NewPlatformDTC is in public betaPlatformDTC is in public beta — sign up and finish with a real store, no waitlist.Read the announcement →

Privacy Policy

Updated September 28, 2026 — effective October 12, 2026. The changes dated September 28, 2026 (Section 1.4 and the DTCPay entries in Sections 3–5) take effect on October 12, 2026, 14 days after publication, as Section 10 promises for material changes; until then the September 11, 2026 version applies.

This Privacy Policy explains how Legalize Freedom LLC (dba PlatformDTC) ("PlatformDTC", "we", "our", or "us") collects, uses, and protects information about you when you use our website and platform at PlatformDTC.com (the "Service").

By using the Service, you agree to the practices described in this Privacy Policy.

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly when you create an account, use our services, or contact us. This includes:

  • Account information: name, email address, password, business name, business address
  • Payment information: billing details, processed securely via Stripe (we do not store full card numbers)
  • Identity verification information: for Brand Owners using payment features, we collect government-issued ID, tax identification numbers (SSN/EIN/ITIN), date of birth, and other Know Your Customer (KYC) information required by our payment processor and applicable law
  • Content: any text, images, videos, product information, customer lists, or other content you upload, generate, or process through the platform
  • Communications: support tickets, emails, and feedback you send us

1.2 Information Collected Automatically

  • IP address, browser type and version, device identifiers
  • Pages visited, features used, actions taken within the app
  • Referring URLs, timestamps, session duration
  • Cookies and similar tracking technologies (see Section 5)

1.3 Information from Third Parties

  • Payment and identity verification data from Stripe
  • Authentication data if you sign in via Google, Facebook, or other providers
  • Marketing performance data from connected ad platforms (Meta, Google, TikTok) that you authorize

1.4 DTCPay saved payment details

DTCPay saves shoppers' contact details, address and, where they type one in, their card, so they can check out faster on stores built on PlatformDTC that offer it. The full terms are at /legal/dtcpay.

  • What is saved: the email address, phone number and shipping address entered at checkout, whatever the payment method; and, only when you pay with a card typed in at checkout, that card. The card number is stored by our payment processor, Stripe; we keep only the card's brand, last 4 digits and expiry date. Apple Pay, Google Pay and PayPal are never saved. We also keep a record of each device where DTCPay remembers you (the checkout website address, browser, IP address, and first and last use).
  • Why: to fill in your details on your next purchase and, where a card is saved, let you pay with one tap. Every purchase still needs you to press Pay; DTCPay never charges you automatically.
  • Consent: at a checkout that offers DTCPay, the line "By paying, you agree to create a DTCPay account subject to DTCPay's Terms and Privacy Policy" is shown before the Pay button, for every payment method, with a Not now option. If you pay without choosing Not now, your DTCPay account is created automatically once the payment succeeds, with no code on that device, and a welcome email is sent with a "Didn't create this? Remove it" link. If your email address already has a DTCPay account, a card is added only from a device that account recognises. A new device needs a 6-digit code or a passkey before saved details are shown. We record each consent with its time, IP address, browser and the version of the consent text shown to you (currently dtcpay-consent-2026-09-28-auto).
  • Order tracking in the DTCPay app: after paying, you can choose Get the app to track that order at pay.platformdtc.com, with or without a DTCPay account. That device is given access to that order's tracking only, for up to 180 days; if you turn on delivery notifications, we store your browser's notification address for that order until you turn them off.
  • Retention: saved cards and details are kept until you remove them or delete your DTCPay account. A card entered at a checkout that uses DTCPay but not saved with DTCPay (for example after Not now) is removed from our payment processor for DTCPay once 7 days have passed since the purchase.
  • Removal and deletion: the welcome email's removal link removes the card in one click for 30 days, and at pay.platformdtc.com you can at any time remove any card, sign devices out, or delete your DTCPay account, which removes all saved cards and withdraws your consents. Order records are kept as described in Section 4.

2. How We Use Your Information

We use your information to:

  • Provide, operate, and improve the PlatformDTC platform
  • Process payments and prevent fraud
  • Perform identity verification (KYC) and anti-money laundering (AML) screening
  • Send transactional emails (receipts, security alerts, service notifications)
  • With your consent, send product updates and marketing communications
  • Analyze usage to improve features and user experience
  • Detect, investigate, and prevent fraudulent, unauthorized, or illegal activity
  • Comply with legal obligations, including tax reporting (e.g., IRS Form 1099-K)
  • Enforce our Terms of Service and other policies

We do not sell your personal data to third parties. Ever.

