Privacy Policy

• Account details: name, email, username, shipping addresses
• Order and payment data processed through payment partners
• Usage data: pages viewed, searches, device and browser information
• Optional delivery region stored locally in your browser until you sign in or checkout
• Support messages, reviews, and dispute communications

We use data to process orders, provide support, prevent fraud, improve reliability, send transactional emails, and comply with law. Marketing emails are sent only with your consent where required.

We share order details with sellers fulfilling purchases and with service providers listed below. We do not sell personal information.

We work with trusted service providers who process data on our behalf:

• Payment processing & seller verification — Stripe (payments, Connect payouts, tax calculation, and seller identity verification)
• Cloud hosting & infrastructure — Google Cloud Platform (application hosting, database, and secure object storage for media and digital assets)
• Email delivery — Postmark (transactional email delivery)
• Security & authentication — Google (reCAPTCHA bot protection and OAuth sign-in)
• Network delivery & protection — Cloudflare (content delivery and protection against abusive traffic)
• Advertising measurement — Google (Google Ads tag, used to measure our advertising campaigns; configured with Google Consent Mode so cookies and user identifiers are not used unless you consent — see our Cookie Policy)
• Typefaces in emails — Google Fonts (when you open one of our emails, your email app may request our typeface from Google's servers, which receive your IP address; our websites serve their typeface themselves)

Depending on where you live, different privacy laws apply. We comply with applicable requirements under:

• PIPEDA (Canada) — personal information collected in the course of our commercial activities
• GDPR (European Union, and UK where applicable) — for users in those jurisdictions
• US state privacy laws (including CCPA/CPRA in California) — for residents of applicable US states

Where GDPR applies, we rely on the following lawful bases:

• Contract — accounts, orders, seller payouts
• Legitimate interests — security, fraud prevention, product improvement
• Consent — non-essential cookies and marketing where applicable
• Legal obligation — tax, accounting, regulatory records

Order and payment records are retained for tax and dispute resolution for up to 2,555 days (~7 years) where required by law. Account data is kept while active and deleted or anonymized after erasure requests, subject to legal holds. Usernames from deleted accounts are quarantined for 14 days before they can be registered again.

Service providers may process data in the United States and other countries. We use appropriate safeguards such as Standard Contractual Clauses where required.

You may access, correct, export, or delete account data from Account Settings where available.

Canada: Under PIPEDA, you have the right to access your personal information, challenge its accuracy, and withdraw consent to certain uses (subject to legal or contractual restrictions). Contact [email protected] to exercise these rights.

California and other US states: Residents may exercise additional privacy rights by emailing [email protected].

Cookie preferences can be managed via our Cookie Policy and consent banner.

Sellers may connect Google Analytics in the Seller Dashboard for their own reporting. Buyer-facing marketplace storefront pages do not load seller Google Analytics scripts by default. If a seller embeds Pagelets on their own website, they are responsible for consent on that site.