IndieCommerce Store Connect Privacy Policy

Effective date: November 5, 2026

This policy applies to your store from the date you connect it through Store Connect.

Who we are

IndieCommerce Store Connect ("Store Connect") is run by the American Booksellers Association ("ABA", "we", "us") for bookstores that use IndieCommerce.

American Booksellers Association
600 Mamaroneck Ave., Suite 400
Harrison, NY 10528

Contact: staff@bookweb.org

What Store Connect does

Each IndieCommerce bookstore gets its own Store Connect link. The store owner signs in with Google and approves access. Store Connect then:

• adds our service account, aba-gmc-uploader@indiecommerce.iam.gserviceaccount.com, as an Admin on the store's Google Merchant Center account;
• reads the Merchant Center account to confirm the connection works;
• lists the store's Google Business Profile locations and sets a store code only on locations that do not already have one;
• links Merchant Center to Business Profile, if they are not already linked.

We do this so that ABA can upload the store's local inventory (its in-store stock feed) to Google Merchant Center, and the store's in-store availability can show on Google.

What we access, and why

When you sign in, Google asks you to approve these permissions (scopes). Here is what each one is used for.

openid and email We read your Google account's email address, so we know who approved the connection and can contact you about it.

https://www.googleapis.com/auth/content (Google Merchant Center) We use this to list the Merchant Center accounts you can manage, add our service account as an Admin on the account you choose, and read that account to confirm the connection works.

https://www.googleapis.com/auth/business.manage (Google Business Profile) We use this to list your Business Profile locations, set a store code on any location that does not have one (existing store codes are never changed), and link your Business Profile to Merchant Center if no link exists.

We do not use these permissions for anything else.

What we store, and where

For each store that connects, we store:

• the store's IndieCommerce identifier (its "slug");
• the Google email address of the person who signed in;
• the Merchant Center account ID;
• the Google Business Profile account and location IDs and names;
• the store codes we set;
• a step-by-step log of what Store Connect did and whether each step worked;
• the date and time of each step.

This data is stored in Google Cloud (Firestore) in the United States (us-east1 region). A summary of the result may also be posted to ABA's internal Slack workspace, so our staff can follow up if a step did not work.

Your Google sign-in is not kept

The access Google gives us when you sign in is used only during your visit to carry out the steps above, and is then discarded. We do not ask Google for long-term ("offline") access, and we do not store a refresh token. If you manage more than one Merchant Center account, the access is held on our server, encrypted, for up to 10 minutes while you choose which account to connect. It is deleted as soon as you choose. If you don't choose, it can no longer be used after 10 minutes and is deleted automatically within a day.

After you connect, ABA works with your Merchant Center account through our own service account, which you can remove at any time (see "How to remove access" below).

How we use and share data

We use the data only to connect your store and to provide the IndieCommerce local inventory service described above.

We do not sell your data. We do not use it for advertising. We do not share it with anyone except Google, as part of providing this service (for example, when we send your store's inventory to your Merchant Center account).

Google API Services User Data Policy

Store Connect's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it

We keep the data while your store is an IndieCommerce customer. We delete it within 30 days of a written request to staff@bookweb.org, or within 30 days of your store leaving IndieCommerce.

How to remove access

You can remove our access at any time, without contacting us:

• Merchant Center: remove aba-gmc-uploader@indiecommerce.iam.gserviceaccount.com from your account's users (in Merchant Center, Settings, then People and access).
• Google sign-in: remove "IndieCommerce Store Connect" from the apps with access to your Google account at https://myaccount.google.com/permissions.

Store codes and the Merchant Center to Business Profile link are ordinary settings in your own Google accounts. You can change or remove them there. If you would like us to delete the data we hold, email staff@bookweb.org.

Security

Store Connect runs on Google Cloud. All traffic to it uses HTTPS. Access to stored data is restricted exclusively to personnel responsible for managing Store Connect for ABA. We do not store your Google password or keep your Google sign-in after your visit.

Contact

Questions about this policy or your data: staff@bookweb.org.

Changes to this policy

If we change this policy, we will post the new version on this page and update the effective date. If a change affects how we use data we already hold, we will tell the stores that use Store Connect before it takes effect.