Skip to content
Storey
Legal

Privacy Policy

Effective 1 May 2026

This Privacy Policy explains how Storey ("we", "us", "our") collects, uses, stores and shares personal information when you install our WordPress plugin or Shopify app, visit our website, or contact us. We are based in South Africa and process personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"). For users in the European Economic Area we also act consistently with the General Data Protection Regulation ("GDPR").

1. Who we are

Storey is a software service that connects merchant stores (WooCommerce, Shopify) to social media platforms (Meta — Facebook and Instagram — and TikTok) to schedule and publish product posts on behalf of the merchant. We act as the responsible party (POPIA) and data controller (GDPR) for the personal information described below.

Contact for privacy matters: privacy@storeyplugin.co.za.

2. What we collect

2.1 Account information

  • Your name, email address and password hash when you create a Storey account.
  • Your store URL and platform (WordPress/Shopify) when you connect a store.
  • License key, plan tier, and subscription state.

2.2 Store and catalogue data

  • Product data you select for promotion: title, description, price, currency, images, categories, product URL.
  • Records of which products are eligible for posting and the post history per product.

2.3 Social account data

  • OAuth access tokens and refresh tokens issued by Meta and TikTok when you connect those accounts.
  • Your social account identifiers (page ID, Instagram Business ID, TikTok open_id) and display names.
  • The status, URL and metadata of posts we publish on your behalf.

2.4 Billing data

  • For WordPress installs: payment metadata returned by Paystack. We do not store full card numbers.
  • For Shopify installs: subscription identifiers returned by Shopify Billing.

2.5 Technical data

  • IP address, user agent and timestamps for security, abuse-prevention and audit logging.
  • Server-side application logs that may incidentally reference identifiers above.

Our website does not set advertising or analytics cookies. We use only first-party storage strictly necessary for the site to function.

3. Why we use your information

  • To deliver the service you install — sync products, publish scheduled posts, surface results in your dashboard.
  • To authenticate store installs and dashboard sessions.
  • To bill for your subscription via the chosen payment provider.
  • To support you when you contact us.
  • To meet legal and security obligations, including fraud prevention and audit.

4. Who we share with

We share personal information only with the categories of recipients required to operate the service:

  • Meta Platforms, Inc. — to publish posts to Facebook Pages and Instagram Business accounts you have connected. Your content and OAuth tokens are transmitted to Meta in accordance with the Meta Platform Terms.
  • TikTok — to publish posts to TikTok accounts you have connected, in accordance with the TikTok for Developers Terms.
  • Paystack (for WordPress) and Shopify (for Shopify) — to process subscription billing.
  • Google Cloud Platform (Cloud Run, Cloud SQL, Cloud Tasks, Cloud Scheduler, Secret Manager) — our cloud infrastructure provider, in the europe-west1 region.

We do not sell personal information. We do not share personal information with third parties for advertising.

5. International transfers

Personal information is primarily processed in the European Union (Google Cloud, europe-west1). Onward transfers occur when data is sent to Meta, TikTok or your chosen payment processor (which may process data in the United States). These transfers are made under standard contractual clauses or equivalent safeguards.

6. How long we keep it

  • Account and store data: while your subscription is active and for up to 90 days after cancellation, then deleted or anonymised.
  • Social tokens: until you disconnect the social account or uninstall the plugin/app, then revoked and deleted.
  • Billing records: for the period required by South African tax law (typically 5 years).
  • Application logs: rolling 30 days unless required for security investigation.

7. Your rights

You have the right to:

  • Access the personal information we hold about you.
  • Request correction of inaccurate information.
  • Request deletion of your information (subject to legal retention requirements).
  • Object to processing, or restrict it, in defined cases.
  • Withdraw consent at any time, including disconnecting any social account.
  • Lodge a complaint with the South African Information Regulator or, if applicable, your local EU supervisory authority.

To exercise any of these rights, email privacy@storeyplugin.co.za from the email address on your Storey account.

8. Security

We use TLS in transit, encryption at rest for sensitive fields (including OAuth tokens and store API keys), and least-privilege access controls. Internal endpoints are protected by shared secrets. We review access logs regularly. No system is perfectly secure — please use a strong, unique password.

9. Children

Storey is not directed at children under 18. If we learn we have collected personal information from a child under 18 we will delete it.

10. Changes to this policy

We may update this policy from time to time. The effective date at the top of this page reflects the most recent change. Material changes will be notified by email to your account address and via an in-app notice.

11. Contact

Privacy and data-rights queries: privacy@storeyplugin.co.za
General support: support@storeyplugin.co.za
Service URL: https://api.storeyplugin.co.za