Pickupp

Privacy policy

Last updated: October 7, 2026

pickupp is built so that we know as little about you as possible. We use no tracking and no advertising cookies; we only count visits with a cookie-free statistics tool. This policy explains which data is processed when you visit pickupp.store, order from a store, request a store, or work in a store's admin app.

Contents

Who is responsible

SITEDOCK GmbH, the operator of pickupp (address in the imprint). For all privacy questions, write to mail@pickupp.store.

Visiting pickupp.store

  • Hosting and server logs. Our website runs on Vercel. When you open a page, the server processes technical data such as your IP address, the time, the address of the page and your browser type, to deliver the page and to protect it against attacks (legitimate interest, Art. 6(1)(f) GDPR). These logs are kept only briefly.
  • Language. If you choose a language, we store it in the cookie pickupp_lang on your device for one year, so the next page opens in your language. It contains only the language code.
  • Protection against abuse. To stop spam and abuse, we briefly count requests per network address (checkout, payment confirmation, store requests, sign-in) and per email address (sign-in, invitations, store requests). These counters expire automatically after at most one hour (via Upstash, if enabled).
  • Fonts and images are delivered from our own domain or our own storage — your browser doesn't contact font or ad providers.
  • Visitor statistics (Pirsch). To see which pages are used, the public pages of pickupp.store count visits with Pirsch Analytics, served from our subdomain stats.pickupp.store. Pirsch sets no cookies and stores nothing on your device. From your IP address, browser and the date it forms a one-way code that changes daily, so a visit can be counted once without identifying you; your IP address itself is not stored. Counted are the page address (without anything after the "?", so no order numbers or links), the referring page, browser, operating system, screen size, country and language. Store teams' admin app is not counted (legitimate interest in improving the website, Art. 6(1)(f) GDPR).
  • No tracking, no advertising. We therefore don't use a cookie banner: nothing is stored on your device except what is technically necessary (§ 25(2) TDDDG).

Ordering from a store

  • No customer account. You order as a guest. We don't store your name, email address, phone number or address with your order.
  • What we store: the products, the chosen pickup time, the amounts, the 4-digit pickup code, and a note if you write one (please don't put personal data in the note). The store sees this to prepare your order.
  • Payment. Payments are processed by Mollie B.V. (Netherlands). Mollie collects the payment and contact details it needs for the payment under its own privacy policy. We only receive the payment status and the payment method used — never your card or account details.
  • Your device. Your cart is kept in your browser's local storage, so it's still there after a reload; the current checkout step is kept in the session storage of the browser tab and disappears when you close it. Neither leaves your device unless you order; you can delete them by clearing your browser data.
  • Store map. The map on a store page is generated with Mapbox on our server and delivered from our domain; no data about you is sent to Mapbox.
  • Who is responsible for your order. The store you order from is the seller. We operate the order system for the store.

Requesting a store

When you send the store request form on our landing page, we store your business name, your name, email address, country, and — if you fill them in — phone, type of business, website or Instagram, and your message, together with the page language and the time of your consent. We use them only to answer your request and to set up your store (consent, Art. 6(1)(a), and pre-contractual steps, Art. 6(1)(b) GDPR).

  • Each new request is emailed to our platform team (via Lettermint).
  • If you attach a file (e.g. your menu or product photos), we don't store it: it is only forwarded as an attachment of that email.
  • To keep spam out, requests are counted briefly (see protection against abuse).
  • Requests that don't lead to a store are deleted automatically after 12 months. You can withdraw your consent at any time by writing to us.

Store teams (admin app)

If you work in a store on my.pickupp.store, we process:

  • Sign-in: your email address, and a sign-in link or code sent to it (via Lettermint).
  • Cookies: sign-in cookies keep you signed in; pickupp_locale remembers your interface language, pickupp_next the page to open after signing in, and sidebar_state whether the side menu is open.
  • Profile and roles: your name, email address, interface language, the stores you belong to and your role there.
  • Notifications: if you switch on push notifications, we store your device's push address and send new-order notices through your browser's push service (Apple, Google or Mozilla).
  • Invitations: if someone invites you to a store, we store your email address, the store and the role.
  • Store and owner details: to set up the store's payments with Mollie, the owner enters the owner's name, contact email and phone, the legal business name, the registered address and the VAT number; we also store the connection to the store's Mollie account. We use these details to onboard the store with Mollie and to contact the owner.

Legal basis: performance of the contract with the store (Art. 6(1)(b) GDPR) and, for notifications, your consent (Art. 6(1)(a) GDPR). Store texts may be translated with Mistral AI (France); these texts contain no personal data.

Service providers

We use these processors, bound by data processing agreements:

  • Supabase — database, sign-in and file storage; data stored in Frankfurt (EU).
  • Vercel — hosting of the website and app; servers in Frankfurt (EU).
  • Mollie — payments (Netherlands, EU).
  • Lettermint — sending emails (Netherlands, EU).
  • Pirsch Analytics (Emvi Software GmbH) — cookie-free visitor statistics; servers in Germany (EU).
  • Upstash — short-lived request counters against spam (if enabled).
  • Apple, Google, Mozilla — delivery of push notifications to store teams who switched them on.
  • Mapbox (USA) — generating store maps on our server (no visitor data); when a store team searches its address in the admin app, the search goes to Mapbox.
  • Mistral AI — translating store texts (France, EU; no personal data).

Transfers outside the EU

Some providers (Vercel, Supabase, Upstash, Mapbox) are based in the USA. Where personal data may reach them, the transfer is based on the EU-US Data Privacy Framework or the EU standard contractual clauses (Art. 45/46 GDPR).

How long we keep data

  • Orders: as long as required for the store's bookkeeping and tax obligations.
  • Store requests: up to 12 months, unless a store is created from them.
  • Store team accounts: as long as you belong to a store; afterwards we delete or anonymise them.
  • Server logs and spam counters: briefly (hours to a few days).

Your rights

You have the right to access, correction, deletion, restriction of processing, data portability and objection (Art. 15–21 GDPR), and to withdraw consent at any time with effect for the future. Write to mail@pickupp.store. You may also complain to a data protection supervisory authority.

For your payment data, contact Mollie; for questions about an order, contact the store.

Changes to this policy

We update this policy when pickupp changes. The date at the top shows the current version.