Privacy Policy
Effective and Last Updated: September 17, 2026
LightStore ("LightStore", "we", "us", "our") provides high-performance headless form backend infrastructure, spam prevention, and real-time webhook routing. This Privacy Policy governs all user interactions with the LightStore platform at https://lightstore-app.web.app and https://lightstore-app.firebaseapp.com. We adhere strictly to global data protection standards (GDPR, CCPA) and the Google API Services User Data Policy.
1. Overview and Scope
This Privacy Policy explains how LightStore collects, uses, stores, shares, and protects information when you access or use our website, web application, APIs, and associated services (collectively, the "Service").
By registering an account, integrating LightStore form endpoints into your websites or applications, or utilizing Google Sign-In with LightStore, you acknowledge that you have read and understood the practices described in this Privacy Policy.
2. Information We Collect
We collect information in three ways: information you provide directly, information collected automatically during service operation, and information received from third-party identity providers such as Google.
A. Account Registration Information
When you register for a LightStore account via email, we collect your name, email address, and an encrypted hash of your password. We use this information to authenticate you and manage your account.
B. Google User Data via OAuth
If you sign in or sign up using Google OAuth ("Sign in with Google"), we request access only to your standard identity profile scopes (openid, email, profile). Through this integration, we receive:
- Google User ID: A unique identifier provided by Google to distinguish your user account.
- Email Address: Your primary Google account email address used for account authentication and service notifications.
- Full Name: Your display name used to personalize your LightStore dashboard.
- Profile Avatar: Your public profile picture URL used to display your user avatar in the interface.
We do not request, access, or store any sensitive Google permissions, private files, Google Drive content, Gmail messages, contacts, or calendar data.
C. Form Submission Payloads
When end-users submit data to a LightStore endpoint (POST https://light-store-api-197a317ad239.herokuapp.com/f/:formId), our servers ingest the key-value pairs submitted in the request body (e.g., name, email, message, company, custom fields) on behalf of the account owner.
D. Technical Telemetry and Spam Protection Data
To protect forms from bot floods and DDoS attacks, we automatically analyze request metadata: IP address hashes, User-Agent strings, referer URLs, submission timestamps, and honeypot field triggers.
E. Outbound Dispatch Logs
When forwarding submissions to user-configured destinations (Google Sheets, Discord, Slack, Telegram, Notion, Email, or custom Webhooks), we log the delivery status code, destination endpoint, timestamp, and latency for debugging and reliability tracking.
3. Google API Services User Data Policy Compliance
Google Limited Use Disclosure:
"LightStore's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."
Strict Adherence to Limited Use Requirements:
- User-Facing Features Only: LightStore uses Google user data exclusively to provide and improve user-facing features, specifically account sign-in, account creation, and user identity management within the LightStore application.
- No Third-Party Transfers: We do not transfer Google user data to third parties, except as strictly necessary to operate our infrastructure (such as hosting on secure cloud servers) or to comply with valid legal processes.
- Zero Advertising Use: We never use or transfer Google user data to serve personalized, targeted, retargeted, or interest-based advertisements.
- No Non-Personalized AI Model Training: We never use Google user data to train, retrain, or fine-tune generalized or non-personalized machine learning or artificial intelligence models.
- No Data Resale: We never sell, license, or monetize Google user data under any circumstances.
- Human Access Restrictions: Human personnel are prohibited from viewing or accessing Google user data unless: (1) we have obtained the user's explicit affirmative consent to resolve a specific customer support request; (2) it is required for security investigations of fraud or abuse; (3) it is required by law; or (4) the data is aggregated and anonymized for internal technical telemetry.
4. How We Use Collected Information
We process information for the following specific purposes:
- Core Platform Operation: Ingesting, parsing, and securely storing form submissions in your private dashboard inbox.
- Automated Routing & Webhooks: Dispatching real-time notifications to your configured endpoints, spreadsheets, or chat services.
- Security & Abuse Prevention: Identifying bot traffic, blocking malicious payloads, enforcing rate limits, and defending infrastructure against abuse.
- Account Administration: Authenticating user sessions, verifying permissions, processing password resets, and delivering transactional system notifications.
- Performance & Diagnostics: Monitoring server uptime, response latency, and system reliability to ensure uninterrupted uptime.
5. Data Storage, Security, and Encryption Standards
LightStore applies stringent security measures to protect your information against unauthorized access, alteration, or disclosure:
- Encryption in Transit: All data transmitted between clients, browsers, external forms, and LightStore servers is encrypted using modern TLS 1.3 cryptographic protocols with HTTPS enforcement.
- Encryption at Rest: Form submission payloads and sensitive API secrets are encrypted at rest in our database using authenticated AES-256-GCM algorithms.
- Logical Tenant Isolation: Data across workspaces is segregated using strict multi-tenant database partitioning.
- Access Control: Administrative access to production databases is strictly restricted, logged, and requires hardware-backed multi-factor authentication.
6. Third-Party Service Providers and Sub-Processors
We engage carefully selected third-party service providers solely to maintain our hosting and database infrastructure:
7. Data Retention, User Control, and Permanent Deletion
We maintain data only for as long as necessary to fulfill the operational purposes described in this policy or as configured by you:
- Active Account Data: Account information and Google user profile data are retained for as long as your LightStore account remains active.
- Configurable Form Retention: Workspace owners can set automatic data purging rules (e.g. 30 days, 90 days, 1 year, or indefinite) to automatically delete historical form submissions.
- User-Initiated Deletion: You may permanently delete individual form submissions, form endpoints, or your entire LightStore account directly from your dashboard settings at any time.
- Permanent Purge Timeline: Upon receiving an account deletion request, all associated data, forms, submissions, and Google profile data are deleted from active databases immediately and completely purged from immutable disaster recovery backups within 30 calendar days.
- Revoking Google OAuth Access: You can disconnect and revoke LightStore's access to your Google account at any time by visiting your Google Account Security Permissions page.
8. Global Privacy Rights (GDPR, UK GDPR, CCPA / CPRA)
Depending on your location, you have statutory rights regarding your personal data:
- Right to Access: Request confirmation of whether we process your data and receive a complete copy.
- Right to Rectification: Request correction of inaccurate or incomplete personal information.
- Right to Erasure ("Right to be Forgotten"): Request the permanent deletion of your personal data.
- Right to Data Portability: Export your submission data in structured JSON or CSV format.
- Right to Object / Restrict Processing: Object to or restrict the processing of your data under specific statutory circumstances.
- Non-Discrimination: We will never discriminate against you, deny services, or alter pricing for exercising your privacy rights.
To exercise any of these rights, contact us at support@lightstore.dev or wisdomdivine3d@gmail.com. We respond to all verified requests within 30 days.
9. Cookies and Local Storage
LightStore uses strictly necessary first-party cookies (lightstore_token) and browser local storage solely to authenticate user sessions and preserve dashboard user interface preferences. We do not use third-party tracking cookies, advertising pixels, or cross-site tracking scripts.
10. Children's Privacy
LightStore is intended for software developers, professionals, and businesses. We do not knowingly collect personal information from individuals under the age of 18. If we discover that a minor has provided us with personal information without parental consent, we will promptly delete that information from our servers.
11. Changes to this Policy
We may update this Privacy Policy from time to time to reflect operational improvements, security enhancements, or legal obligations. When changes are made, we will update the "Last Updated" date at the top of this page. For material changes, we will provide prominent notice through the LightStore dashboard or via email prior to the changes taking effect.
12. Contact and Developer Information
If you have any questions, inquiries, or requests regarding this Privacy Policy or our data practices, please contact us directly: