Data Deletion

Last updated: 16 May 2026

Astrocart Ltd ("Astrocart", "we", "us") respects your right to have your personal data deleted from our systems. This page describes how to request deletion, which categories of data we can remove, and how long the process takes.

Who this page is for

  • Merchants — businesses running a storefront on Astrocart.
  • Staff users — team members invited by a merchant to access an Astrocart admin.
  • End customers — shoppers who created an account on, or placed an order through, a merchant's storefront.
  • Connected third-party accounts — anyone who connected a Meta, Google, TikTok or similar account to a merchant's Astrocart store.

How to request deletion

If you are an end customer of a merchant's store

Contact the merchant directly first — they are the data controller for your purchase history, addresses, and account on their storefront. They can delete or anonymise your account from their Astrocart admin. If you cannot reach the merchant, or believe they have not honoured your request within 30 days, email us at [email protected] and we will escalate.

If you are a merchant or merchant staff user

Self-serve in the Astrocart admin:

  • To close your store and delete all merchant data: Admin → Settings → Account → Close Store.
  • To remove a staff user: Admin → Settings → Staff → remove the team member.

Alternatively, email [email protected] from the email address registered on your account, requesting deletion. Include your store subdomain so we can identify the right account.

If you connected a third-party account (Meta, Google, TikTok, etc.)

Disconnect inside the Astrocart admin (Marketing → Channels → Disconnect) and we will purge the stored OAuth tokens and any cached profile data within 7 days. To additionally revoke our access from the third-party side, follow the platform's instructions:

  • Meta (Facebook / Instagram): facebook.com/settings → Business Integrations → remove "Astrocart Connect".
  • Google: myaccount.google.com → Security → Third-party apps with account access → remove "Astrocart".
  • TikTok: tiktok.com → Settings → Manage account → Authorized apps → remove "Astrocart".

What we delete

On a deletion request we remove or irreversibly anonymise:

  • Your name, email address, phone number, and any other contact details.
  • Your account credentials (password hash, recovery tokens).
  • Your stored addresses, payment-method references (the actual card data lives with our payment processor — see below), and order history association.
  • Any uploaded files or images you contributed.
  • Any third-party OAuth tokens (Meta, Google, TikTok) we hold on your behalf.
  • Any consent records (cookie consent, marketing opt-ins).

What we retain (and why)

We retain the following minimum-necessary records, anonymised or pseudonymised where possible, to meet our legal obligations:

  • Financial records (orders, invoices, tax records): retained for 6 years under UK HMRC rules. Linked to a pseudonymous customer ID rather than your name and contact details.
  • Fraud-prevention signals: hashed identifiers may be retained where required for chargeback defence.
  • Anonymised analytics: aggregated statistics (visit counts, conversion rates) that cannot be tied back to you.

Third-party processors

Some of your data is processed by our subprocessors. Deletion in Astrocart triggers deletion at those processors where applicable:

  • Stripe (payments) — card details and payment-method references. Stripe retains transaction records to meet card-network and regulatory obligations.
  • Mailjet (transactional + marketing email) — email addresses and send history.
  • Twilio (SMS) — phone numbers and send history.
  • Cloudflare R2 (storage) — any files you uploaded.
  • Google Cloud SQL (database hosting) — primary store; deletion in Astrocart removes the row.
  • Meilisearch (search) — product/customer search indexes; deletion in Astrocart purges the index entry.

Timeline

We complete deletion requests within 30 days of receipt, in line with UK GDPR Article 17 and EU GDPR. Most self-serve deletions complete immediately; email requests are typically processed within 7 business days.

How we confirm completion

When deletion is complete, we send a confirmation email to the address on the original request, listing the categories of data removed and the date of removal. The confirmation email is itself the last communication we send to that address; we do not retain it for marketing purposes.

Contact

Data Protection Officer: Anthony Pentland
Email: [email protected]
Postal: Astrocart Ltd, Thompson Yard, Middlesbrough, Cleveland TS3 8RQ, United Kingdom

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.