KwikNest ("KwikNest", "we", "us") runs a commerce platform for merchants, suppliers, and the customers who shop on merchant storefronts. This policy explains what personal information we collect, how we use and share it, how long we keep it, and the rights you have over it. It applies to kwiknest.com and every storefront we host. Sections 10 to 12 add the details required for people in the United States, Canada, the European Union, and the United Kingdom.
1. Who is responsible for your information
- Merchant, supplier, and team accounts. For information about people who use the KwikNest back office, KwikNest decides how it's used and is responsible for it (the "controller" under GDPR, and the organisation accountable for it under Canadian law).
- Storefront shoppers. When you shop on a merchant's storefront, that merchant is responsible for your information. KwikNest processes it on the merchant's behalf and under their instructions (a "processor" or "service provider"). Each storefront links to the merchant's own privacy policy, and requests about your shopper data are best sent to the merchant first. We'll help them respond, and you can always contact us directly.
2. Information we collect
- Account information: name, email, phone number if you add one, organisation name, role, and the user ID issued by our sign-in provider, Clerk.
- Business verification: legal business name, business address, and the last four digits of a tax ID. Full identity and bank verification for payouts is collected by Stripe, not by us.
- Storefront shopper information: name, email, phone, shipping and billing addresses, order history, wishlists, reviews, enquiries, conversations with a storefront's assistant, tax-exemption details if you provide them, and whether you agreed to receive marketing.
- Commercial information: orders, quotes, RFQs, invoices, messages between merchants and suppliers, payouts, and refunds.
- Payment information: Stripe customer and payment IDs and payment status. Card numbers are entered directly into Stripe's secure fields. We never see or store full card details.
- Information merchants bring with them: customer and order records a merchant imports by file or by connecting another platform such as Shopify, WooCommerce, or Instagram.
- AI requests: what you type into AI features and the business data needed to answer it, such as product or order details.
- Technical information: IP address, browser user-agent, pages requested, and timestamps, logged for security and abuse prevention.
- Storefront analytics: only if you accept analytics in the cookie banner. See the Cookies Policy for exactly what is recorded.
We get this information from you, from the merchant or supplier you deal with, from services a merchant connects (such as Stripe or a sales channel), and automatically from your browser when you use the platform.
3. How we use it
- To run the platform: sign-in, storefronts, checkout, orders, invoicing, delivery, and payouts.
- To send the emails and messages the service depends on, such as receipts, order updates, and password resets.
- To keep the platform secure and prevent fraud, spam, and abuse.
- To meet legal duties such as tax, accounting, and responding to lawful requests.
- To show merchants how their own storefront is performing.
- To improve KwikNest using aggregated usage information.
- To send marketing, only where you have agreed or the law otherwise allows it, and always with a way to opt out.
We do not use personal information for third-party advertising, and we do not build profiles of shoppers across different merchants' storefronts.
4. Who we share it with
We do not sell personal information, and we do not share it for cross-context behavioural or targeted advertising. We share it only in these cases:
- With the merchant or supplier you are dealing with, so they can fulfil your order or quote.
- With service providers that help us run the platform, each limited to what it needs for its purpose. Some only receive data when a merchant turns on the feature that uses them:
- Clerk: Authentication and session management.
- Neon: Primary Postgres database hosting.
- Stripe: Payments, payouts, optional tax calculation.
- Resend: Transactional and account email.
- Upstash: Rate-limit state (hashed keys only).
- Sentry: Error monitoring (when enabled; PII scrubbed).
- Vercel: Application hosting, edge delivery, and Blob object storage.
- OpenAI / Anthropic: Optional AI features (catalogue helpers, Nestor, storefront assist) when configured.
- Twilio: Optional SMS delivery when messaging is configured.
- Google Maps Platform: Optional delivery routing / geocoding when Maps keys are set.
- EasyPost: Optional carrier rates, labels, and tracking webhooks.
- Shippo: Optional carrier rates, labels, and tracking webhooks.
- DoorDash Drive: Optional local courier delivery: receives the recipient's name, phone, and delivery address.
- Uber Direct: Optional local courier delivery: receives the recipient's name, phone, and delivery address.
- Meta (Instagram): Optional Instagram catalogue / channel integrations when connected.
- Unsplash: Optional stock imagery for storefront theme helpers.
- With services a merchant chooses to connect, such as their Shopify or WooCommerce store or a shipping carrier. Those services handle data under their own terms and privacy policies.
- When the law requires it, or to protect the rights, safety, or property of our users, the public, or KwikNest.
- In a business transfer, such as a merger or sale, where the buyer must keep protecting the information as this policy describes.
The current list is also on our Sub-processors page. We give 30 days' notice before adding a new sub-processor that handles personal data.
5. Email and SMS
- Service messages such as receipts, order updates, security alerts, and password resets are part of the service and are sent whether or not you have opted in to marketing.
- Merchant marketing. Merchants can only send campaigns from KwikNest to shoppers recorded as having agreed to marketing. Every marketing email includes an unsubscribe link, and unsubscribes and bounces are suppressed automatically.
- KwikNest marketing to merchants and suppliers follows the same rules. In Canada we only send commercial electronic messages with consent, as Canada's Anti-Spam Legislation (CASL) requires, and we process unsubscribes within 10 business days.
