Privacy Policy

1. Two kinds of data, two roles

LaunchLancer is operated by Vividsol ("we", "us"), a sole proprietorship owned by Sheikh Muhammad Fayyaz. We handle personal data in two distinct roles, and your rights run through the party in charge of each:

• Merchant data — we decide how it's used. Account and business information for people who sign up to run a store (and their invited staff), plus enquiries sent through our contact form.
• Shopper data — the merchant decides how it's used. When you buy from a store hosted on LaunchLancer, the store's merchant is responsible for your data; we store and process it on the merchant's behalf so their store works. Shopper questions and requests should go to the store you bought from first — we support merchants in answering them.

2. What we collect

From merchants and staff

• Account details: name, email address, password (stored only as a secure hash), phone number.
• If you sign in with Google or Facebook: your name, email address, and provider account identifier as shared by that provider. We never see your social password.
• Business details from onboarding: store name, industry, catalogue type, and how you found us (optional).
• Billing details you enter for invoices, and your plan and usage records.
• Content you upload: products, images, pages, branding.
• If you turn on order alerts: the browser push subscription needed to deliver them.
• Operational records: administrative actions with IP address and browser identifier, kept as an audit trail.

From shoppers, on the merchant's behalf

• Order and account details: name, email, phone, delivery addresses, order history, carts, wishlists, and product reviews on that store.

From anyone contacting us

• Whatever you include in the message, plus your name and email so we can reply.

3. How we use it

• To provide the platform: run stores, process orders, deliver transactional email (order confirmations, password resets, invoices, verification links).
• To operate responsibly: prevent fraud and abuse, enforce our Terms, keep an audit trail, and fix problems.
• To communicate with account owners about their service — billing, security, and changes that affect them.
• To understand how this website is used, so we can improve it — see §4 for exactly what that involves today.

We do not sell personal data, and we do not rent it, trade it, or hand it to anyone for their own marketing.

4. Cookies and analytics

A cookie is a small piece of data a site stores in your browser. We use the cookies the platform needs to function: a session cookie to keep you signed in (merchant dashboards and storefronts use separate cookies, scoped to their own addresses), a security token that protects forms against forgery, and an optional "remember me" cookie.

None of these are advertising cookies. We run no third-party advertising or tracking on this website. If that ever changes, this section will say so, naming each service and how to opt out, before it does.

On merchants' storefronts, a merchant may enable their own Google Analytics or Meta pixel for their store. When they do, those services set their own cookies there under the merchant's responsibility, and the merchant's store policies apply — not this one.

5. How we protect it

• All traffic is encrypted in transit (HTTPS).
• Passwords are stored only as secure one-way hashes; connected payment and courier credentials are encrypted at rest.
• Every store's data is isolated from every other store's, and staff only see the stores they've been invited to.

No system is perfectly secure. If a breach ever affects your data, we'll tell the affected account owners what happened, what was involved, and what to do about it.

6. Who processes data on our behalf

We share personal data only with the service providers the platform needs to run, and only what each one needs:

• DigitalOcean — cloud infrastructure the platform is hosted on.
• Resend — delivers transactional email.
• Google / Meta — only if you choose to sign in with them.
• JazzCash — only if you choose to pay a platform invoice through it, or if a merchant connects their own JazzCash account for their store's checkout.
• Our domain registrar — registrant details needed to register a domain you buy through us (WHOIS privacy is enabled).
• Couriers a merchant connects — a shopper's name, address, and phone are sent to the merchant's own courier account to book their delivery.

We require every provider we share data with to protect it to a standard consistent with this policy, and to use it only to perform the service they provide us. Our servers may be located outside Pakistan.

7. When we disclose data for other reasons

Beyond the providers in §6, we disclose personal data only in these situations:

• When the law requires it — a court order, or a lawful request from an authority entitled to make one. Where we're permitted to tell you about such a request, we will.
• To investigate or prevent serious harm — suspected fraud, threats to someone's physical safety, or a breach of our Terms.
• If the business changes hands — if we are acquired, merged, or reorganised, data may transfer as part of that. We'll notify account owners beforehand, and the new owner remains bound by this policy until you're told otherwise and given the chance to leave.

8. Your data, and your customers' data

We own the platform. You own your data. The software, servers, databases and themes are ours; the products, content, orders and customer records inside your store are yours, and running them through our software doesn't change that.

Concretely, that means:

• We don't market to your customers. We will never email your shoppers to sell them something, add them to a list of ours, or tell them about other stores on the platform.
• Store email goes out in your name. Order confirmations and the other transactional emails your store sends carry your store's own sender name, and replies go straight back to your own address — not to us. Delivering them needs a sending domain that mailbox providers have verified, so unless you have verified your own, they are handed over for delivery on a domain of ours. The only mail we send in our own name goes to account owners, about their account.
• We don't compete with you. We don't use your catalogue, pricing or sales figures to trade against you or to advantage another merchant. Aggregated, de-identified figures — how many stores are on a plan, how many orders the platform handled — tell us nothing about any one store and are all we use.

The other half of this is your responsibility. When someone buys from your store you receive their name, contact details and address. For that data you are the controller and we are only the processor, so:

• Use it to fulfil the order and serve that customer — delivery, support, and messages about their own purchase.
• Buying from you once is not consent to be marketed to. Don't add a customer to a promotional list, or send them unsolicited commercial messages, without asking them first.
• Don't sell, rent, or pass your customers' details to anyone else, and publish your own store privacy policy saying how you handle them — the platform gives you pages for exactly this.

Breaking these is a breach of our Terms, and it's the kind we act on: your customers trusted your store, and the platform's reputation rides on that trust being kept.

9. Retention and deletion

• Merchant account data is kept while the account is active. To delete a store or an account permanently, contact us — we confirm with the store owner, then delete.
• We don't delete a store for being quiet. An account with no recent orders keeps its data until you ask us to remove it.
• Shopper data lives inside the merchant's store and follows the merchant's instructions — merchants can remove customer records, and store deletion removes them.
• Some records outlive the account where the law or a legitimate need requires it — invoices and payment records for tax and accounting purposes, and a domain's registration record, which is held at the registry rather than by us.
• Backups exist for disaster recovery and expire on a fixed schedule; deleted data leaves backups as they rotate.

10. Your choices and rights

• Merchants: you can view and correct most of your data in your dashboard; for a copy of your data, a correction we don't expose, or deletion, contact us.
• Shoppers: contact the store you bought from — its merchant controls your data. If you can't reach them, contact us and we'll help route the request.
• You can stop service emails you don't need from your notification settings. Emails we must send — invoices, security notices, and changes to these policies — come with the account.

11. Children

LaunchLancer accounts are for adults (18+). We don't knowingly collect data from children; if you believe a child's data has reached us, contact us and we'll remove it.

12. Changes to this policy

When this policy changes, the "Last updated" date above changes with it, and material changes are announced to account owners by email before they take effect. We'd encourage you to look over it from time to time.

13. Contact