When your boutique stores customer records (names, emails, phone numbers, loyalty and gift-card data) in Hangerline, you are the controller of that data and Cornerstone Rock Holdings is your processor. These terms form part of the Terms of Service.
1. Processing on your instructions
We process merchant-customer data only to provide the service as you direct through the product: storing records, computing loyalty balances, generating exports, and — only when you connect and explicitly trigger them — sending data to your own Klaviyo, Shippo or Twilio accounts. We do not use merchant-customer data for our own purposes, and we never sell it.
2. Confidentiality
Access to merchant data inside Cornerstone Rock Holdings is limited to what is needed to operate and support the platform, under confidentiality obligations.
3. Security measures
- Transport encryption (TLS) on all connections; HSTS enforced.
- Passwords stored as salted hashes; sessions via an HttpOnly, SameSite cookie.
- Per-merchant data isolation enforced in every query path; role-based access between merchant and platform-admin surfaces.
- Integration secrets stored server-side and only ever displayed masked.
- Audit logging of significant account actions, visible to you in your dashboard.
4. Sub-processors
Our engaged sub-processors are published — with what each one sees — on the Sub-processors page. Providers you connect with your own API keys (Klaviyo, Shippo, Twilio) act on your behalf under your agreements with them, not as our sub-processors.
5. Assistance and data-subject requests
If a customer of your boutique exercises privacy rights, we assist you in fulfilling the request — locating, exporting, correcting or deleting their records — within a commercially reasonable time.
6. Incident notice
If we become aware of a personal-data breach affecting your data, we notify you without undue delay with the facts we have, and update you as investigation proceeds.
7. Return and deletion
On account closure, your data is available for export during a reasonable wind-down period and then deleted, except where retention is legally required. You can also delete individual records at any time through the product.
Candor note: Cornerstone Rock Holdings has not undergone a SOC 2 or ISO 27001 audit and does not claim any certification it does not hold. The concrete measures above are what actually protects your data today.