3. Data Sharing

We share data only with trusted service providers who help us operate the platform, and only as necessary to deliver our services. Categories of recipients include:

CategoryPurpose
Payment processorsProcess payments, payouts, KYC/AML, and store cards saved with DTCPay (Stripe)
Card networks and card-issuing banks, through the payment processorHelp a cardholder recognise a charge and resolve a dispute: when a cardholder asks their bank about a card payment, the order's details (products, amounts, delivery address, email address and the IP address used to place the order) — and, under Visa Compelling Evidence 3.0, the same details of earlier undisputed orders placed with that card — may be shared with the issuing bank (Dispute Resolution Policy §4.4)
Cloud infrastructure providersHosting, storage, content delivery
Analytics providersProduct analytics and usage measurement
Email and communications providersTransactional and marketing email delivery, and DTCPay verification codes by text message (Twilio)
AI service providersPower AI features within the Service
Customer support toolsHelp desk and ticket management
Fraud prevention and identity verification providersKYC, sanctions screening, fraud detection

Our current subprocessors — each with its purpose, the data it processes and where processing takes place — are listed at /legal/subprocessors, with a change log and an Atom feed. Where we process personal data on behalf of a merchant, including the personal data of that merchant's customers, our Data Processing Addendum governs that processing and the obligations we place on subprocessors.

We may also disclose information when required by law, court order, or government request, or to protect our rights, property, safety, or that of our users or the public.

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity, subject to this Privacy Policy.

4. Data Retention

We retain your account data for as long as your account is active or as needed to provide you with services.

  • Account data: retained until account deletion
  • Transaction records: retained for at least 7 years to comply with US tax and financial regulations
  • KYC and identity verification records: retained for at least 5 years after account closure, as required by anti-money laundering laws
  • Marketing data: retained until you unsubscribe
  • DTCPay saved cards and details: retained until you remove them or delete your DTCPay account; cards not saved with DTCPay are removed from our payment processor for DTCPay once 7 days have passed since the purchase (Section 1.4)
  • Backups: residual copies may persist in backups for up to 90 days after deletion

You may request deletion of your account and associated data at any time by contacting contact@platformdtc.com. We will process your request within 30 days, subject to legal retention requirements above.

5. Cookies and Tracking

We use:

  • Essential cookies: to keep you logged in and remember your preferences (cannot be disabled)
  • Functional cookies: to show the Google sign-in prompt on our homepage
  • Analytics cookies: to understand how visitors use our website (Google Analytics)

In the European Economic Area, the United Kingdom and Switzerland, functional and analytics cookies are set only after you agree. Elsewhere they are on by default and you can turn them off. We treat a Global Privacy Control signal from your browser as a request to turn analytics off. We do not use advertising or marketing cookies.

If you have a DTCPay account, the checkout where it was created, or where you confirmed a code or passkey, sets one strictly necessary cookie, dtcpay_device, so DTCPay can recognise that device for up to one year. It is HttpOnly, is set only for that checkout's website address, and is never used for analytics or advertising (see DTCPay Terms §6).

You can change your choices at any time with the "Cookie preferences" button in the footer of our website. The cookies we set, what each one does and how long it lasts are listed in our Cookie Policy.

6. Security

We protect personal data with technical and organizational measures including:

  • Encryption in transit: our public hosts accept only TLS 1.2 or TLS 1.3
  • Encryption at rest: our primary database is encrypted at rest, and files in our storage are encrypted with AES-256
  • Passwords: hashed with bcrypt, never stored in plain text
  • Payment card data: we do not store full card numbers or card security codes — our Security page explains how card details are handled for each payment provider
  • AI agents: act through scoped API keys that can be revoked individually, with every Agent Gateway call recorded in an audit log
  • Breach notification: where a personal data breach affects data we process for a merchant, we notify that merchant as set out in our Data Processing Addendum

More detail is on our Security page. No system is 100% secure. If you discover a vulnerability, please report it responsibly to contact@platformdtc.com under our Vulnerability Disclosure Policy. We aim to acknowledge reports within 48 hours.

7. Your Rights

Depending on your location, you may have the right to:

  • Access: request a copy of personal data we hold about you
  • Correct: update inaccurate or incomplete information
  • Delete: request deletion of your data (subject to legal retention)
  • Export: receive your data in a portable, machine-readable format
  • Object/Restrict: object to or restrict certain processing
  • Withdraw consent: where processing is based on consent
  • Non-discrimination (California residents): we will not discriminate against you for exercising CCPA rights

To exercise these rights, contact contact@platformdtc.com. We may require identity verification before processing requests.

7.1 EU/UK Users (GDPR)

The legal bases we rely on are: contract performance, legitimate interests, legal obligation, and consent. You have the right to lodge a complaint with your local data protection authority.

7.2 California Users (CCPA/CPRA)

You have the right to know what personal information we collect, to delete it, to opt-out of "sales" (we do not sell), and to non-discrimination.

8. International Data Transfers

PlatformDTC operates from the United States. If you access our Service from outside the US, your information will be transferred to, stored, and processed in the US. We rely on Standard Contractual Clauses (SCCs) and other approved transfer mechanisms for EU/UK data transfers.

9. Children's Privacy

PlatformDTC is not intended for use by individuals under 18 years of age. We do not knowingly collect data from minors. If you believe we have collected data from a minor, contact contact@platformdtc.com and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice in the platform at least 14 days before the change takes effect.

11. Contact

For any privacy-related questions or requests, contact us at:

Data Protection Officer (for EU/UK matters): not appointed at this time; privacy-related EU/UK inquiries may be directed to contact@platformdtc.com