Privacy policy

Who we are

Ripshop is a trade name of MoeskerGroup, Carstensdijk 77, 7916 RA Elim, the Netherlands, Chamber of Commerce number 97344567. For questions about your data, reach us through the contact page.

Two roles

Ripshop handles personal data in two roles, and this policy covers both:

• As controller, for the data of visitors to this site and of shop owners who have an account with us. That is what most of this page is about.
• As processor, for the data of buyers in the shops that run on Ripshop. There, the shop owner decides what happens with the data and is your first point of contact. What we do with that data is agreed with the shop owner in the data processing annex of our terms of service, summarized below.

Visitors of this site

When you visit ripshop.io we process:

• Server logs: your IP address, the time, the page you asked for, the response and your browser type. We keep these for ninety days at most, to keep the site secure and to fix faults.
• A session cookie and a security cookie, needed for forms and logging in. See the cookie page.
• Visit statistics, counted by ourselves on our own server, with no cookie of their own and no third party. For each page you open we store a hashed identifier of your session, the page, the site you came from, campaign tags in the address (utm_source, utm_medium, utm_campaign), whether you use a phone or a computer, your country and the time. Your country is looked up from your IP address in a database on our own server; the IP address itself is not stored. We also note when you view the pricing page, send the contact form or start a sign-up, together with the site you first came from. We use this only to see how the site is doing.
• Google Analytics and Google Ads, only with your consent. If you accept cookies in the banner, Google Analytics measures how you use the site (the pages you open, where you came from, your device and an identifier in a cookie) and Google Ads notes whether you came from one of our ads and whether you started a trial, and may show you our ads on other sites later (remarketing). Until you accept, neither runs. You can withdraw your consent at any time with "Cookie settings" at the bottom of every page.
• Where a sign-up came from: when you start a sign-up we keep the campaign tags in the address, the first page you opened and the site you came from. If you accepted cookies, we also keep the identifier of the ad you clicked and your Google Analytics identifier, so we can tell which ads bring shops to Ripshop; when the shop pays for the first time after its trial, we tell Google Analytics so under that identifier, with the plan and its price. When you start a trial with cookies accepted, Google Ads also receives your email address in hashed form (an unreadable code, not the address itself), so the trial can be matched to the ad you clicked even when its cookie is gone.
• What you send through the contact form: your name, email address, your shop's address if you give it, and the message. We keep it for twelve months so we can follow up, then delete it, unless it became part of a shop account.

The fonts on this site are loaded from Google Fonts, and Google Tag Manager is loaded from Google too; those requests share your IP address with Google, who use it only to serve the file.

The legal basis is our legitimate interest in running, securing and improving a website, and for the contact form, taking steps at your request before a contract. For Google Analytics, Google Ads and the ad identifiers kept with a sign-up, it is your consent.

Shop owners

If you open a shop on Ripshop we process:

• Sign-up: what you tell us when you start a shop at ripshop.io/start: your name and email address (confirmed with a code we mail you), your password (hashed), the shop's name and address, its country, language and currency, your company details, the games you sell, where you stream and sell today with links to those channels, whether you sell in person, a rough revenue band, the look and plan you pick, and the site you first came from. The questions about how you sell can be skipped. A sign-up that never becomes a shop is deleted after thirty days.
• Account details: your name, email address, password (hashed), your two-factor authentication (its secret stored encrypted), the shops you own, the people you invite, and your login history.
• Company details: trade name, address, registration and VAT numbers, the contact details you show in your shop.
• Billing: the plan you are on, your invoices (including the monthly commission invoice) and the status of your payments to us. For the commission invoice, Stripe and Mollie tell us what they withheld from your shop's payments. Subscriptions are billed through Stripe Billing: Stripe holds your payment method (a card, or a SEPA mandate when you pay with iDEAL or Bancontact) and we never see your card or bank details.
• Usage: what happens in your admin, in logs we use for security, support and to fix faults. Ninety days at most, except two records kept for a year: the platform's activity log (what was done on the platform and in your account; its IP addresses are removed after ninety days) and each shop's mail log (which mail went to whom, so the shop can see what its customers were sent).
• Connected sales channels: when you connect TikTok Shop, the access tokens TikTok gives us (stored encrypted) and your TikTok shop's name, region and seller details. They are deleted when you disconnect.
• Support and feature requests: what you write to us through Support in your Ripshop account or by email, for as long as needed to help you and to see what was agreed; and the feature requests you send and the ones you vote for. A request is shown on the public roadmap without your name, so keep personal details out of it.

