Privacy Policy

At TCG-ShipSync ("we", "us", or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, and protect your personal information when you use ShipSync.

1. Information We Collect

Account Information

When you create an account, we collect:

• Email address and password (stored securely via Supabase Auth)
• Full name and company name (optional)
• Shipping address information

Order and Business Data

When you use our service, we collect and process:

• Order data imported from TCGPlayer and eBay (customer names, addresses, order values)
• Expense records (vendor names, costs, descriptions)
• Revenue entries and profit calculations
• Shipping preferences and automation rules

Payment Information

Payment processing is handled by Stripe. We do not store your credit card details. Stripe collects and processes payment information according to their privacy policy.

Usage Data

We automatically collect:

• Usage metrics and feature interactions
• Subscription status and billing history
• Browser type and device information
• Log data and error reports

2. How We Use Your Information

We use your information to:

• Provide our service: Process your orders, generate shipping labels, and track your business metrics
• Manage your account: Authenticate you, manage your subscription, and communicate with you
• Improve our service: Analyze usage patterns, fix bugs, and develop new features
• Process payments: Handle subscription billing through Stripe
• Customer support: Respond to your questions and resolve issues

3. Data Storage and Security

Your data is stored securely using:

• Supabase: All user data, orders, expenses, and revenue records are stored in Supabase's secure, encrypted database
• Stripe: Payment and subscription data is processed and stored by Stripe
• Browser Storage: Session data and preferences are cached locally using localStorage and service workers for offline functionality

4. Data Sharing and Third Parties

We share your information only with:

• Supabase: Database hosting and authentication services
• Stripe: Payment processing for Pro subscriptions
• EasyPost (indirectly): When you export CSV files for shipping, you manually upload them to EasyPost

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

5. Data Retention

We retain your data as long as your account is active. When you delete your account:

• All order data, expenses, revenue records, and automation rules are permanently deleted
• Your Stripe subscription is automatically cancelled
• Your authentication credentials are removed from our systems
• Billing records may be retained for up to 7 years for legal and accounting compliance

6. Your Rights

You have the right to:

• Access your data: Request a copy of all data we store about you
• Export your data: Download your data in a portable format via the Settings page
• Correct your data: Update your account information and business data at any time
• Delete your data: Permanently delete your account and all associated data via Settings
• Object to processing: Contact us to object to specific data processing activities

7. Cookies and Tracking

We use cookies and similar technologies for:

• Essential cookies: Authentication and session management (required for the service to work)
• Local storage: Storing user preferences and enabling offline functionality
• Service workers: Caching application data for improved performance

You can manage cookie preferences in your browser settings, but disabling essential cookies will prevent you from using ShipSync.

8. International Users

Your data may be transferred to and processed in the United States and other countries where our service providers operate. By using ShipSync, you consent to this transfer. We ensure appropriate safeguards are in place for international data transfers.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the application. The "Last updated" date at the top indicates when this policy was last revised.

10. Contact Us

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected, used, and shared
• Right to delete personal information (with certain exceptions)
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your privacy rights

To exercise these rights, email us at [email protected].

12. European Users (GDPR)

If you are in the European Economic Area, you have rights under the General Data Protection Regulation (GDPR):

• Right to access, rectify, and erase your personal data
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

Legal basis for processing: We process your data based on your consent, contract performance, and our legitimate business interests.