Privacy
Privacy policy
What this website collects about you, why, who else sees it, and how to get a copy or have it deleted.
Who this covers
This policy is from J2Commerce, LLC, a company based in the United States. It applies to j2commerce.com and the documentation site at docs.j2commerce.com.
It does not apply to a store you run with the J2Commerce software. There, you are the one collecting personal data and you are the controller of it, as covered separately in the section called Your store's own data.
What we collect
| Category | Collected when | Examples |
|---|---|---|
| Account details | You buy an extension or create an account | Name, email address, password hash |
| Order records | You complete a purchase | Items, amount, currency, billing address, invoice |
| Payment details | You pay | Card type and last four digits only, held as a gateway token |
| Support content | You open a ticket or send the contact form | Your message, attachments, site URL if you give one |
| Email preferences | You subscribe to release notes | Email address, subscription state, unsubscribe date |
| Server logs | Any page request | IP address, user agent, requested URL, timestamp |
| Site usage | You allow analytics cookies (Google Analytics) | Pages viewed, clicks, device and browser type, approximate location, how you arrived |
| Ad measurement | You allow advertising cookies (Meta Pixel) | Pages viewed, add-to-cart and purchase events, browser and device details, IP address, the Facebook or Instagram ad you clicked |
We never receive a full card number. Card entry happens on the payment provider's own form and what comes back to us is a token plus the last four digits, which is all a refund needs.
Why we collect it
- To complete the contract
Taking payment, delivering a download, issuing a license key and handling a refund all require the order record. - To answer you
A support thread needs the message, the version you are on and a way to reply. - To meet a legal obligation
Invoices and tax records are retained because the law requires it, not because we want them. - Because you asked
Release notes are sent only to addresses that opted in, and every message carries a one-click unsubscribe. - To keep the site up
Server logs exist to diagnose faults and to block abuse. They are not used to build a profile of you. - To improve the site, with your consent
Google Analytics shows which pages help and where visitors get stuck. We read it as totals and trends, not to follow one person. - To measure and show our ads, with your consent
The Meta Pixel tells Meta when a visit or a purchase came from one of our ads, and lets us show J2Commerce ads on Facebook and Instagram to people who have visited this site.
Your store's own data
This part matters most for ecommerce software, so it gets its own section.
J2Commerce is self-hosted. When a shopper buys something from your store, that order, that customer record and that address are written to your database on your server. They are never sent to us. There is no telemetry in the core component, no phone-home, and no analytics pipeline pointed at your store.
That means you are the data controller for your shoppers, and your own privacy notice is what governs them. It also means we cannot retrieve your store's data for you, because we do not have a copy of it. Take backups.
Cookies
This site sets the cookies it needs to work, plus two optional sets that are switched on only with your consent: Google Analytics for site statistics and the Meta Pixel for advertising.
| Stored item | Purpose | Lifetime |
|---|---|---|
| Session cookie | Keeps you logged in and holds your cart between pages | Until you close the browser or log out |
| Form token | Protects forms against cross-site request forgery | Session |
| Theme preference | Remembers whether you chose the light, dark or automatic theme | Kept in your browser until you clear it |
| _ga | Google Analytics (optional): tells one visitor from another | 2 years |
| _ga_<container-id> | Google Analytics (optional): keeps the pages of one visit together | 2 years |
| _fbp | Meta Pixel (optional): recognizes your browser so visits and purchases can be matched to our ads | 90 days |
| _fbc | Meta Pixel (optional): records the Facebook or Instagram ad you clicked to get here, when you arrived from one | 90 days |
The theme preference is browser storage rather than a cookie, so it is never sent to the server.
Google Analytics and Meta Pixel cookies are set only after you accept them in the cookie banner. You can change your choice at any time from the cookie settings link at the bottom of every page, and turning them off stops new data from being sent. You can also use Google’s opt-out browser add-on and your Meta ad preferences.
Third parties
A short list, named by role rather than hidden behind a clause about sharing with partners. Each one sees only what its job needs.
- The payment provider handles card entry and settlement. It sees your payment details; we see a token.
- The email provider delivers order confirmations, ticket replies and release notes.
- The hosting provider runs the server this site sits on and holds the server logs.
- Google LLC runs Google Analytics 4. When you allow analytics cookies, it receives the site-usage data described above and handles it under Google’s privacy policy.
- Meta Platforms runs the Meta Pixel. When you allow advertising cookies, it receives page and purchase events and your IP address, may link them to a Facebook or Instagram account you are logged into, and uses them under Meta’s privacy policy, including to show you ads.
- The public issue tracker is on GitHub. Anything you post there is public by design, so do not put personal data in an issue.
We do not sell personal data for money, we do not trade it, and we do not pass it to a data broker. Some US state laws count sending Meta Pixel data for advertising as “sharing”; turning off advertising cookies stops it. Google and Meta may process data in the United States and other countries. Write to us if you want the current processor names in writing.
How long we keep it
- Invoices and order records: as long as tax law requires, then deleted.
- Account details: while the account is open. Close it and they go.
- Support tickets: kept while they are useful history on a product you own, then removed.
- Email subscriptions: until you unsubscribe. The unsubscribe itself is recorded so you are not re-added.
- Server logs: a short rolling window, then rotated out.
- Google Analytics data: 14 months, then deleted automatically.
- Meta Pixel data: kept by Meta under its own retention rules. Our cookies on your device expire after 90 days.
Your rights
Wherever you live, you can ask us to do all of the following, and we will do it without charging you or making you explain yourself.
- See it. A copy of what we hold about you.
- Fix it. Correct anything inaccurate, including from the account screens yourself.
- Delete it. Removed, except records a law requires us to keep.
- Take it with you. Exported in a machine-readable format.
- Object. Tell us to stop a particular use, including email.
- Withdraw consent. Turn off analytics or advertising cookies from the cookie settings link at any time.
Send the request from the address on the account, or through the contact form. You will hear back within thirty days, usually much sooner. If you are in the EU or the UK and you are unhappy with the outcome, you can complain to your national data protection authority.
How it is protected
The site runs over HTTPS. Passwords are stored as hashes, never in a readable form, and no member of the team can read yours. Access to order and ticket data is limited to the people who answer tickets.
If you find a weakness, please use the coordinated disclosure route on the security advisories page rather than a public issue, so a fix can reach every install before the detail does.
Children
This is developer and merchant software. The site is not aimed at children and we do not knowingly collect data from anyone under 16. If you believe we have, write to us and it will be deleted.
Changes to this policy
When this policy changes, the date at the top of the page changes with it. A change that affects how we use data you have already given us is announced by email to account holders before it takes effect, not published quietly and backdated.
