Yes. LotsStore never holds your money: shoppers pay into your own Stripe or Razorpay account, or straight to you by UPI or on WhatsApp. Stripe connects with a restricted key that can't pay out or touch your bank details, card numbers are entered on Stripe's own checkout page, and if you stop paying, nothing is deleted.
That's the short answer. Below is exactly what LotsStore can and can't do with each payment account, what it stores about your shoppers, who on your team can change what, and what happens to your store if a payment lapses. Every point comes from our setup guides, the LotsTech privacy policy and terms, and the product itself, checked on 21 October 2026.
Your money goes to you, never through us
LotsStore is a store platform, not a payment company. The terms say it plainly: you are the seller and the merchant of record, shoppers pay you directly, and "LotsStore never holds your money or your shoppers' money and takes 0% of your sales."
There are four ways to get paid, and you choose which ones your store offers:
| Way to pay | Where the money goes | What LotsStore sees |
|---|---|---|
| Card and wallet checkout with your own Stripe account (in the countries Stripe supports) | Your Stripe balance, then your bank on Stripe's schedule | The order and whether it was paid; never the card number |
| Your own Razorpay account (cards, UPI, netbanking, wallets; businesses registered in India) | Your Razorpay account and bank on Razorpay's schedule | The order and whether it was paid; never card numbers or UPI PINs |
| UPI to your UPI ID | Straight to your bank account | The order and the transaction reference the shopper reports |
| Order on WhatsApp | However you and the shopper agree | The order request; payment is between you |
Your payment provider charges its own fee in your own account. LotsStore adds nothing on top.
Stripe: a restricted key with three permissions
Stripe is available on every LotsStore store, in your own Stripe account. You connect it with a restricted key: a Stripe key that can do only the jobs you allow. The connect Stripe guide has you create one named LotsStore with exactly three permissions set to Write, and everything else on None:
| Stripe permission | Why LotsStore needs it |
|---|---|
| Checkout Sessions | Opens Stripe's own checkout page for each order, so shoppers pay on Stripe |
| Charges | Lets you refund an order from LotsStore |
| Webhook Endpoints | Creates one notification in your Stripe account that tells your store when a payment goes through |
What that means in practice:
- The key can't pay out money, change your bank account, or touch your products, customers or subscriptions in Stripe.
- A full secret key is refused. If you paste a key that starts with
sk_, LotsStore rejects it and explains why: a full secret key "can do anything in your Stripe account". It only accepts a restricted key (rk_test_in test mode,rk_live_in live mode), and checks each of the three permissions with Stripe before saving. - It's stored encrypted and never shown again, not to you, your team or anyone at LotsStore.
- Payment notifications are verified. When Stripe tells your store a payment went through, LotsStore checks Stripe's signature on the message before it marks the order paid.
- You can cut it off at any time. Untick Stripe on your Payments page to stop offering it, or delete the LotsStore key in Stripe (Developers, then API keys) and payments through it stop at once. Orders already paid stay in your Stripe account.
- Start in test mode. The guide has you create a test key first, pay with Stripe's test card, refund it, and only then repeat the steps with a live key.
Hosted checkout: card numbers never reach us
When a shopper pays by card, LotsStore opens a Stripe Checkout page for that order, and the shopper types their card details there, on Stripe. Razorpay works the same way with its own checkout. The privacy policy says it directly: "We never see or store card numbers, and we hold no shopper money."
Razorpay: you approve access on Razorpay's own site
For businesses registered in India, Razorpay connects without a key to copy. You sign in on Razorpay's site, see what LotsStore is asking for, and approve it. You never give us your Razorpay password. The access is used only to create payments for your orders, check whether they were paid and make the refunds you approve, and it's stored encrypted. You can remove LotsStore from the connected apps in your Razorpay Dashboard at any time. Steps: connect Razorpay.
UPI and WhatsApp orders: you confirm before anything ships
UPI and WhatsApp orders never touch a payment account of ours, because there isn't one.
- UPI: the shopper pays the exact amount to your UPI ID and reports the transaction reference. LotsStore treats that as a claim, not a payment: you check it in your own bank or UPI app, then accept the order.
