This policy explains what personal data we collect when you visit solidshop.app, create an account, or purchase commercial extensions, how we use it, and the rights you have over it.
Last updated: 2026-06-25
Introduction
Solidshop publishes a free, open-source e-commerce component for Joomla. The software itself runs entirely on your server — we never see the orders, customers, or products stored inside your Solidshop installation. This policy applies only to the data we collect through our website (solidshop.app), our commercial extensions marketplace, and our support channels.
Are you a customer of a store built on Solidshop? This policy does not apply to your purchases from that store. Each Solidshop merchant is the data controller for their own customer data — contact the merchant directly for questions about your order with them.
Who we are
For the purposes of the EU General Data Protection Regulation (GDPR) and the
UK Data Protection Act 2018, Solidshop is the data controller for the
website, your account, and support. You can reach us at
We sell commercial extensions directly, as the seller of record. Payments are processed on our behalf by PayPal, acting as our payment processor. You enter your payment details directly into PayPal — we never see or store your full card number or PayPal credentials. PayPal processes that payment data under its own privacy statement — see PayPal’s privacy statement. Solidshop is the data controller for the order, billing, account, and support records described in this policy.
Data we collect
We collect the minimum data required to run the website, process purchases, and provide support. Categories below describe what we collect and when.
When you visit the website
- Server logs — IP address, user agent, referring URL, pages visited, and timestamps. Retained for 30 days for security and debugging.
- Analytics events — page views, referrer, country (derived from your IP at request time, not stored), and browser/OS class, processed through Cloudflare Web Analytics. No cookies are set, no cross-site tracking takes place, and no persistent identifier is assigned to your browser.
When you create an account
- Email address — for sign-in and transactional messages.
- Name — displayed on invoices and in forum posts.
- Password hash — stored using industry-standard one-way hashing; the plain-text password is never stored.
When you purchase an extension
We sell extensions directly and use PayPal as our payment processor. Your payment details — card number, CVV, or PayPal login — are entered into PayPal and are never seen or stored by Solidshop. In connection with a purchase we collect and hold:
- Order details — your email, name, billing country, the product purchased, the order ID, and the amount paid.
- Payment confirmation — the transaction ID and payment status PayPal returns to us, so we can confirm the payment and reconcile the order. We do not receive your full payment-instrument details.
- Invoices and accounting records — we issue your invoice and retain it, with our transaction records, for as long as required by tax and accounting law (typically 7–10 years).
- Download and licence-key usage logs — which file you downloaded and the domain(s) you activated a licence on, for licence validation and updates delivery.
When you contact support or post on the forum
- Message content, attachments, and screenshots — the text and files you send us.
- Forum posts — publicly visible alongside your chosen display name. You can request deletion of your forum posts at any time.
What we do not collect
We do not collect: government IDs, precise geolocation, biometric data, health data, browsing history from other websites, or data from your Solidshop installation. We do not sell, rent, or trade any personal data to third parties.
How we use data
| Purpose | Data categories used |
|---|---|
| Run the website and serve pages | Server logs |
| Measure site usage and improve the service | Aggregated, cookieless analytics events |
| Authenticate your account | Email, password hash |
| Process purchases and issue invoices | Name, email, billing details, payment metadata |
| Deliver licence keys and software updates | Email, licence usage logs |
| Send transactional email (receipts, password resets, update notices) | Email, name |
| Provide support | Support messages, attachments, account email |
| Prevent fraud and abuse | Server logs, payment metadata |
| Comply with tax, accounting, and legal obligations | Invoices, billing details |
Legal basis (GDPR)
Under the GDPR, every processing activity must have a lawful basis. Ours are:
- Performance of a contract — processing necessary to deliver extensions, licence keys, and support you have purchased.
- Legal obligation — retaining invoices and transaction records as required by tax law.
- Legitimate interests — server-log retention for security and fraud prevention, and aggregated, cookieless analytics for understanding how the website is used and improving it. Our legitimate interests do not override your fundamental rights.
- Consent — optional marketing emails and any non-essential cookies. Consent is always opt-in and can be withdrawn at any time.
