Legal

Privacy notice

Last updated 3 November 2026

Who is responsible

The controller of personal data processed through this website is:

Company name: Black Fenix Korlátolt Felelősségű Társaság (Black Fenix Kft.)
Legal form: Limited liability company (korlátolt felelősségű társaság)
Registered seat and postal address: 1023 Budapest, Lajos utca 35., Hungary
Email: contact@front.store
Company registration number: 01-09-471036, Company Registry Court of the Budapest-Capital Regional Court (Fővárosi Törvényszék Cégbírósága)
Tax number: 33138042-2-41
Founded: 2 October 2026

We have not appointed a Data Protection Officer. Write to contact@front.store with any question about your data.

This notice covers this website, signing in to a Front Store creator account with Google or Apple, and verifying a creator's TikTok, Instagram or YouTube account. Brands that install the Front Store channel on their Shopify store are covered by the Brand privacy notice. Creators who open an account on Front Store receive a separate notice about the other account data we process.

What we process, why and for how long

When you visit the website

To deliver pages, our hosting provider processes your IP address, the page requested, the time and your browser's technical details. This is needed to show you the website and keep it secure (legitimate interest, GDPR Article 6(1)(f)). It is used only to deliver the page and is not stored in a log. We do not use this information to identify or profile you. We use no analytics, advertising or tracking tools, and no cookies (see the Cookie notice).

When you write to us

If you email us or use our contact form, we process your name, email address and what you write, to answer you (GDPR Article 6(1)(f), or 6(1)(b) where you are asking about a contract with us). We keep the correspondence for up to one year after we have dealt with your request, and longer only where the law requires it or to establish or defend a legal claim.

When you sign in with Google or Apple

Creators can create and sign in to their Front Store account with their Google or Apple account. We ask Google only for basic sign-in access (your account ID, name and email address) and Apple for your name and email address. Of what they send, we keep:

Google: your Google account ID, your name, and your email address if Google confirms it is verified. We do not keep your profile picture or any other Google data.
Apple: your Apple account ID, your name (Apple sends it only the first time you sign in with Apple), and your email address if Apple confirms it is verified. If you choose Hide My Email, Apple gives us a private relay address (ending in @privaterelay.appleid.com) that forwards to your real address, and we only see the relay address.

We use what Google or Apple sends only to create your creator account and sign you in. When Google or Apple sign-in creates a new account, the name it sends becomes the starting public name on your storefront, which you can change. The email address is where we send your account notices, unless you have already confirmed another one. If you add Google or Apple sign-in to an existing account, we keep only the account ID. We never receive your Google or Apple password, and we keep no access token after you are signed in. This is needed to provide the account you asked for (GDPR Article 6(1)(b)).

We keep this data for as long as your account is open. When your account closes, we delete your Google or Apple account ID, your public name and your storefront's name one month later. Every email address on the account (including the one you sign in with) goes one month later too, or once we have paid you everything you are owed and any hold on your payouts has ended if that is later, and at the latest 12 months after it closes. You can ask us to delete any of it sooner by writing to contact@front.store; we delete it within one month, except what the law requires us to keep or we need for a legal claim or an open review of your account. If a sign-in fails, we keep a record of the attempt, which may include your Google or Apple account ID, for 90 days to find and fix the fault (GDPR Article 6(1)(f)). You can also remove our access in your Google Account or Apple ID settings; that stops future sign-ins but does not delete what we already hold.

We do not sell data received from Google or Apple, use it for advertising, or share it with anyone except the providers below who run the service on our behalf. Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you verify your TikTok, Instagram or YouTube account

Creators can verify that a TikTok, Instagram (professional accounts only) or YouTube account is theirs. These accounts cannot be used to sign in. We ask each for read-only access, use it only while you verify, and read only these fields:

TikTok (basic and profile information): your TikTok account ID, username, display name and profile picture.
Instagram: your Instagram account ID, username, name and profile picture.
YouTube: your Google account ID and email address, and your YouTube channel ID, channel handle and channel picture. Google's read-only YouTube permission would also let us view your account's videos, playlists and subscriptions; we do not read them.

Of what they send, we keep your account ID (for YouTube, your channel ID), your username or channel handle, and the link to your profile picture. For YouTube we also keep an encrypted Google refresh token, which lets us read your channel again. We do not keep your Google account ID or email address from YouTube, and we do not keep your followers, posts, videos or any other data from these accounts.

We use this to show your username or handle as verified on your storefront, where it also sets your storefront's web address if you do not have one yet. Your profile picture is shown on your storefront unless you upload your own. When your account has no public name yet, your TikTok or Instagram display name or name becomes the starting public name on your storefront, which you can change; a YouTube channel name is not used. We never receive your password, and apart from the YouTube refresh token we keep no access token after you have verified. This is needed to provide the account you asked for (GDPR Article 6(1)(b)).

