Privacy policy

Who controls your information

CodeCasa Studios Ltd operates Powered by Casa and Casa Commerce. For questions about this policy or your personal data, email hello@codecasastudios.com.

A merchant is normally responsible for the customer information collected through their own storefront. Casa processes that information to provide the platform to the merchant.

Information we collect

• account details such as your name, email address, and password hash;
• store, business, domain contact, and payment-onboarding information;
• products, orders, customer records, delivery details, and store content;
• subscription, transaction, refund, and payout references;
• support messages and communications with Casa; and
• technical information such as browser, device, IP, and security logs.

Casa does not store complete payment card numbers or card security codes. Card information is handled by the payment provider through its secure payment interfaces.

How we use information

We use personal data to:

• create accounts, host stores, and provide requested features;
• process subscriptions, payments, domains, postage, and refunds;
• authenticate users and protect Casa against fraud and abuse;
• send service messages and respond to support requests;
• meet legal, tax, accounting, and regulatory obligations; and
• understand and improve the Powered by Casa marketing and signup experience.

We rely on performance of our contract, legal obligations, legitimate interests in operating and securing Casa, and consent where required.

Cookies and optional tracking

Essential storage is used for sign-in, security, and checkout. The Google tag uses denied storage by default on the Powered by Casa marketing and signup experience. Google Analytics and the Meta Pixel are enabled only after you choose Allow optional tracking. They help Casa measure interest, signups, and successful store subscriptions. These tags are not loaded by Casa on merchant storefronts.

You can change your choice by clearing site data for poweredbycasa.com and selecting a new preference when the notice appears again. Browser settings can also block or remove cookies.

Who receives information

We share only the information needed with service providers that help us deliver Casa, including hosting and database providers, payment providers, email delivery services, domain registries, shipping platforms and carriers, and fraud or identity-verification services. We may also disclose information where required by law or to protect users, Casa, or the public.

We do not sell personal information.

International transfers and security

Some providers may process information outside the UK. Where required, we use recognised safeguards or rely on an applicable adequacy decision. We use access controls, encrypted connections, protected credentials, and operational monitoring to reduce risk. No online service can guarantee absolute security.

Retention

We keep information only for as long as needed to provide Casa, maintain transaction and security records, resolve disputes, and meet legal obligations. Retention periods differ by record type. Some transaction records must be retained after an account closes.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data, and to withdraw consent. Email us to make a request. We may need to verify your identity first.

UK users can also complain to the Information Commissioner's Office at ico.org.uk.