Front Store

Front Store · v1

Privacy notice for creators

Who is responsible

The controller of creators' personal data is:

Company name
Black Fenix Korlátolt Felelősségű Társaság (Black Fenix Kft.)
Legal form
Limited liability company (korlátolt felelősségű társaság)
Registered seat and postal address
1023 Budapest, Lajos utca 35., Hungary
Email
contact@front.store
Company registration number
01-09-471036, Company Registry Court of the Budapest-Capital Regional Court (Fővárosi Törvényszék Cégbírósága)
Tax number
33138042-2-41
Founded
2 October 2026

We have not appointed a Data Protection Officer. Write to contact@front.store with any question about your data.

This notice covers a Front Store creator account, on the website and in the creator app. Shoppers are covered by the Privacy notice for shoppers and brands by the Brand privacy notice.

What we process, why and for how long

Where we name a GDPR article, we mean the EU GDPR and, for people in the United Kingdom, the same article of the UK GDPR.

When you sign in with Google or Apple

Creators can create and sign in to their Front Store account with their Google or Apple account. We ask Google only for basic sign-in access (your account ID, name and email address) and Apple for your name and email address. Of what they send, we keep:

We use what Google or Apple sends only to create your creator account and sign you in. When Google or Apple sign-in creates a new account, the name it sends becomes the starting public name on your storefront, which you can change. The email address is where we send your account notices, unless you have already confirmed another one. If you add Google or Apple sign-in to an existing account, we keep only the account ID. We never receive your Google or Apple password, and we keep no access token after you are signed in. This is needed to provide the account you asked for (GDPR Article 6(1)(b)).

We keep this data for as long as your account is open. When your account closes, we delete your Google or Apple account ID, your public name and your storefront's name one month later. Every email address on the account (including the one you sign in with) goes one month later too, or once we have paid you everything you are owed and any hold on your payouts has ended if that is later, and at the latest 12 months after it closes. You can ask us to delete any of it sooner by writing to contact@front.store; we delete it within one month, except what the law requires us to keep or we need for a legal claim or an open review of your account. If a sign-in fails, we keep a record of the attempt, which may include your Google or Apple account ID, for 90 days to find and fix the fault (GDPR Article 6(1)(f)). You can also remove our access in your Google Account or Apple ID settings; that stops future sign-ins but does not delete what we already hold.

We do not sell data received from Google or Apple, use it for advertising, or share it with anyone except the providers below who run the service on our behalf. Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you verify your TikTok, Instagram or YouTube account

Creators can verify that a TikTok, Instagram (professional accounts only) or YouTube account is theirs. These accounts cannot be used to sign in. We ask each for read-only access, use it only while you verify, and read only these fields:

Of what they send, we keep your account ID (for YouTube, your channel ID), your username or channel handle, and the link to your profile picture. For YouTube we also keep an encrypted Google refresh token, which lets us read your channel again. We do not keep your Google account ID or email address from YouTube, and we do not keep your followers, posts, videos or any other data from these accounts.

We use this to show your username or handle as verified on your storefront, where it also sets your storefront's web address if you do not have one yet. Your profile picture is shown on your storefront unless you upload your own. When your account has no public name yet, your TikTok or Instagram display name or name becomes the starting public name on your storefront, which you can change; a YouTube channel name is not used. We never receive your password, and apart from the YouTube refresh token we keep no access token after you have verified. This is needed to provide the account you asked for (GDPR Article 6(1)(b)).

We keep this data for as long as your account is open. When your account closes, we delete your YouTube data at once, and the rest, your public name and your storefront's name one month later. A storefront web address built from your YouTube handle is released at once, and any other one month later; anyone can then claim it, and old links to it may lead to their storefront. You can ask us to delete it sooner by writing to contact@front.store; we delete it within one month, except what the law requires us to keep or we need for a legal claim or an open review of your account. If a verification fails, we keep a record of the attempt, which may include your account ID, for 90 days to find and fix the fault (GDPR Article 6(1)(f)). You can also remove our access in your TikTok or Instagram settings; that does not delete what we already hold. We do not sell this data, use it for advertising, or share it with anyone except the providers below who run the service on our behalf, and YouTube data is covered by the Google API Services User Data Policy above.

Verifying with YouTube uses YouTube API Services, and by doing so you agree to be bound by the YouTube Terms of Service. The Google Privacy Policy covers what Google does with your data. You can remove our access at any time in your Google security settings. We read your channel again at least every 30 days to keep your handle and picture current. If we can no longer confirm the channel, we delete what we hold about it within 30 days and email you. That happens if you or Google end our access, if the channel or its handle is gone, if that access now leads to a different channel, or if we hold no access for it because you verified it before we began keeping one. Your storefronts stay live, but publishing and share links need a verified handle. When you disconnect the channel or close your account, we delete it and remove our access at Google straight away. If you ask us to delete your YouTube data, we do so within 7 days. Deleting what we hold does not affect data stored by YouTube; to delete that, use YouTube itself.

Verifying a TikTok, Instagram or YouTube account is your choice. You do not have to give us this data, but without it that account is not shown as verified on your storefront.

Each time you sign in

Whichever way you sign in, we record the sign-in method, when it happened, a short name for your browser and device read from your browser (such as "Safari on iPhone"), the country and region your connection comes from, and your IP address. We keep no more precise location. We use this to show you the devices signed in to your account, where needed to email you a code when a sign-in comes from a browser we do not know, and to spot accounts that may belong to the same person, which protects your account and prevents fraud (GDPR Article 6(1)(f)). We delete the IP address 12 months after the sign-in. We keep the rest for as long as your account is open. When a creator account closes, we delete the browser and device name and the country and region one month later, and keep only the sign-in method and time. You can ask us to delete it at any time by writing to contact@front.store.

