricted to authorised Ganbo team members and audit-logged. Passwords are hashed by our authentication provider; sensitive credentials shared with you during handover are delivered via your Ganbo console and are not stored in plain text in shared systems.

Children

Ganbo is not intended for children under 18. We do not knowingly collect personal information from anyone under 18.

Changes to this policy

We may update this policy from time to time. Material changes will be notified via email or in-app notice at least 14 days before they take effect.