Privacy Policy

When you create an account we collect your email address, password (stored as a hash — we never see or store your plaintext password), username, selected plan, and locale-derived currency preference. If you sign up via Google or Apple, we receive your name, email, and profile photo from those providers. During signup and password reset, we send a partial hash (the first five characters of a SHA-1 hash) of your password to the Have I Been Pwned API to check whether it has appeared in known data breaches — your full password is never transmitted.

Data you enter into ResellIQ — item records, descriptions, prices, costs, expenses, receipts, storage maps, order records, and financial summaries — is stored in our database and associated with your account. This data is not accessible to other users unless you make it visible through your public shop profile.

You may upload product photos, a profile avatar, a banner image, and expense receipts. Product images and avatars are stored in publicly accessible storage buckets so they can be displayed on your public shop page and used by the browser extension during cross-listing. Receipt uploads are stored in a private bucket accessible only to you. By uploading product images, you acknowledge that they will be accessible via public URLs.

If you use the public shop feature, your username, avatar, banner, bio, accent colour, social links, listed items, item descriptions, sale prices, and product images are publicly visible at reselliq.app/shop/[your-username]. Purchase cost data is never displayed publicly.

If you connect your Gmail account (available on paid plans), ResellIQ initiates a Google OAuth 2.0 authorisation flow. The consent screen lists the exact scopes we are requesting and the Google Account that will be connected. You can review and revoke this access at any time from your Google Account at myaccount.google.com/permissions or by clicking “Disconnect Gmail” in your ResellIQ settings, which revokes the token with Google and deletes the stored credentials.

We request the following scopes: https://www.googleapis.com/auth/gmail.readonly (read-only access to your Gmail messages and settings, used to search for and read marketplace order emails), https://www.googleapis.com/auth/userinfo.email (your email address, used to identify the connected Google Account inside ResellIQ), and openid (standard OpenID Connect identifier). We never request gmail.send, gmail.modify, gmail.compose, gmail.labels, or full-mailbox access. We do not send, compose, modify, label, archive, or delete any emails on your behalf.

We use this access only to search for and parse order, sale, payout, and shipping confirmation emails from supported marketplaces (currently eBay, Depop, Vinted, Poshmark, Mercari, Grailed, Etsy and Whatnot) and to extract order details such as item names, prices, fees, shipping information, and buyer identifiers so they can be turned into structured sales records inside your ResellIQ dashboard. For low-confidence parses we may temporarily store a sanitised version of the email HTML for review, which is automatically deleted after 30 days. We do not read, store, index, or process emails from senders that are not on our marketplace allow-list. Your Gmail OAuth tokens (access and refresh tokens) are encrypted at rest using AES-256 encryption and are accessible only to authorised server-side processes.

Google API Services User Data Policy — Limited Use disclosure. ResellIQ’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from Gmail through Google APIs is used only to provide and improve user-facing features of ResellIQ that are visible in our interface (parsed orders, sales, payouts and associated reporting). We do not use Gmail data to serve advertisements; we do not transfer Gmail data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger or acquisition with appropriate notice; we do not allow humans to read Gmail data unless we have obtained your explicit consent for specific messages, it is necessary for security purposes (such as investigating abuse), required by law, or the data has been aggregated and anonymised; and we do not use Gmail data to develop, improve, or train generalised AI or machine-learning models.

When you choose “Import from Google Drive” in bulk photo import, ResellIQ asks Google for access using Google’s sign-in window, which shows the exact permission we request and the Google Account involved. You then pick photos in Google’s own file picker.

We request the following scope: https://www.googleapis.com/auth/drive.file. This lets ResellIQ open only the individual files you select in Google’s picker. We cannot see, list, or open any other file or folder in your Google Drive, and we never create, modify, share, or delete files in your Google Drive. To save your phone’s data and battery, our servers download the photos you pick directly from Google Drive: your browser sends the short-lived Google access token (valid for up to one hour) with the list of picked files, and we use it only to fetch those files in that request. We never store or log the token. If our servers can’t process a photo, your browser downloads it instead. The photos are then handled exactly like photos you upload from your device: they are stored in your ResellIQ account and analysed to create item drafts.

When a picked photo becomes an item in your inventory, we record that photo’s Google Drive file ID and file name against your account, so we can skip it the next time you import from Drive. You can review and revoke ResellIQ’s access at any time at myaccount.google.com/permissions.

Google API Services User Data Policy — Limited Use disclosure. ResellIQ’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained from Google Drive through Google APIs is used only to provide and improve user-facing features of ResellIQ that are visible in our interface (item photos and drafts in your inventory). We do not use Google Drive data to serve advertisements; we do not transfer Google Drive data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger or acquisition with appropriate notice; we do not allow humans to read Google Drive data unless we have obtained your explicit consent, it is necessary for security purposes (such as investigating abuse), or it is required by law; and we do not use Google Drive data to develop, improve, or train generalised AI or machine-learning models.

