Privacy Policy

1. Who we are

Boughtopia Dashboard ("Boughtopia", "we", "us") is a business bookkeeping and operations dashboard for sellers operating across multiple sales platforms (eBay, Amazon, Etsy, Shopify, and others). This policy explains what data we collect when you and your team use Boughtopia, why we collect it, and how it is stored and protected.

[Legal entity name, registered address, and company registration number to be added here before publishing.]

2. Data we collect

• Account data: name, email address, and role, provided when you or your administrator create a user account.
• Business records: sales/orders, expenses, purchases, inventory, VAT and invoice details, and audit logs that you or your team enter, import, or that are synced automatically from a connected sales platform.
• Platform integration data: if you connect an eBay or Amazon seller account under Dashboard → Integrations, we store an OAuth access token, refresh token, and the seller/account identifier returned by that platform, so we can periodically retrieve your order data on your behalf. We only request the minimum scopes needed to read order information (e.g. eBay'ssell.fulfillmentscope) — we never request access to your platform account's payment methods, messaging, or listing-management functions.
• Billing data: subscription plan and status. Payment card details are collected and processed directly by our payment processor (Stripe) — we do not store card numbers.
• Technical data: authentication session cookies and a short-lived cookie used to protect the OAuth connection flow against cross-site request forgery.

3. How we use your data

• To provide the dashboard's core functionality: recording, displaying, and reporting on your sales, expenses, purchases, and inventory.
• To automatically retrieve and display order data from eBay/Amazon accounts you choose to connect, and keep that data in sync.
• To generate invoices and financial summaries from the records you store with us.
• To manage your subscription, billing, and account access.
• To maintain an audit trail of changes made within your account, for your own compliance and bookkeeping purposes.
• To secure your account and prevent unauthorized access.

4. Legal basis for processing

We process your data under the following legal bases (GDPR Art. 6): performance of a contract (providing the service you signed up for), your consent (where you actively connect a third-party platform integration), and our legitimate interest in operating and securing the service.

5. Third-party processors

We use the following sub-processors to operate Boughtopia. Each only receives the data necessary to perform its function:

• Supabase — database hosting and authentication.
• Stripe — subscription billing and payment processing.
• eBay and Amazon (via the Selling Partner API) — only if and when you connect your seller account, to retrieve your order data.
• Vercel — application hosting and scheduled background jobs.

6. Data retention

We retain your account and business data for as long as your account is active, and for a reasonable period afterward to comply with legal and tax record-keeping obligations. If you disconnect an eBay or Amazon integration, we delete the associated access and refresh tokens immediately; previously synced order records remain part of your business data unless you delete them.

7. Data security

Data is encrypted in transit (HTTPS/TLS) and at rest. Access to platform integration tokens and to other tenants' data is restricted at the database level — only administrators of your own account can view connection status, and tokens are never exposed to the browser.

8. Your rights

Subject to applicable law (including the GDPR), you have the right to access, correct, export, or delete the personal data we hold about you, to withdraw consent for a platform integration at any time by disconnecting it in Dashboard → Integrations, and to object to or restrict certain processing. To exercise these rights, contact us using the details below.

9. Contact

Questions about this policy or your data can be sent to support@boughtopia.com.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to account administrators by email.