stallee

HOW INFORMATION IS HANDLED

Privacy Policy

This policy explains what personal information Stallee handles, why we need it, who we share it with, and the choices available to you.

Effective and last updated 5 October 2026

1. Scope and who we are

Congruent Labs Pty Ltd, trading as Stallee (“Stallee”, “we”, “us” and “our”), is an Australian company providing software for independent retailers and market stallholders. This Privacy Policy applies to personal information handled by Stallee when you visit our websites, create or use a merchant account, contact us, buy from a Stallee-hosted shop, or interact with a supported integration.

Stallee merchants are independent businesses. A merchant is responsible for its own customer relationship and privacy practices. When Stallee handles buyer information to provide a merchant’s storefront, order, inventory or communication tools, we generally do so to provide services to that merchant. The merchant’s own privacy notice may also apply. Third-party services linked from Stallee have their own privacy policies.

2. Personal information we collect

Depending on how you use Stallee, we may collect:

  • Account information: name, email address, sign-in and session information, roles and account preferences. If you add a passkey, we store its public key, credential ID, device type, sync status and any name you provide. We do not receive or store your fingerprint, face, other biometric data or passkey private key. Email sign-in remains available as a recovery option.
  • Merchant information: business name, contact and domain details, storefront content, products, inventory, locations, orders, fulfilment records and support communications.
  • Buyer and order information: name, email, delivery and billing details, order contents, status, transaction references and communications with the merchant. Payment providers process card details; Stallee does not intend to store full card numbers.
  • Integration information: provider account IDs, catalogue and inventory records, webhook events, connection status and authorisations for services such as Stripe or Square.
  • Technical information: IP address, device and browser details, timestamps, requested pages, security events, cookies and similar identifiers, performance information and diagnostic logs.

We do not ask you to provide sensitive information through ordinary Service use. Please do not upload sensitive information unless it is necessary, lawful and supported by the relevant Stallee feature.

3. How we collect information

We collect personal information:

  • directly from you when you register, configure or contact us;
  • from merchants when they operate a shop, record an order or assist a buyer;
  • from buyers when they browse, place an order or communicate through a storefront;
  • from connected providers such as Stripe, Square, Cloudflare and Resend; and
  • automatically when browsers and systems communicate with the Service.

You may browse general marketing pages without identifying yourself, but we need certain information to create an account, process an order, provide support or perform requested features.

4. Why we handle personal information

We use and disclose personal information where reasonably needed to:

  • provide, personalise, maintain and support the Service;
  • authenticate users, manage accounts, subscriptions and custom domains;
  • operate storefronts and help merchants process, fulfil and reconcile orders and inventory;
  • deliver transactional messages such as sign-in and order emails;
  • connect services a merchant chooses, including Stripe and Square;
  • secure Stallee, prevent fraud and abuse, troubleshoot problems and enforce our Terms;
  • understand performance and improve our products using aggregated or appropriately de-identified information; and
  • meet legal, accounting and regulatory obligations.

We do not sell personal information. We do not use merchant buyer data to independently market Stallee to those buyers. We only send commercial marketing where we have the consent or other permission required by law, and our marketing messages will provide a practical way to unsubscribe.

5. Who receives personal information

We may disclose relevant information to:

  • the merchant involved in a buyer’s order and authorised members of that merchant’s workspace;
  • service providers that host, secure, communicate, analyse or support Stallee, including Cloudflare and Resend;
  • payment and commerce providers such as Stripe and, when a merchant connects it, Square;
  • professional advisers, auditors and insurers under appropriate confidentiality obligations;
  • regulators, courts, law enforcement or other parties where required or authorised by law, or reasonably necessary to protect people, rights and systems; and
  • a genuine prospective purchaser or successor in a merger, restructure or sale, subject to appropriate safeguards.

We limit providers to the information reasonably needed for their role and expect them to protect it. Their handling of information may also be governed by their own terms and privacy policies.

6. Overseas handling

Stallee is operated in Australia, but our service providers operate internationally. Personal information may be processed in the United States and in other countries where Cloudflare, Resend, Stripe, Square or their approved subprocessors operate. The exact location can depend on network routing, the feature used and a provider’s current subprocessor arrangements.

Where Australian privacy law applies to an overseas disclosure, we take reasonable steps appropriate to the circumstances to protect the information. You can contact us for current information about the providers relevant to your use of Stallee.

7. Cookies and analytics

Stallee uses essential cookies and similar browser storage to maintain secure sessions, prevent request forgery and remember necessary settings. We may use Cloudflare security, performance and web analytics services to understand traffic and keep the Service reliable. Browser settings can restrict cookies, but blocking essential storage may stop account and checkout features from working.

8. Security and data retention

We use technical and organisational safeguards designed for the nature of the information and the risks involved. These include encrypted transport, access controls, tenant separation, limited provider access, security logging and recovery practices. No online service can promise absolute security, so please tell us promptly if you believe your account or information has been compromised.

We retain information for as long as reasonably needed to provide the Service, maintain legitimate business and security records, resolve disputes, and meet tax, accounting and legal requirements. Retention periods vary by record type. When information is no longer required, we take reasonable steps to delete or de-identify it, subject to backups and legal obligations.

9. Access, correction and account choices

You can update some information through your account. To ask for access to, or correction of, personal information Stallee holds about you, email hello@stallee.xyz. We may need to verify your identity. We will respond within a reasonable period and explain any lawful reason we cannot fulfil a request.

If your request concerns information held for a particular merchant, we may refer the request to that merchant or assist it in responding. You can opt out of Stallee marketing through the message’s unsubscribe option or by contacting us. Service and transactional communications may still be necessary while your account remains active.

10. Privacy questions and complaints

Send privacy questions or complaints to hello@stallee.xyz. Please describe the issue and how we can contact you. We will acknowledge the complaint, investigate it fairly and aim to respond within 30 days. If you are not satisfied, you may be able to complain to the Office of the Australian Information Commissioner at oaic.gov.au.

11. Children

Merchant accounts are for adults and authorised business representatives. Stallee is not directed to children and we do not knowingly invite children to create merchant accounts. Merchants are responsible for ensuring that their products and collection practices are appropriate for their customers.

12. Changes to this policy

We may update this policy when our services or legal obligations change. We will publish the current version and its effective date. We will provide additional notice where a change materially affects how we handle personal information.

13. Contact

Privacy and general enquiries: hello@stallee.xyz