Last updated: [Month Year]

When you work with me, I may need access to parts of your ecommerce setup — from Shopify and Google Analytics to advertising accounts, email platforms and other tools. I take that access seriously and only use it for the work we’ve agreed on.

Access & account security

I only request access to the accounts and information needed to carry out the agreed work.

Where possible, I use individual user accounts and platform permissions rather than asking clients to share passwords. I also use two-factor authentication and strong, unique passwords for accounts I control.

You remain the owner of your accounts, data and business information at all times.

Client information

During a project, I may have access to information such as website analytics, advertising performance, customer behaviour, sales data, campaign data or other business information.

I only use this information to provide the services we’ve agreed on. I don’t sell, share or use your confidential business information for unrelated purposes.

I’ll also avoid downloading or storing personal customer information unless it’s genuinely necessary for the work.

Sharing information

I don’t share your confidential information with third parties unless:

• it’s necessary to provide the agreed service;
• you’ve given me permission to do so; or
• I’m legally required to.

Some services may require working within third-party platforms such as Shopify, Google, Meta or Klaviyo. Those platforms have their own security and privacy practices, which apply alongside mine.

Data storage

Project files and information are stored using reputable, access-controlled services. I take reasonable steps to prevent unauthorized access, loss or disclosure of information.

When access or information is no longer needed for the project, I remove it where reasonably possible, subject to any legal, accounting or contractual requirements to retain it.

Security incidents

If I become aware of a security incident that affects your information or account access, I’ll take reasonable steps to contain the issue, secure affected accounts and assess what happened.

Where appropriate, I’ll notify you as soon as reasonably practicable and work with you on the next steps.

Your responsibility

Security is a shared responsibility. You remain responsible for your own accounts and for maintaining appropriate permissions for people who have access to them.

Where possible, I recommend using platform permissions rather than sharing account passwords, enabling two-factor authentication and removing access when someone no longer needs it.

Questions

If you have questions about how I handle your information or want to discuss security requirements before starting a project, you can contact me at [your email].