Stallkeep / Trust centre
Trust centre
How we look after your shop and your customers' information. Last updated 9 October 2026.
Security
- HTTPS everywhere. Stallkeep's websites, back office and shop sign-in are served over an encrypted connection.
- Passwords are never readable. They are stored scrambled, so not even our team can see them.
- Keys and secrets are encrypted where they are stored, and are never written to our logs or activity records.
- Two-step sign-in. Stallkeep's own team must use an authenticator app. Shop owners and staff can switch it on for their accounts.
- Card details never reach us. Card payments are handled by Stripe and PayPal.
- Least access. Shop staff see only their own shop, and only what their role allows. Only Stallkeep's owners can change platform settings; other team roles see only what their job needs.
- A record that can't be rewritten. Issued invoices, stock movements and the activity log only ever have things added; a correction is a new entry, so history can't be quietly changed.
- Spam and abuse protection on every public form.
Report a security problem
If you think you have found a weakness in Stallkeep, please tell us before telling anyone else. We will read every report. Our contact details are in security.txt, or email [email protected]. Please don't access other people's data, and give us a reasonable time to fix the problem before you share it.
Data protection
- UK GDPR. For shop owners' and staff account details, Stallkeep decides how the data is used (the controller). For a shop's customers, the shop decides, and Stallkeep stores and processes the data on the shop's behalf and on its instructions (the processor).
- Data processing agreement. Sellers who need a written data processing agreement for the customer data we hold for them can ask at [email protected].
- Keeping data. Account details and the activity log are kept while the account is open. Financial records such as orders and invoices are kept for six years, as UK tax law requires. Server logs are kept for a short time.
- Deleting data. You can ask us to delete your account details by emailing [email protected]. When a shop closes, we delete its records once any period the law requires us to keep them has passed. If your details are held for a shop, we pass your request to that shop and help it answer.
- Our privacy notice has the full detail, including your rights and how to complain to the Information Commissioner's Office.
Sub-processors
These companies handle personal data for us to run Stallkeep. Each gets only what it needs for its job. Some are outside the UK, mainly in the US; where that happens, the transfer is covered by the UK's adequacy rules or by standard contract clauses approved for UK data.
| Company | What it does for us | Data involved |
|---|---|---|
| IONOS | Hosting the website and databases | Everything held in the service |
| Cloudflare | Delivering pages securely and quickly, and the "I'm not a robot" check on some forms | Visitors' IP addresses and requests |
| Brevo | Sending emails | Recipients' names and email addresses, and the email content |
| Stripe | Taking card payments and Stallkeep's own billing | Payment and billing details (card numbers go to Stripe and never reach Stallkeep) |
| PayPal | Taking PayPal payments | Payment details (these go to PayPal and never reach Stallkeep) |
| Anthropic, Google and OpenAI | AI tools, only when a shop uses one, such as drafting a reply to a customer message | What the tool needs to do its job |
Couriers, marketplaces and other services a shop connects itself (for example Royal Mail, Parcel2Go, Etsy or eBay) are the shop's own choice and receive data under the shop's agreement with them.
Responsible AI
- AI suggests, you decide. AI tools in Stallkeep draft and suggest. The shop owner reads, edits and approves before anything is published or sent.
- Customer data goes only to approved providers. Some AI tools never receive customer details at all.
- AI is optional. AI tools only run when someone in the shop chooses to use one. A shop can work without them.
- Business services only. We use AI providers' paid business services, not their free consumer apps.
Accessibility statement
We want everyone to be able to use the Stallkeep website, including people who use screen readers, keyboards, voice control or magnification. We aim to meet the Web Content Accessibility Guidelines (WCAG) 2.2 at level AA on these public pages. They use headings, landmarks and labelled forms, work with a keyboard, have visible focus, and reflow on small screens.
These pages have not yet had an independent accessibility audit. The shop back office is a larger product and may not meet every guideline yet; we are improving it as we go.
If you find something you can't use, or you need information in another format, email [email protected] and we will get back to you. If you are not happy with our reply, you can contact the Equality Advisory and Support Service.
This statement was prepared on 9 October 2026.
Company
- Trading name
- Stallkeep
- Legal name
- Design Studio Lab Ltd
- Company number
- 11222280
- Registered office
- 2 Damara Way, Ashford TN25 7FD
- [email protected]