We keep this data for as long as your account is open. When your account closes, we delete your YouTube data at once, and the rest, your public name and your storefront's name one month later. A storefront web address built from your YouTube handle is released at once, and any other one month later; anyone can then claim it, and old links to it may lead to their storefront. You can ask us to delete it sooner by writing to contact@front.store; we delete it within one month, except what the law requires us to keep or we need for a legal claim or an open review of your account. If a verification fails, we keep a record of the attempt, which may include your account ID, for 90 days to find and fix the fault (GDPR Article 6(1)(f)). You can also remove our access in your TikTok or Instagram settings; that does not delete what we already hold. We do not sell this data, use it for advertising, or share it with anyone except the providers below who run the service on our behalf, and YouTube data is covered by the Google API Services User Data Policy above.

Verifying with YouTube uses YouTube API Services, and by doing so you agree to be bound by the YouTube Terms of Service. The Google Privacy Policy covers what Google does with your data. You can remove our access at any time in your Google security settings. We read your channel again at least every 30 days to keep your handle and picture current. If we can no longer confirm the channel, we delete what we hold about it within 30 days and email you. That happens if you or Google end our access, if the channel or its handle is gone, if that access now leads to a different channel, or if we hold no access for it because you verified it before we began keeping one. Your storefronts stay live, but publishing and share links need a verified handle. When you disconnect the channel or close your account, we delete it and remove our access at Google straight away. If you ask us to delete your YouTube data, we do so within 7 days. Deleting what we hold does not affect data stored by YouTube; to delete that, use YouTube itself.

Verifying a TikTok, Instagram or YouTube account is your choice. You do not have to give us this data, but without it that account is not shown as verified on your storefront.

Each time you sign in

Whichever way you sign in, we record the sign-in method, when it happened, a short name for your browser and device read from your browser (such as "Safari on iPhone"), the country and region your connection comes from, and your IP address. We keep no more precise location. We use this to show you the devices signed in to your account, where needed to email you a code when a sign-in comes from a browser we do not know, and to spot accounts that may belong to the same person, which protects your account and prevents fraud (GDPR Article 6(1)(f)). We delete the IP address 12 months after the sign-in. We keep the rest for as long as your account is open. When a creator account closes, we delete the browser and device name and the country and region one month later, and keep only the sign-in method and time. You can ask us to delete it at any time by writing to contact@front.store.

Automated decisions

When a new creator account shares a sign-in IP address, a social handle, a PayPal address or a bank account with another account, or when too large a share of a creator's sales are returned, our system recommends pausing or reducing that creator's payouts. A member of our staff decides, and payouts continue until they do. Our system pauses payouts by itself when a payout detail you change matches another account, and when a payout to you fails or is reversed. Only a member of our staff can lift those pauses, after reviewing them. Payouts also pause for 48 hours after your payout details change or our support team resets your two-step sign-in, and then resume by themselves. A pause or reduction moves no money, closes no account and stops no sales, and what you have earned stays owed to you. We do this to prevent fraud and protect your account (GDPR Article 6(1)(f)). You can ask for a person to review any of these decisions, give your point of view and contest them, from your creator console or by writing to contact@front.store. We make no other decision about you solely by automated means.

Who else receives data

Our hosting provider, Amazon Web Services EMEA SARL (38 Avenue John F. Kennedy, L-1855 Luxembourg; data stored in the Frankfurt, Germany region), processes data on our behalf, including the creator account and sign-in data above, and keeps it in the European Union. Messages sent through the contact form, and the emails we send about your account, are delivered by an email delivery provider acting on our behalf. Where that provider is outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses; you can ask for a copy by writing to contact@front.store. We do not sell personal data.

Your rights

You can ask us for access to your personal data, and for its correction, erasure or restriction, or object to its processing, and where it applies ask for it in a portable form. Write to contact@front.store. We answer within one month.

Your right to object

Where we rely on our legitimate interests (GDPR Article 6(1)(f)), such as keeping the website and your account secure, preventing fraud and answering you, you can object at any time on grounds relating to your particular situation. We then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend a legal claim.

Complaints

Please write to contact@front.store first, so we can try to put it right. You can also complain to the data protection authority of the country where you live or work, or where you think the breach happened, or go to court. In the United Kingdom that is the Information Commissioner's Office (Wycliffe House, Water Lane, Wilmslow SK9 5AF, 0303 123 1113, ico.org.uk). In Hungary, where we are based, the authority is:

Authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11.; postal: 1363 Budapest, Pf. 9.
Contact: +36 1 391 1400, ugyfelszolgalat@naih.hu, naih.hu

Children

Creator accounts are for people aged 18 or over. When you set up your account you confirm this, or give a date of birth that shows it, and we do not accept a younger age. We do not knowingly collect personal data from children; if you think a child has given us data, write to contact@front.store.

Changes to this notice

When we change this notice, we update the date at the top. If a change materially affects how we use account holders' data, we tell them by email.