The legal bases are the contract we have with you, or the steps before it while you sign up; our legal duties (invoicing, tax records); and our legitimate interest in keeping the platform secure and improving it.

We send you email about your shop: invoices, payment and trial reminders, security notices, tips while you set up your shop in its first week, and changes to the service and these terms. We do not send marketing mail unless you asked for it, and you can opt out of that at any time.

Buyers in a shop

If you buy in a shop that runs on Ripshop, the shop owner is the controller of your data. They decide what is collected and why, and their privacy policy applies. Ripshop hosts and processes that data on their behalf: your name, address, email, phone number, orders, payment status, what you keep in storage, and the account you may create.

A shop also counts its visitors the same way this site does: a hashed session identifier, the page, the site you came from, campaign tags, device type, country (the IP address is not stored) and the time. It does not record who you are, even when you are signed in. Those statistics are only shown to the shop owner.

If you bought through TikTok Shop from a shop that connected TikTok Shop to Ripshop, TikTok passes your order to that shop through us: your name, delivery address and phone number, what you bought and paid, and a TikTok buyer number that lets the shop see your earlier orders with it. TikTok gives no email address we may write to, and you get no mail from Ripshop. On the shop's behalf we send TikTok the tracking number and carrier of your parcel, and the shop's answers to your cancellation or return requests. What you share with TikTok itself is covered by TikTok's privacy policy.

A shop owner can add Google Analytics, the Meta pixel, the TikTok pixel or the Snapchat pixel to their shop. These load only after you accept them in the shop's consent banner, and the shop owner is responsible for them.

We use buyer data only to run the shop for its owner: showing your orders, sending the shop's order mails, producing shipping labels and invoices, and supporting the shop owner. We do not use buyer data for our own purposes and never for advertising.

For questions or requests about your data, contact the shop. If you cannot reach them, contact us and we will help.

Who receives data

We share data only with the parties we need to run the service, under a contract that binds them to confidentiality and security:

• DigitalOcean: hosting and backups, on servers in Amsterdam, the Netherlands.
• Ploi: manages our servers, and so has access to them.
• Resend: delivers our mail and the mail the shops send.
• Sentry: tells us when something in the software goes wrong, from servers in the European Union. A report says where the error happened, such as a web address or an order number; we send it no form contents.
• Stripe: bills shop owners' subscriptions and commission invoices; and, for a shop that connects Stripe, handles its buyers' payments under the shop owner's own contract.
• Mollie: for a shop that connects Mollie, handles its buyers' payments under the shop owner's own contract.
• MyParcel and Sendcloud, and the carriers behind them: the name, address and contact details on a shipping label, for a shop that connects one of them.
• CardSight: recognizes a card from the photo a shop takes of it. The photo shows a card; we send no personal data with it.
• TCGdex and tcggo: card information and prices. We only fetch from them; no personal data is sent.
• Google and Twitch: only when a shop turns on signing in with them and a buyer chooses it, and then only the name and email address they share.
• TikTok: for a shop that connects TikTok Shop, under the shop owner's own contract with TikTok. TikTok sends us the shop's TikTok orders; we send TikTok the tracking number and carrier of each of them, the products the shop sells there (title, description, photos, stock and price) with the company details TikTok asks of a seller, and the shop's answers to cancellations and returns.
• Google (Google Analytics, Google Ads, Google Tag Manager): for visitors of this site who accept cookies, as described above. Google Ireland Limited acts for the European Union; Google is certified under the EU-US Data Privacy Framework.
• Discord: for a shop that connects its Discord server, posts about going live, new products and events go to that server. They contain no buyer data.

We do not sell data and do not share it for third-party marketing. We disclose data to authorities only when the law obliges us to.

Transfers outside the EU

Data is stored in the European Union. Where a provider we use processes data outside the EU, we rely on an adequacy decision or on standard contractual clauses, and on additional measures where needed.

How long we keep data

Security

Connections are encrypted (TLS), passwords are hashed, secrets such as payment keys are stored encrypted, access is limited to people who need it, and we apply security updates promptly. No system is perfect; if a breach affects you, we tell you and, where required, the data protection authority.

Your rights

You can ask us for access to your data, to correct it, to delete it, to limit its use, to receive it in a usable format, and to object to processing based on our legitimate interest. Mail us and we respond within a month. Shop owners can see and change most of their data in the admin themselves.

If you are unhappy with how we handle your data, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in your own country.

Children

Ripshop is for businesses. Shops on Ripshop decide their own age policy; some products they sell may not be suitable for minors, and the shop owner is responsible for that.

Changes

We update this policy when the service or the law changes. The version and date at the top tell you which one applies. A material change is announced to shop owners by email.