Privacy policy
Two layers: this website and the Mistok instance that runs for a store. In the self-hosted setup all buyer data lives on the store’s own server and we never see it. In managed hosting we act as a processor on the store’s behalf.
1. Who is who
| Role | Self-hosted | Managed hosting |
|---|---|---|
| Controller of buyer data | the store | the store |
| Processor | none — the store’s own server | [PROVIDER NAME] under contract with the store |
| Controller of this website’s visitor data | [PROVIDER NAME] | |
2. What a Mistok instance stores
Mistok keeps the minimum needed to match a payment to an order and to show the owner where buyers drop off.
| Data | Purpose | Source |
|---|---|---|
| Shopify order id and number, amount, currency, status | create the PSP invoice, verify the webhook, mark the order paid | Shopify webhook |
| Buyer email and phone | unpaid-order reminders, receipt delivery, anti-fraud rules for cash on delivery | Shopify |
| Shipping country, region, city | geography analytics and prepayment rules | Shopify (shipping address, no street) |
| Device type, browser, IP at the moment of clicking “Pay” | drop-off analytics, abuse protection for payment links | HTTP request to /pay/:id |
| PSP invoice and transaction ids, card mask (if the PSP returns one) | refunds, cancellations, reconciliation | PSP APIs and webhooks |
| Fiscal receipt links (mono PRRO, Checkbox) | show the receipt to the buyer, keep it for reporting | fiscalisation API |
| Administrator action log | audit: who changed settings or issued a refund | Mistok admin |
What Mistok does not store: full card numbers, CVV, bank login data. Payment happens on the PSP’s page (SAQ A); the Mistok server never renders a card form.
3. Where the data lives
- Self-hosted: in a SQLite file on the store’s server (
data/mistok.db) and in backups the store configures. Nothing is sent to the Mistok developers — there is no telemetry. - Managed hosting: on a [PROVIDER NAME] server in [COUNTRY/DATA CENTER], encrypted disk, access restricted to the Provider’s administrators via SSH keys.
4. What this website collects
The site is static. We use no analytics counters, advertising pixels or tracking cookies. The web server keeps standard logs (IP, time, URL, user agent) for up to [30] days for security and diagnostics.
The Mistok admin sets one cookie — the interface language — and a session cookie after sign-in. The request form forwards what you enter to the team’s Telegram; we use it only to answer your request.
5. Third parties
Data goes only to services the store itself has enabled in the instance settings:
| Recipient | What it receives | Basis |
|---|---|---|
| PSPs (monobank, LiqPay, WayForPay, NovaPay, Przelewy24, PayU, Stripe and others) | amount, currency, order number, buyer email/phone where required | the store’s contract with the PSP |
| Shopify | payment status, tags, order notes | the store’s contract with Shopify |
| Fiscalisation (mono PRRO, Checkbox) | order lines, amount, buyer email for the receipt | fiscal legislation |
| Telegram | owner notifications: order number, amount, status | store settings |
| SMS/email gateways, CRMs (KeyCRM, SalesDrive, Zapier and others) | order data via the signed outgoing webhook | store settings |
Each of these services processes data under its own policy. The store is responsible for having a legal basis for the transfer.
6. Retention
| Data | Period |
|---|---|
| Orders, payments, receipts | while the store uses the instance; deleted with the database or at the store’s request |
| Audit log and webhook events | 365 days, then automatic clean-up |
| Backups (managed hosting) | 14 days, rotated daily |
| Website server logs | up to [30] days |
| Form requests | until the request is closed, no longer than [12] months |
7. Data-subject rights
Buyers have the rights set out in the Law of Ukraine “On Personal Data Protection” No. 2297-VI and, for buyers in the EU, in the GDPR: access, rectification, erasure, restriction of processing, objection, portability, withdrawal of consent and a complaint to a supervisory authority (in Ukraine — the Ukrainian Parliament Commissioner for Human Rights).
Requests should be addressed to the store as the controller. In managed hosting [PROVIDER NAME] helps the store fulfil a request within [10] business days. Mistok has built-in tools to export and delete a buyer’s data by email or phone number.
8. Security
Webhook signatures are verified for every PSP, payment status is re-read from the API rather than trusted from the webhook, the admin has roles and an action log, secrets live in environment variables. Details on the Security page.
9. Contact and changes
Questions about this policy: [EMAIL] · [TELEGRAM]. Changes are published on this page with the version date; material changes are additionally communicated to managed-hosting clients.
See also the public offer.