Your profile and storefront

We keep your public name, your storefront's name and web address, any picture you upload, the products you choose to show, your settings and your acceptance of the creator agreement. When you set up your account you confirm your age; we keep only that the check passed, never your date of birth. This is needed to provide your account (GDPR Article 6(1)(b)).

Getting paid

To pay you we keep your legal name and either your PayPal address or your bank details and the account holder's postal address. Bank details are stored encrypted. We also keep the sales credited to you, what you earned and each payout. We use this to pay you and to meet our accounting duties (GDPR Article 6(1)(b) and (c)). You can use your account without giving us payout details, but we cannot pay you until you do.

Sales and payout records are kept for eight years after the end of the financial year they belong to, which is the period Hungarian accounting law requires, including after your account closes. One month after your account closes, or once we have paid you everything you are owed and any hold on your payouts has ended if that is later, and at the latest 12 months after it closes, we delete your PayPal address and bank details. Deleting them does not cancel what we owe you: if money is still due, write to contact@front.store and we will pay you. If we have ever sent you a payout, your legal name and the recipient details on that payout stay with those records. PayPal and Revolut keep their own records of payouts they made.

Notifications and error reports

We email you about your account and sales, and the creator app can send push notifications if you allow them, which you can turn off in your device settings (GDPR Article 6(1)(b)). When something breaks, an error report with credentials and query strings removed is sent to our error-reporting service, so we can find and fix the fault (GDPR Article 6(1)(f)).

Automated decisions

When a new creator account shares a sign-in IP address, a social handle, a PayPal address or a bank account with another account, or when too large a share of a creator's sales are returned, our system recommends pausing or reducing that creator's payouts. A member of our staff decides, and payouts continue until they do. Our system pauses payouts by itself when a payout detail you change matches another account, and when a payout to you fails or is reversed. Only a member of our staff can lift those pauses, after reviewing them. Payouts also pause for 48 hours after your payout details change or our support team resets your two-step sign-in, and then resume by themselves. A pause or reduction moves no money, closes no account and stops no sales, and what you have earned stays owed to you. We do this to prevent fraud and protect your account (GDPR Article 6(1)(f)). You can ask for a person to review any of these decisions, give your point of view and contest them, from your creator console or by writing to contact@front.store. We make no other decision about you solely by automated means.

Who we share your data with

Your data is stored on Amazon Web Services in the European Union, in the Frankfurt region. These providers process data on our behalf:

Amazon Web Services EMEA SARL (Luxembourg)
Hosting, database and backups in Frankfurt, Germany
Resend, Inc. (USA)
Email delivery
Functional Software, Inc., trading as Sentry (USA)
Error reports
Google LLC (USA), Firebase Cloud Messaging
Push notifications to the creator app
Grafana Labs (USA)
Service metrics, logs, traces and alerting
Slack Technologies, LLC (USA)
Alerts to our staff, which may name your storefront

When we pay you, PayPal or our payment provider Revolut receives the payout details it needs, as a financial institution responsible for its own processing. Your public name, handle and picture are public on your storefront. Brands whose products you carry see you by a code, never by name, with your niches, country and months active. Once you have sold 3 or more of a brand's units, that brand also sees how many you sold and a range for how many were returned. We share data with authorities, courts or professional advisers where the law requires it or we need to establish, exercise or defend a legal claim. We do not sell personal data.

International transfers

Providers in the United States are covered by the EU–US Data Privacy Framework, and its UK Extension for data about people in the United Kingdom, where the provider is certified under it, and otherwise by the European Commission's Standard Contractual Clauses, with the UK Addendum for data about people in the United Kingdom. You can ask for a copy by writing to contact@front.store.

How long we keep your data

How to delete your data explains how to close your account or ask us to delete your data, and what we have to keep.

How we protect your data

Connections to Front Store use HTTPS, and our database and backups are encrypted. Bank details have their own encryption on top of that. We never receive your Google, Apple, TikTok, Instagram or YouTube password, and apart from an encrypted YouTube refresh token we keep no access token after you have signed in or verified. No system is perfectly secure; if a breach puts your data at risk, we tell you and the authority as the law requires.

Cookies

The Cookies page lists every cookie we use and why.

Your rights

You can ask us for access to your personal data, and for its correction, erasure or restriction, or object to its processing, and where it applies ask for it in a portable form. Write to contact@front.store. We answer within one month.

Your right to object

Where we rely on our legitimate interests (GDPR Article 6(1)(f)), such as keeping the website and your account secure, preventing fraud and answering you, you can object at any time on grounds relating to your particular situation. We then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend a legal claim.

Complaints

Please write to contact@front.store first, so we can try to put it right. You can also complain to the data protection authority of the country where you live or work, or where you think the breach happened, or go to court. In the United Kingdom that is the Information Commissioner's Office (Wycliffe House, Water Lane, Wilmslow SK9 5AF, 0303 123 1113, ico.org.uk). In Hungary, where we are based, the authority is:

Authority
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address
1055 Budapest, Falk Miksa utca 9-11.; postal: 1363 Budapest, Pf. 9.
Contact
+36 1 391 1400, ugyfelszolgalat@naih.hu, naih.hu

Children

Creator accounts are for people aged 18 or over. When you set up your account you confirm this, or give a date of birth that shows it, and we do not accept a younger age. We do not knowingly collect personal data from children; if you think a child has given us data, write to contact@front.store.

Changes to this notice

When we change this notice, we update its version. If a change materially affects how we use your data, we tell you by email.

How to contact us

Write to contact@front.store with any privacy question or complaint. Our postal address is under “Who is responsible” above.

Back to Front Store