Privacy Policy

1. Information We Collect

• Account & Auth: email address and encrypted password hash, managed via Supabase Auth. We do not store plaintext passwords.
• Billing: subscription plan and status are recorded via Stripe webhooks. Payment card details are processed and stored by Stripe; we do not store full card numbers or CVVs.
• eBay Integration: when you connect your eBay account, we store an encrypted OAuth refresh token, your eBay user ID, username, account type, and marketplace. This is used solely to create and manage listings on your behalf.
• Usage: monthly part-preparation and publish counts per account, used to enforce plan limits. Pages viewed and actions taken may be recorded for analytics.
• Vehicle & Listing Content: year, make, model, trim, mileage, costs, and optional notes you enter. If you enter a VIN on a saved vehicle, we store it with that vehicle record until you edit or delete it; if you choose to include a VIN in listing descriptions, it also appears in that generated text.
• Photos: vehicle photos and part photos you upload are stored with your account so your saved part-outs and listings keep them until you delete them or delete your account.
• Support & Contact: the request type, name (optional), email address, subject, and message you submit through the support form.
• Technical: IP address, browser/device info, and error logs used for security, debugging, and service improvement.

2. How We Use Information

• Provide, maintain, and improve the Service, including listing preparation and eBay publish features.
• Authenticate accounts, enforce plan limits, and prevent fraud or abuse.
• Process payments and send transactional emails (billing receipts, support replies).
• Respond to support tickets and contact form submissions.
• Analyze aggregate usage to develop new features and improve performance.
• Comply with legal obligations and respond to lawful requests.

3. Sharing & Disclosures

• Supabase: database and authentication infrastructure. Account data, usage, tokens, and listing data are stored in Supabase.
• Stripe: payment processing and subscription management.
• eBay: listing data is transmitted to eBay APIs using your OAuth authorization.
• Other Vendors: cloud hosting, logging, error tracking, and email providers, under contract.
• Legal: to comply with law, enforce terms, or protect rights, property, or safety.
• Business transfers: in connection with a merger, acquisition, or asset sale.

4. Data Security

eBay OAuth tokens are encrypted at rest before storage. We use reasonable administrative, technical, and physical safeguards to protect information. No method of transmission or storage is entirely secure; we cannot guarantee absolute security.

5. Data Retention

We retain information as long as needed for the purposes above, to comply with legal obligations, resolve disputes, and enforce agreements. You may request deletion as described under Your Rights.

6. Your Rights & Choices

• Access, Update, Delete: You can change your password from the sign-in screen and edit your saved vehicles, parts, photos, and listings in the app. For other account or data requests, including deletion of your account and associated data, contact support.
• eBay Disconnection: You can disconnect your eBay account at any time. This revokes our ability to publish listings but does not delete existing eBay listings.
• Marketing: You may opt out of non-essential emails via unsubscribe links.
• California (CCPA/CPRA): California residents may request access, deletion, correction, and to opt out of "selling" or "sharing" personal information. We do not knowingly sell personal information.
• EEA/UK (GDPR): Where GDPR applies, our lawful bases include performance of contract, legitimate interests, consent (where required), and legal compliance. You have rights to access, rectify, erase, restrict, object, and portability, and to lodge a complaint with a supervisory authority.

7. Cookies & Similar Technologies

We use cookies and similar technologies for authentication, session management, and preferences. You can adjust browser settings to refuse cookies, but some features (including login) may not function without them.

8. International Transfers

If you access the Service from outside the United States, information may be processed in countries with different data protection laws. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) for transfers.

9. Children

The Service is not directed to children under 13. We do not knowingly collect personal information from children.

10. Changes to this Policy

We may update this Policy from time to time. We will post the revised version with a new "Last updated" date.

11. Contact Us

Contact us, or email privacy@autopartout.com.