Last updated October 9, 2026
Privacy policy
Store Social Login provides Google and email-code sign-in for participating BigCommerce stores. This policy explains how the app handles information when merchants configure it and shoppers use it.
Information used for sign-in
A shopper can sign in to a participating store in two ways, or use the store’s own sign-in instead. With Google, and with your authorization, Google provides your account identifier, verified email address, and available first and last name. We use this information to verify your identity, create a customer account when appropriate, or sign you into a previously connected account in the participating store. With an emailed code, you type your email address, we send a six-digit code to it, and you type the code back, which shows that the address is yours. We do not receive your Google password, and we do not request access to your Gmail, Google Drive, contacts, or payment information. When you type an address into a store’s sign-in or create-account form, the app checks with the store whether an account has that address; the address is hashed before it reaches our backend and is not logged.
What we store
The app stores a connection between your sign-in identity and the store’s BigCommerce customer ID. Identity identifiers and email addresses used for matching are stored as hashes. Temporary sign-in records contain security values, timestamps, and, when a name is still needed, encrypted profile details. For an emailed code, the app stores a keyed hash of the code, never the code itself. The email that carries the code, which contains your address and the code, is sent through an email delivery provider; our backend keeps a copy in its email log and deletes it seven days after sending, and the provider keeps its own copy of the message and its delivery log for 30 days, in the United States, with backups for seven days more. The store retains customer names, email addresses, orders, and other customer records in BigCommerce. For merchants, we store the store identifier, installation permissions, an encrypted BigCommerce access token, settings, and the identifiers and temporary sessions needed to verify authorized staff access. We also keep per-store, per-day counts of sign-ins by method and of where on the storefront sign-in was offered; these contain no shopper data. To limit abuse, a visitor’s IP address is combined with a secret key into a hash that rate-limits requests, and the address itself is not stored by the app. Service infrastructure may process IP addresses and request metadata for operation, troubleshooting, and abuse prevention.
Past guest orders
If the merchant has switched it on (it is on by default) and has granted the app permission to modify orders, then after a verified sign-in the app asks the store for its most recent orders (up to fifty) under the verified email address and moves the ones placed as a guest, or under a customer the store has since deleted, to your account. This is the same change a merchant can make by hand in the control panel. It does not move an order that belongs to another account, and the app does not keep a copy of any order.
Sharing and service providers
Google handles Google authentication. Customer information is shared with the participating merchant’s BigCommerce store to provide account access. Vercel hosts the application, Convex provides its backend data storage, and an email delivery provider sends the email that carries the code. These providers process information to operate the service. We do not sell shopper data, including Google user data, use it for advertising, or use it to train AI models.
Cookies, browser storage and retention
A temporary, secure sign-in cookie binds a Google sign-in attempt to your browser and expires after ten minutes. An emailed code is tied to the page that asked for it by a random token kept in that page’s memory, not in a cookie, and the app keeps only a hash of it; reloading the page means asking for a new code. The storefront script may keep the address you typed in your browser’s session storage for the same tab, so the next page can fill it in, and removes it once it is used. The merchant dashboard uses no cookies or browser storage. Sign-in attempts and codes expire after ten minutes (a verified code stays usable for a further ten minutes so a new customer can add a name) and are removed by a scheduled cleanup. Account connections are retained to support later sign-ins until disconnected or removed in response to a verified request. When a merchant uninstalls the app, its settings and access token are removed at once and its shoppers’ connections are kept for 30 days, so a reinstall finds them, and then deleted. Uninstalling or disabling the app prevents new app sign-ins; it does not delete the merchant’s BigCommerce customer records. Infrastructure logs and backups follow the providers’ retention processes.
Your choices and requests
You may use the store’s ordinary sign-in instead, cancel Google authorization, or remove this app’s access from your Google Account. You can disconnect Google on the account page of the store, which asks you to create a store password first and removes the app’s connection. Removing Google authorization does not itself delete a store account or the app’s account connection. Contact the merchant about its customer records. For access, correction, disconnection, or deletion requests concerning this app, including a request to delete a sign-in email from our email provider’s records, contact support@storesociallogin.com. We may need to verify your identity and the relevant store before acting.
Contact and changes
Store Social Login support: support@storesociallogin.com. Updates to this policy will appear here with a revised date. A participating store’s privacy policy separately governs its customer accounts, purchases, and marketing.