Cookies & tracking
The website uses a small number of cookies. We group them as follows:
| Cookie type | Purpose | Requires consent? |
|---|---|---|
| Strictly necessary | Session identifier, CSRF token, shopping cart contents, language preference | No (required for the site to function) |
| Preferences | Theme (light/dark), sidebar state | No (set by your explicit choice) |
Our analytics provider (Cloudflare Web Analytics) does not set cookies or any persistent identifier on your device, so analytics is not listed in the table above. We do not use advertising cookies, third-party remarketing pixels, or cross-site behavioural advertising networks. You can clear cookies at any time from your browser settings.
Third-party services
We use a small number of sub-processors to operate the service. Each is bound by a data processing agreement and transfers only what is necessary for the stated purpose. PayPal is included below as our payment processor: you enter your payment details directly into PayPal, and PayPal also acts as an independent controller of that payment data under its own privacy statement, for fraud prevention and regulatory compliance.
| Service | Purpose | Data shared |
|---|---|---|
| PayPal (Europe) S.à r.l. et Cie, S.C.A. Payment processor |
Process payments for extension purchases and renewals, and run fraud, anti-money-laundering, and regulatory checks on the payment | You provide your payment details (card or PayPal account) directly to PayPal at checkout. Solidshop receives back only the transaction ID and status, plus the order details you entered (email, name, billing country, product, amount). |
| Email delivery provider | Send transactional email (receipts, password resets, update notices) | Recipient email, subject, message content |
| Cloudflare, Inc. (Cloudflare Web Analytics) | Aggregated, cookieless website analytics | IP address (read at request time for country lookup, not stored), user agent, page URL, referrer, basic performance metrics. No cookies, no persistent identifier. |
| Cloud hosting provider | Host the website, database, and file storage | All data processed on our behalf; primary storage stays in the EU |
Data sharing
We do not sell, rent, or trade your personal data. We share data only:
- With the third parties listed above, strictly for the purposes stated.
- When required by a valid court order or binding legal request.
- With a successor entity in the event of a merger, acquisition, or sale of assets — with advance notice to you and an opportunity to object.
Data retention
- Server logs — 30 days, then deleted.
- Account data — retained while your account is active. Deleted within 30 days of account closure (except data we are legally required to retain).
- Invoices and financial records — 10 years from issue, to satisfy tax-law retention requirements.
- Support conversations — 3 years from the date of the last message, so we can reference prior context for returning customers.
- Forum posts — kept indefinitely unless you request deletion.
Security
We take reasonable technical and organisational measures to protect personal data:
- All connections to the website are encrypted with TLS 1.2 or higher.
- Passwords are stored using one-way hashing.
- Payment card details are entered into and handled entirely by PayPal, and never reach our servers.
- Production databases are backed up daily and encrypted at rest.
- Access to production systems is limited to named staff, protected by multi-factor authentication, and audited.
No online system is perfectly secure. If we ever detect a breach affecting your personal data, we will notify you and the relevant supervisory authority within the timeframes required by law (72 hours under GDPR).
Your rights
If you are in the EU, UK, Switzerland, California, or another jurisdiction with a comparable privacy law, you have the following rights:
- Access — request a copy of the personal data we hold about you.
- Rectification — correct data that is inaccurate or incomplete.
- Erasure — request deletion of your data, subject to retention obligations.
- Restriction — ask us to pause processing in specific circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests or for direct marketing.
- Withdraw consent — where processing is based on consent, withdraw it at any time.
- Lodge a complaint — with your local data protection authority.
To exercise any of these rights, email
California residents — under the California Consumer Privacy Act (CCPA) you additionally have the right to know the categories of personal information collected, the purposes for which it is used, and the categories of third parties with whom it is shared. All of this is disclosed above.
International data transfers
Our servers are located in the European Union. If you access the service from outside the EU, your data is transferred to and processed within the EU. Cloudflare Web Analytics is operated by Cloudflare, Inc., based in the United States, and serves your requests from a globally distributed edge network; this transfer is covered by Cloudflare’s certification under the EU–US Data Privacy Framework, supplemented by Standard Contractual Clauses (SCCs). For any other sub-processor located outside the EU/EEA, transfers are governed by SCCs or an equivalent transfer mechanism approved by the European Commission.
Children’s privacy
Solidshop is a business-to-business service not intended for anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
Changes to this policy
We may update this policy from time to time to reflect changes in our practices, new features, or legal requirements. The “Last updated” date at the top of this page always reflects the current version. If we make material changes, we will notify registered users by email at least 14 days before the change takes effect.
Contact us
For any question about this policy or about how we handle your personal
data, contact us at