My gut feeling is "no" not without permission from the store.  The type of data you collect would also have to be limited.  The law surrounding the internet is ever emerging.  But it still feels like an invasion of privacy issue.  If they go to your website and expect to be able to create a secure and private site then they should be able to do so.  I get the feeling that you would have to utilize some form of "spy ware" for a lack of a better term, to collect the data.  And if the data contains information as to names, addresses, credit cards, etc., of the "store" clientele then you could really get in to some problems.  Think of another way to approach this.  Good luck.