Privacy Policy

We collect the following categories of information when you use the Service:

Account Information

• Email address
• Username (if provided)
• Password (stored as a secure hash via Supabase — we never see your plaintext password)

User-Provided Data

• Inventory and sales records you create
• Buy and sell prices, profit data, and notes you enter
• Listing URLs or text you submit to AI-powered features

Usage & Technical Data

• Pages visited and features used (via Vercel Analytics — anonymized)
• IP address and approximate geographic location
• Browser type, device type, and operating system
• Referring URLs and session duration

We use the information we collect to:

• Create, maintain, and secure your account
• Store and display your inventory, sales, and profit data
• Process inputs through AI features and return results to you
• Understand how the Service is used in order to improve it
• Respond to support requests or inquiries
• Detect and prevent fraud, abuse, or security threats
• Comply with legal obligations

We do not use your data for advertising, sell it to third parties, or use it to build profiles for marketing purposes.

We rely on the following third-party services to operate. Each acts as a data processor on our behalf:

• Supabase — stores your account information and user data. Subject to Supabase's Privacy Policy.
• OpenAI — processes listing text or URLs you submit to AI-powered features. Data submitted may be used by OpenAI subject to their usage policies. We do not send your account information (email, name) to OpenAI.
• Vercel — hosts the Service and provides anonymized analytics (page views, device type). No personally identifiable information is included in analytics data.

We are not responsible for the privacy practices of these providers. We encourage you to review their respective privacy policies.

We use cookies and browser storage technologies to:

• Maintain your login session (authentication cookies via Supabase)
• Remember preferences within the app
• Collect anonymized analytics (Vercel Analytics)

We do not use advertising cookies or third-party tracking pixels. You can disable cookies in your browser settings, but doing so may prevent you from logging in or using certain features.

Your data is stored on Supabase's infrastructure, which uses industry-standard security practices including encryption at rest and in transit.

• Passwords are hashed and never stored or transmitted in plaintext
• All data is transmitted over HTTPS
• We take reasonable technical and organizational measures to protect your data

However, no system is 100% secure. We cannot guarantee absolute security against all threats. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

We retain your data for as long as your account is active or as needed to provide the Service.

• If you delete your account, your personal data and user-created content will be permanently deleted from our systems within a reasonable timeframe
• Some data may be retained in backups for a limited period after deletion
• Anonymized analytics data may be retained indefinitely as it cannot be linked back to you

We do not sell, rent, or trade your personal data.

We may share data only in the following limited circumstances:

• With third-party service providers listed in Section 3, solely to operate the Service
• With law enforcement or government authorities if required by law, court order, or to protect our legal rights
• In connection with a merger, acquisition, or sale of assets, in which case you will be notified

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and associated data via the account settings page
• Portability — request an export of your data in a machine-readable format
• Objection — object to certain types of processing

To exercise any of these rights, contact us at the address in Section 11. We will respond within a reasonable timeframe and as required by applicable law.

California Residents (CCPA): You have the right to know what personal information we collect, request deletion, and opt out of any sale of personal information. We do not sell personal information. To submit a request, contact us at the address in Section 11.

International Users (GDPR): If you are located in the European Economic Area (EEA) or United Kingdom, you have rights under GDPR including access, rectification, erasure, restriction of processing, and data portability. Our legal basis for processing your data is the performance of a contract (providing the Service) and legitimate interests (improving and securing the Service). Data may be transferred to and stored in the United States, which may not have the same data protection laws as your country.

The Service is not directed to or intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it promptly in accordance with COPPA and applicable law.

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.

For privacy-related questions, data requests, or concerns, visit our Support page or email us at help@marginra.com.