1.Who we are
Lapis ("Lapis", "we", "us") is a commerce platform available at uselapis.io, operated by AUS Consulting. Merchants ("Operators") use Lapis to build and host their own online storefronts and to run their businesses.
This policy explains what personal information the platform handles, for whom, and why. It covers the uselapis.io site, the Lapis dashboard, and the storefronts we host on behalf of Operators.
2.Our two roles
We handle personal information in two distinct capacities:
- As a controller for Operators, the merchants who sign up for Lapis. We decide how account, billing, and platform usage data is handled.
- As a processor for visitors and customers of storefronts hosted on the platform. There, we process data on behalf of, and under the instructions of, the Operator who runs that store. The Operator is the controller of their customers' data.
If you bought something from, or signed into, a store hosted on Lapis, that store's own privacy policy also applies. Questions about a store's data practices should go to the store Operator first; we assist Operators in honoring those requests.
3.Information we collect from Operators
- Account details, your email address and name when you create an account.
- Billing information, subscriptions are billed through Whop, our billing partner. Whop handles your payment details; we never store card numbers. We receive subscription status and plan information from Whop.
- Usage data, which features you use, pages you visit in the dashboard, and diagnostic information that helps us keep the platform reliable.
- Communications, messages you send us, such as support requests.
4.Information we collect during onboarding
Before you create an account, Lapis asks you to complete a short onboarding intake so the platform can build your first storefront. This information is collected at that point, prior to an account existing, and stored so we can generate your store and follow up with you.
- Contact details, the name and email address you provide so we can reach you about your store.
- Business and brand details, your business or brand name, industry, and other details about what you sell.
- Free-text answers, the brand-story and ideal-customer descriptions you write, which the AI uses to generate copy and layout tailored to your brand.
- Uploaded images, any logo or product images (for example, vial photos) you upload to be used in your store.
These intake responses are stored in our onboarding records and used to build your storefront and to contact you about setting it up. If you do not go on to create an account, you can ask us to delete them at the contact address below.
5.Information we process on hosted storefronts
When a visitor uses a storefront hosted on Lapis, we process the following on behalf of that store's Operator:
- Order details, items purchased, order amounts, and the name, email, and shipping address needed to fulfill an order.
- Sign-in email, if the visitor signs in with Google, the email address (and basic profile) provided through Google OAuth, as described in the next section.
- Analytics events, first-party events such as page views and cart activity, used to power the Operator's store analytics.
6.Google user data
Storefronts hosted on Lapis offer sign-in with Google. This section describes exactly how Google user data is handled.
What we request. Sign-in uses Google OAuth and requests only your email address and basic profile information (name and profile picture). We do not request access to any other Google data, no contacts, no Drive, no Gmail, no calendar.
How we use it. Google user data is used solely to authenticate you and to associate your orders with your account on the specific store you signed into. Nothing else.
What we never do with it. Google user data is never sold, never used for advertising, never used to train AI models, and never shared with anyone beyond the Operator whose store you signed into and the subprocessors that host the platform (listed below).
Revoking access. You can revoke Lapis's access to your Google account at any time from your Google account settings.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
7.How we use information
We use the information described above to:
- Provide and operate the platform and hosted storefronts.
- Authenticate accounts and process subscriptions.
- Process and fulfill orders on behalf of Operators, including generating shipping labels.
- Power analytics dashboards for Operators.
- Improve the platform and keep it secure, including fraud prevention.
- Communicate with Operators about their accounts and the service.
We do not sell personal information, and we do not use it for third-party advertising.
9.Analytics
Storefront analytics are first-party: events such as page views and purchases are collected by the platform itself and shown to the Operator of that store in aggregate dashboards. Analytics data is not shared with advertising networks.
10.Subprocessors
We rely on a small set of service providers to run the platform. Each processes data only as needed to provide its function:
- Supabase
- Database and authentication infrastructure.
- Vercel
- Application hosting and content delivery.
- Anthropic
- AI features (content generation and store editing).
- Shippo
- Shipping labels and carrier integration.
- Whop
- Subscription billing for Operators.
- OAuth sign-in for storefront customers.
11.Data retention
Operator account data is retained while the account is active and for as long as needed afterward for legal and accounting purposes. Storefront customer data is retained on behalf of the Operator for as long as their store operates, and handled per the Operator's instructions.
When an account is terminated, Operators have a thirty (30) day window to request an export of their store data, after which it may be permanently deleted. Residual copies in encrypted backups roll off on a fixed schedule.
12.Security
Data is encrypted in transit (TLS) and at rest through our infrastructure providers. Access to production data is limited to what is necessary to operate the service. No method of transmission or storage is perfectly secure, but we work to protect personal information with measures appropriate to its sensitivity, and we will notify affected parties of any breach as required by law.
13.Your rights and choices
Depending on where you live, you may have rights to access, correct, export, or delete your personal information.
- Operators can contact us directly at austin@byaus.co.
- Storefront customers can contact the Operator of the store they used, or reach us at the same address, we will route the request to the right Operator and assist in honoring it.
You can also revoke Google sign-in access at any time via your Google account settings, as described above.
14.Children
The platform and hosted storefronts are intended for adults aged 18 and over. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn we have collected such information, we will delete it.
15.International data transfers
The platform is operated from the United States, and data is stored with providers in the United States. If you access the platform or a hosted storefront from elsewhere, your information will be transferred to and processed in the United States, with safeguards provided through our infrastructure providers' compliance programs.
16.Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top reflects the current version, and we will provide notice, by email or in-product, before material changes take effect.
17.Contact
Questions about privacy on Lapis? Contact us at austin@byaus.co.