Privacy Policy

Version 2026-09-13 · Last updated 13 September 2026

This explains what CAJA305 holds, why, where it lives and who can reach it. It is about the data of the business that runs a store here. If you are a shopper who signed up for a store's loyalty programme, the shop you signed up with has its own notice, and the shop — not us — decides what it does with your details.

1 Two different roles

For the account of the business — the owner's email, the users of the store and what they do in the system — we decide what to hold and we are responsible for it.

For everything the store puts inside CAJA305 — its catalogue, its sales, its customers — the store decides, and we only hold and process it on the store's instructions. If you are a customer of a shop that uses CAJA305, ask the shop.

2 What we hold

• To open and run the account: the store's name and address, the country and time zone, the email of whoever created it, and the usernames, emails and roles of the people who work there.
• To keep it safe: sign-in attempts with their date, the IP address they came from and whether they worked; and a log of what each person changes inside the store.
• Because the store put it there: products, costs and prices, movements, sales, shifts, vendors, purchase orders, documents, payroll, and the customers the store chooses to keep, with the contact details it asks them for.
• When you write to us: your message and the address you wrote from.

We do not ask for card numbers, and we do not hold any: the service is free today, and when it stops being free, payments will be taken by a payment company, not by us.

3 Why we hold it

• To give you the service you asked for, which is the whole of it.
• To keep it secure: to spot an attack, to limit sign-in attempts, and to be able to tell you who changed what and when.
• To answer you when you ask for help.
• To meet an obligation the law puts on us.

We do not profile you, we do not sell anything to anyone, and we do not use your business data to train any model.

4 Where it lives

On a server we rent in the United States from Hostinger. The nightly backups go to a second machine, also in the United States, of the same provider. Every store has its own space in the database, so one store's query cannot reach another's data.

5 Who else touches it

• Hostinger, which runs the servers where the service and the backups live.
• The email provider we use to send password links, receipts and notices.
• A text-message gateway, only if the store turns it on and only for the messages the store sends.
• Us: a small team. Reading a store to support it is logged, and writing needs the store owner to grant permission from their own Settings, with an expiry date.

Nobody else. We do not share it with advertisers, data brokers or analytics companies.

6 How we protect it

• Everything travels encrypted (HTTPS), and the site asks browsers to refuse anything else.
• Passwords are stored hashed. We cannot read yours, and we never will: to help you we send you a link to set a new one.
• Sign-in attempts are limited, so guessing a password by brute force does not work.
• The service does not run as the machine's administrator, and the database password lives in one file that only the service can read.
• Backups every night, kept off the main server, and tested by actually restoring them.

7 How long we keep it

• Your store's data, for as long as the store is open.
• When you close it: 30 days marked for deletion, then purged for good.
• Backups: up to 60 days for the database and 14 days for files, after which they rotate out on their own.
• Security and change logs: long enough to be useful for an investigation, and archived after that.

8 Your rights

You can ask us to show you what we hold about your account, to correct it, to export it, or to delete it. The export is a normal part of the service, not a favour: ask and you get it. Write to us with the address of your store and we will answer.

If you are a shopper and you want a shop to correct or delete your details, ask the shop: it is the one that decides. We will help the shop do it.

9 Text messages

CAJA305 can send text messages on behalf of a shop: sign-in verification codes to its staff, purchase receipts to a customer who asked for one, purchase orders to a vendor, and offers to customers who joined the shop's loyalty programme and ticked a separate box agreeing to receive them. The date and time of that consent is recorded against the customer, and it is what authorises any later message.

Anyone can stop them by replying STOP to any message, or by asking the shop. Replying HELP gives help. Message and data rates may apply.

We do not sell mobile numbers, and consent to receive text messages is never shared with third parties or affiliates for their own marketing. A number is passed only to the carrier that delivers the message. The whole programme is described in our SMS Messaging Policy.

10 Cookies

CAJA305 uses the cookies it needs to work: one to keep you signed in and one to protect forms from being submitted from another site. There are no advertising or tracking cookies, and no third-party analytics.

11 Changes

If this policy changes we publish the new version here with a new date and tell you by email before it takes effect.

12 Getting in touch

Write to the address on your CAJA305 welcome email, with the address of your store (yourstore.caja305.com).