- SMS is only sent to a number provided for that purpose. Reply STOP to opt out.
6. Where your data is stored
Our infrastructure and most of our service providers are in the United States, so your information is stored and processed there. If you are outside the US, including in Canada, your information will be transferred to the US and may be accessible to US courts, law enforcement, and national security authorities under US law. For transfers out of the EU, the UK, or Switzerland, we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider's certification under the EU-US Data Privacy Framework, as applicable.
7. How long we keep it
- Accounts: while the account is open. When an account is closed, we delete or anonymise it within 90 days, except for the records below that we must keep.
- Orders, invoices, and payouts: 7 years, to meet tax and accounting law in the US, Canada, and most other countries.
- Storefront shopper accounts: deleting your account from the storefront's account page removes your name, saved addresses, wishlist, and sign-in details straight away. Reviews you posted stay published without your name. Past orders keep the shipping address and email used, because they are part of the merchant's sales records.
- Security logs: 90 days. After that the IP address, browser user-agent, and user ID are removed, and only the anonymous event remains.
- Cookie consent records: a record that you declined optional cookies is kept for 3 years. All consent records are deleted after 5 years.
- Unsubscribes: kept for as long as needed to make sure we and our merchants don't email you again.
- Storefront analytics: kept while the merchant's account is open, and deleted with it.
8. Security
Data is encrypted in transit (TLS 1.2 or higher) and at rest. Access is limited by organisation and by role. Card data is handled by Stripe in PCI DSS Level 1 environments. Payment and delivery webhooks are signature-checked.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant regulators as the law requires, including where Canadian law requires notice because there is a real risk of significant harm.
9. Your rights
Wherever you live, you can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct information that is wrong or incomplete;
- delete your information, subject to records we must keep by law;
- give you your information in a portable format;
- stop sending you marketing, and withdraw any consent you gave.
Storefront shoppers can download or delete their data from the storefront's account page. For anything else, email privacy@kwiknest.com. We will verify your identity before acting on a request, and we respond within 30 days. If the law allows us more time and we need it, we'll tell you why. Requests are free. You can also ask someone to make a request for you if you give them written permission, and we may confirm that with you. We will not treat you differently for using your rights.
10. United States residents
California and a growing number of states (including Colorado, Connecticut, Texas, Virginia, and others) give residents specific privacy rights. We honour the rights in section 9 for all US residents. In addition:
- Categories of information. In the past 12 months we have collected the categories described in section 2: identifiers (such as name, email, and IP address), customer records and commercial information (such as orders), internet activity (such as pages viewed, with consent for analytics), professional information (such as your business and role), and account sign-in details. We use and disclose them only for the purposes in sections 3 and 4.
- No sale, no sharing, no targeted advertising. We have not sold personal information, shared it for cross-context behavioural advertising, or used it for targeted advertising, including information about people under 16, so there is nothing to opt out of. This is also why a Global Privacy Control browser signal does not change how we handle your information.
- Sensitive information. We only use account sign-in details to let you sign in and keep your account secure. We do not use sensitive information to infer characteristics about you.
- Appeals. If we decline your request, you can appeal by replying to our decision. If you are still not satisfied, you can contact your state attorney general.
- California "Shine the Light". We do not disclose personal information to third parties for their own direct marketing.
11. Canada
We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA), the provincial private-sector laws of Quebec, Alberta, and British Columbia, and Canada's Anti-Spam Legislation (CASL).
- Accountability. Our Privacy Officer is responsible for how we handle personal information, and is also the person in charge of the protection of personal information under Quebec's Law 25. You can reach them at privacy@kwiknest.com.
- Consent. We rely on your express consent for optional cookies and marketing, and on implied consent for what is needed to provide the service you asked for. You can withdraw consent at any time, though some features may stop working.
- Transfers outside your province or Canada. As section 6 explains, information is stored in the United States. Before transferring it, we assess whether it will be adequately protected, and our contracts with service providers require them to protect it.
- Complaints. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada. Quebec residents can also contact the Commission d'accès à l'information du Québec.
12. European Union and United Kingdom
If you are in the EU or the UK, the General Data Protection Regulation (GDPR) or the UK GDPR applies. Our legal bases for using your information are:
- Contract (Art. 6(1)(b)): to provide the platform, route orders, and process payouts.
- Legal obligation (Art. 6(1)(c)): tax and accounting records and responding to lawful requests.
- Legitimate interests (Art. 6(1)(f)): security logging, abuse prevention, and improving the product with aggregated information, balanced against your rights.
- Consent (Art. 6(1)(a)): optional cookies and marketing email. You can withdraw it at any time through the cookie banner or the unsubscribe link.
On top of the rights in section 9, you can object to processing based on legitimate interests and ask us to restrict processing. You can complain to your local data protection authority, or in the UK to the Information Commissioner's Office. See our EU representative page for how to reach us from the EU.
13. Children
KwikNest is not directed at children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.
14. Changes
If we make material changes, we will tell account holders by email or when they next sign in before the changes take effect. The "Last updated" date at the top of this page shows when it last changed.
15. Contact
Questions or requests? Contact our Privacy Officer at privacy@kwiknest.com.
Questions or requests? Contact privacy@kwiknest.com.