- WhatsApp: the shopper places the order on your store, and LotsStore opens WhatsApp with the order number, items and total already written. You agree payment in the chat.
Either way, you can review every order before it goes ahead. On the Payments page you choose whether to review every order or accept verified online payments automatically.
Who on your team can touch payments
Every store has five roles: owner, admin, manager, staff and viewer. Only the owner and admins can open the Payments page, along with domains, shipping, taxes, team and settings. Managers and staff work on products and orders; viewers can look but not change. People see only the stores they're invited to, and nobody can be invited as owner. Archiving a store is owner-only, and you confirm it by typing the store's name.
Your shoppers' data
LotsStore has its own section in the LotsTech privacy policy (section 17). The main points:
- You are the controller of your shoppers' data. LotsStore processes their orders, account details (name, email, phone and addresses), wishlists and reviews only to run your store.
- Shopper accounts are separate from LotsTech accounts. Shoppers sign in with an email code, an email link or Google.
- No advertising trackers on your storefront. Storefronts set only the cookies they need for sign-in and checkout.
- The services involved are named: Supabase stores account, store and order data; Cloudflare hosts the app and storefronts; the commerce engine runs on a server LotsTech operates at Hetzner; Stytch provides shopper sign-in; Resend delivers order emails; Stripe or Razorpay receives the payment details when you turn on online payments.
You can export your product catalog to a CSV file at any time from the dashboard.
If you stop paying, nothing is deleted
LotsStore is priced per store: Starter $12 a month for 1 store, Pro $29 for 3, Business $79 for 10, or $15 per store a month pay as you go from credits (pricing, checked on 21 October 2026). If a store's plan or credits run out:
- nothing is deleted;
- the storefront stays readable;
- new orders pause until the store is funded again;
- the dashboard turns read-only;
- orders already placed can still be fulfilled and refunded.
If you archive a store yourself, the storefront goes offline and billing for it stops, but nothing is deleted, and you can restore it for 30 days. Credits you buy never expire. New accounts get 15,000 free credits, valid 90 days, no card. More in LotsStore pricing explained.
If you connect ChatGPT or Claude
LotsStore works with the AI agent you already use, and the same rules apply there. You connect an assistant by signing in with your Lots account (setup on the MCP page), and it can only reach the stores you can. It can't take a Stripe key: the instructions it gets from LotsStore say never to ask for or accept one in chat, and the key can only be pasted on your store's Payments page. Before archiving a store or accepting an order, the assistant is told to show you what it's about to do. Every change shows up in your dashboard.
FAQ
Does LotsStore hold my money?
No. Shoppers pay into your own Stripe or Razorpay account, or straight to you by UPI or on WhatsApp. LotsStore never holds your money or your shoppers' money, and takes 0% of your sales.
Is it safe to give LotsStore a Stripe key?
LotsStore only accepts a Stripe restricted key with three permissions: Checkout Sessions, Charges and Webhook Endpoints. It can't pay out money, change your bank account or touch your Stripe products, customers or subscriptions. A full secret key is refused, the key is stored encrypted, and you can delete it in Stripe at any time.
Does LotsStore see my customers' card numbers?
No. Shoppers enter card details on Stripe's or Razorpay's own checkout page. The LotsTech privacy policy says LotsStore never sees or stores card numbers.
What happens to my store if I stop paying?
Nothing is deleted. The storefront stays readable, new orders pause and the dashboard turns read-only until the store is funded again. Orders already placed can still be fulfilled and refunded.
Who owns my shoppers' data?
You do. The LotsTech privacy policy says you are the controller of your shoppers' data, and LotsStore processes it only to run your store. Storefronts run no advertising trackers.
Can my staff change where payments go?
No. Only the store owner and admins can open the Payments page. Managers, staff and viewers can't see or change payment settings, and nobody can be invited as owner.
Sources
Checked on 21 October 2026: Connect Stripe, Connect Razorpay, LotsTech privacy policy, section 17, LotsTech terms, section 19, LotsStore pricing, LotsStore API docs.