How StorePay protects your store data

• Email and password sign-in for administrators and store users, backed by the platform’s managed auth service.
• Role-based access: every user is either an admin or a store user. Roles are stored server-side and enforced by database row-level security on every read and write — not by the browser.
• Each store has a 6-digit PIN required to authorize payments at the store device. PINs are stored as bcrypt hashes; the plaintext PIN is never persisted.
• Store users only see data for stores they are explicitly a member of. Vendor bank details can only be edited by store managers or admins.

• The app runs on Lovable Cloud, which uses managed Postgres with row-level security, a serverless function runtime, and private object storage for uploaded bills.
• Data in transit is protected by HTTPS/TLS between the browser and the platform.
• Server-side secrets (database keys, OCR keys, demo credentials) are kept in the platform’s server-only secret store and are not shipped in the browser bundle.

• Account data: full name, work email, and optional phone number for each user.
• Store & vendor data: store name, location, monthly budgets, vendor name, UPI ID, bank account, IFSC, account holder, and optionally a cancelled-cheque image.
• Expense data: amount, category, vendor, payment method, payment reference, uploaded bill image, OCR-extracted text, status, and approval / rejection notes.
• Audit logs: actor, action, entity, and timestamp for sensitive operations.

• Lovable Cloud — hosting, database, authentication, file storage, and serverless functions.
• Lovable AI Gateway — used to OCR uploaded bill images so expense fields can be auto-filled.

StorePay does not currently use third-party advertising, tracking, or analytics SDKs in the app.

Store, vendor, expense, and audit-log records are retained for as long as the customer account is active so that historical budgets and approvals remain auditable. To request export or deletion of a specific store’s data, contact the StorePay team using the address in the “Contact” section below.

StorePay stores a session token and the currently-selected store ID in the browser so you stay signed in and land on the right store. We do not set advertising or cross-site tracking cookies.

If you believe you have found a security vulnerability in StorePay, please email the StorePay team with a description and reproduction steps. We will acknowledge your report and keep you updated on the fix.

(The StorePay team should replace this paragraph with a real security contact address before publishing.)

StorePay does not currently hold an independent compliance certification (such as SOC 2, ISO 27001, PCI DSS, or HIPAA). The controls described on this page reflect the current behavior of the product and are maintained by the StorePay team; they are not a substitute for an audited attestation.