Minimum data, purposeful use.

Draft policy: the store collects account, order, and operational security data needed to provide purchases and protect access. It does not store payment card data. This policy requires owner and legal review before paid launch.