Privacy Policy

1. Information We Collect

Information you provide directly

• Account information: name, email address, and password when you register
• Profile information: display name, default shipping and return policies
• Inventory data: item details, photos, pricing, condition notes, and attributes you enter
• Payment information: billing name and payment card details. Card data is processed directly by Stripe and is never stored on our servers

Information collected automatically

• Usage data: pages visited, features used, actions taken within the Service
• Device and log data: IP address, browser type, operating system, referring URLs, and timestamps
• Cookies and similar technologies: session cookies required for authentication, and analytics cookies (see Section 6)

Information from third parties

• Google OAuth: if you sign in with Google, we receive your name and email address from Google
• Stripe: we receive transaction status, subscription status, and a Stripe customer ID — we do not receive full card numbers

2. How We Use Your Information

We use your information to:

• Create and manage your account
• Provide, operate, and improve the Service
• Process payments and manage subscriptions via Stripe
• Generate AI-assisted listing descriptions using your item data (processed via Groq)
• Send transactional emails (account confirmation, password reset)
• Analyze usage patterns to improve the Service via Google Analytics
• Respond to support requests
• Comply with legal obligations

We do not sell your personal information. We do not use your inventory data or item details to train AI models.

3. How We Share Your Information

We share your information only with the following categories of third parties:

• Supabase — database and file storage (your inventory data, photos, and account information are stored on Supabase infrastructure)
• Stripe — payment processing. Stripe's privacy policy governs their handling of your payment data: stripe.com/privacy
• Groq — AI inference for listing description generation. Item details you provide are sent to Groq to generate descriptions. Groq's privacy policy governs their handling of this data
• Google Analytics — website and app usage analytics (see Section 6)
• Netlify — hosting and deployment infrastructure

We may also share information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets (you will be notified of any such change).

4. Data Retention

We retain your account data and inventory for as long as your account is active. If you delete your account, we delete your personal data and inventory within 30 days, except where retention is required by law (e.g. billing records, which may be retained for up to 7 years).

Photos uploaded to Bazaarlist are stored in Supabase Storage and are deleted when you delete the associated item or your account.

5. Your Rights

All users

• Access: you can export your full inventory as CSV from Settings → Account at any time
• Deletion: you can delete your account from Settings → Account → Danger Zone
• Correction: you can update your profile and account details at any time

California residents (CCPA)

California residents have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at info@bazaarlist.app.

Oregon residents (OCPA)

Oregon residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising and profiling. We do not engage in targeted advertising or automated profiling that produces legal or significant effects. To exercise your rights, contact us at info@bazaarlist.app. We will respond within 45 days.

6. Cookies and Google Analytics

We use Google Analytics to understand how users interact with the Service. Google Analytics uses cookies and similar tracking technologies to collect anonymized usage data including pages visited, session duration, and general geographic location (country/region level).

Google Analytics data is processed by Google LLC under their privacy policy: policies.google.com/privacy. You can opt out of Google Analytics tracking using the Google Analytics Opt-out Browser Add-on.

We also use essential session cookies required for authentication. These cannot be disabled without preventing you from using the Service.

7. Data Security

We use industry-standard security practices including encrypted data transmission (TLS), row-level security on our database, and scoped access controls. However, no method of transmission over the internet is 100% secure. We encourage you to use a strong, unique password for your account.

8. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Service. Your continued use of the Service after changes become effective constitutes your acceptance of the updated policy.

10. Contact Us

For privacy-related questions or to exercise your rights: