Stakeout
Privacy Policy
Last updated: October 13, 2026
Stakeout: Store Locator & SEO (“Stakeout”, “we”, “our”) is a Shopify app that adds a store locator and a search-friendly page for each store location to a merchant’s Shopify store. This policy explains what data we collect, why, and how we handle it.
Our role. For data about your store’s visitors, you (the merchant) are the controller (GDPR) or business (CCPA/CPRA), and Stakeout acts as your processor or service provider: we only process that data to provide the app to you. For your own account data, Stakeout is the controller.
1. Data We Collect
Merchant data (provided by you when you install and use the app)
- Shopify session info — shop domain, staff name, email, and OAuth tokens. This is standard Shopify authentication data required for the app to function.
- App settings — map provider preference, API keys (Mapbox token, Google Maps key), widget styling choices (colors, fonts, layout).
- Location data — store names, addresses, phone numbers, emails, websites, hours, descriptions, Google Business Profile links, tags, images, and coordinates that you enter or import. This is business information you choose to publish on your storefront.
Storefront analytics (from visitors to your store)
When your store’s visitors use the store locator or open a store location page, we record anonymous usage events for your analytics dashboard:
| Data point | Example | Identifies a person? |
|---|---|---|
| Event type | store finder view, search, location click, directions click, location page visit | No |
| Search text | “Austin, TX” | No — searches that look like a street address are counted, but their text is not stored |
| Location | Which of your stores was clicked or viewed | No |
| Arrived from a search engine | Yes / no (worked out in the browser; the referring page itself is not stored) | No |
Events are not linked to a person, device, or session. We do not store visitors’ names, emails, IP addresses, cookies, or device identifiers. Visitor IP addresses are processed briefly, in memory, to rate-limit our public endpoints, and are recorded in our hosting provider’s short-lived request logs; they are not stored in our database.
The “use my location” button uses the browser’s location only inside the visitor’s browser to sort stores by distance. Those coordinates are never sent to us.
Visitor privacy choices
Analytics events are only sent when Shopify’s Customer Privacy API reports that the visitor allows analytics. That API reflects your store’s cookie banner (for example in the EU, EEA, and UK). If a visitor declines, or their choice can’t be checked, nothing is sent.
If your store has Google Analytics installed, the store locator also sends the same events to your Google Analytics property, which is governed by your agreement with Google. Those events are only sent when the visitor allows analytics and has not used a “do not sell or share my personal information” opt-out (for example in California).
Data we do NOT collect
- Shopify customer accounts, orders, or products — the app requests no access to them
- Payment or billing details (handled entirely by Shopify)
- Browsing history beyond the store locator and store location pages
- Cookies or other storage on your visitors’ devices
2. How We Use Data
- Merchant data — to render your store locator and store location pages, authenticate your admin session, and save your configuration.
- Location data — to display your stores on the map, in search results, and on their own pages on your storefront.
- Analytics data — to power the analytics dashboard in the app admin so you can see how visitors use your store locator and pages.
We do not sell or rent data, and we do not share it for cross-context behavioral advertising.
3. Service Providers
We use these providers to host and run the app. They process data on our behalf, under their own data processing terms:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Vercel (vercel.com) | App hosting | All app requests and request logs | United States |
| Supabase (supabase.com) | Database | All data described in section 1 | United States |
If you are in the EU, EEA, UK, or Switzerland, your data is transferred to the United States. These transfers rely on our providers’ Standard Contractual Clauses and, where they are certified, the EU–U.S. Data Privacy Framework.
Services you configure
Depending on your configuration, the app and your store locator communicate with these services directly:
| Service | Purpose | Data sent |
|---|---|---|
| Mapbox (mapbox.com) | Map rendering, geocoding | Your Mapbox token, your store addresses (from our servers, to place them on the map), and search text entered by visitors (from the visitor’s browser) |
| Google Maps (google.com) | Map rendering, geocoding (if selected as provider) | Your Google Maps key and search text entered by visitors (from the visitor’s browser) |
| Google Fonts (fonts.googleapis.com) | Custom font loading (if a non-system font is selected) | Standard HTTP request headers |
| Google Sheets (googleapis.com) | Optional location import/export | Your sheet ID and the location data read from or written to your spreadsheet |
Each service is governed by its own privacy policy. We only connect to them when you configure them in the app.
4. Data Retention
- Analytics events are automatically deleted after 90 days.
- Merchant settings and location data are retained as long as the app is installed.
- Session data is retained as long as the app is installed and is refreshed by Shopify automatically.
- Request logs are kept by our hosting provider for a short period under its retention policy, then deleted.
5. Data Deletion
On app uninstall
When you uninstall Stakeout, we immediately and permanently delete:
- All session and authentication data
- Your shop record and widget settings
- All location data
- All analytics events
Shopify also sends a shop erasure request 48 hours after uninstall, which repeats the deletion as a safeguard.
On request
You may request deletion of your data at any time by contacting us. We will process your request within 30 days.
Shopify privacy requests (GDPR / CCPA)
We handle all of Shopify’s mandatory privacy webhooks:
- Customer data request — we hold no data that identifies your customers, so there is nothing to export.
- Customer data erasure — we hold no data that identifies your customers, so there is nothing to erase.
- Shop data erasure — we delete all shop data, locations, and analytics.
6. Data Security
- All traffic to and from the app uses HTTPS/TLS encryption.
- Data is stored in a managed database that is encrypted at rest.
- API keys (Mapbox, Google Maps) are stored server-side and only sent to the storefront as needed for map rendering.
- Public endpoints are rate-limited to prevent abuse.
- Application logs record operational events such as errors and shop domains. They do not contain visitor search text.
7. Your Rights
Depending on where you are (including the EU/EEA, UK, and California and other U.S. states with privacy laws), you have the right to:
- Access the data we hold about your shop
- Request correction of inaccurate data
- Request deletion of your data
- Export your location data
- Not be discriminated against for exercising these rights
To exercise these rights, contact us at the address below. If you are a shopper at a store that uses Stakeout, please contact that store first; we will help them respond to your request. EU, EEA, and UK residents may also complain to their local data protection authority.
8. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated through the app admin or via email. The “Last updated” date at the top reflects the most recent revision.
9. Contact
For privacy questions or data requests:
Stakeout
Email: support@stakeoutlocator.com
Website: stakeoutlocator.com