If you connect your eBay account, ResellIQ initiates an eBay OAuth 2.0 authorisation flow. We request only the scopes required to sync your listings, orders, sold-history and selling-account data (including sell.inventory, sell.account, sell.fulfillment, commerce.identity.readonly and the read-only buy/browse scopes). We store the resulting access and refresh tokens encrypted at rest using AES-256 and use them to sync your eBay listings, orders, and sold comparable data. We do not use these tokens to make purchases on your behalf. If you disconnect your eBay account from your ResellIQ settings, we revoke the tokens with eBay and delete your eBay connection data. You can also revoke ResellIQ’s access at any time from your eBay account settings.

The ResellIQ Chrome extension runs only on supported ResellIQ, Vinted, Depop, and eBay UK pages relevant to the workflow you start. Depending on the action you choose, it may receive listing data from your ResellIQ inventory page, read publicly visible listing data from a Depop product page for import, or populate the Vinted, Depop, or eBay sell form for you. Data involved may include the item title, description, brand, size, condition, colour, price, category selections, hashtags, and product photos.

The extension uses Chrome permissions as follows: storage and unlimitedStorage to hold pending listing payloads and temporary image data in chrome.storage.local; activeTab and tabs to detect, reuse, or open the supported Vinted, Depop, or eBay tab you asked us to use; and narrowly scoped host permissions to run the autofill and import scripts only on supported ResellIQ, Vinted, Depop, eBay, and the image hosts your own photos are served from. We do not use these permissions to monitor unrelated browsing activity, read browsing history, or capture passwords or keystrokes from unrelated sites.

For cross-listing, listing data is passed between the ResellIQ web page and the installed extension on your device so the destination form can be completed on Vinted, Depop, or eBay. Product photo URLs may be fetched by the ResellIQ page and converted into browser-local data URLs before autofill so marketplace upload fields can be populated correctly. For import workflows, publicly visible Depop listing data is only added to your ResellIQ account if you choose to import it.

Autofill reliability reporting.When the extension fills a marketplace form, it sends us a short report on how that run went so we can tell when a marketplace changes its page and breaks autofill. The report records which fields we attempted, and for each one whether it filled, could not be found, or did not match an option the marketplace offers — along with the run outcome, how long it took, and the extension version. Where a value could not be matched, the report names that value, because knowing that a colour like "Charcoal gray" is not on Vinted's list is the only way we can correct the mapping for everyone. That means these reports can contain your own item attributes: a colour name, a size, a category term. They do not contain your photos, prices, descriptions, buyer information, marketplace passwords or marketplace session tokens, and they are not enough to reconstruct a listing. Reports are stored in ResellIQ's own database, are never sold or shared with third parties, and are used only to keep cross-listing working.

Marketplace sign-in check. So we can tell you which marketplaces you need to sign in to before you start a cross-list rather than after it fails, the extension can check whether you are currently signed in to Vinted and eBay UK in this browser. It does this by requesting one page from each site with your existing cookies attached, and reading only the response status — whether the site sent us to its sign-in page or not. No page content is read or stored, and no cookie value is ever accessed. Depop is deliberately not checked, because its bot protection gives the same answer whether you are signed in or not, so we tell you we could not check rather than guess. The result is held for a few minutes, is never sent to our servers, and the check runs only when you open the cross-listing page or ask us to check again.

The extension does not sell your data, inject third-party advertising trackers, or read content from websites outside the supported ResellIQ, Vinted, Depop, and eBay flows.

If you use the Vinted import feature, we retrieve publicly visible data from the Vinted seller profile URL you provide — including item titles, prices, brands, sizes, conditions, images, and listing URLs — and import them into your ResellIQ inventory. This retrieval is performed at your direction and on your behalf.

When you use AI features (item scanning, description generation, pricing analysis, the business assistant, screenshot analysis, or Pokemon vision), we send relevant data — which may include your item photos, item metadata, inventory context, and screenshots you provide — to OpenAI for processing. As of the date of this policy, OpenAI's API data usage policy states that API inputs and outputs are not used to train their models; however, OpenAI's policies may change and you should review their current terms if this is a concern. AI outputs including descriptions, price estimates, grading suggestions, and authenticity assessments are stored in our database alongside your item records.

We collect usage data including session identifiers, event names, page paths, user agent strings, screen dimensions, and timestamps. This data may be collected from both authenticated and anonymous users. We strip sensitive keys before storage. We do not use third-party advertising trackers. We use this data solely to understand how the Service is used and to improve it. Session identifiers are pseudonymous and do not directly identify you without cross-referencing other data.

Payment processing is handled entirely by Stripe. We do not see, store, or process your credit card number or bank details. We receive from Stripe your subscription status, plan, trial dates, and payment event notifications (successful payments, failures, refunds, and cancellations) which we store to manage your account.

If you submit feedback through the in-app widget, we collect your message, the page you were on, and optionally your email address if you choose to provide it. Providing your email is entirely voluntary and is used only if we need to follow up on your feedback.

We periodically collect publicly available sold listing data from eBay and, where configured, other marketplace sources via third-party services. This data is used to power pricing analysis and AI grounding features. It is aggregated market data and does not contain personal information.

If you connect a Shopify store to Store Sync, we hold details about your store and, for orders that pass through Store Sync, limited details about your customers. Section 4 explains what we hold, why, and for how long.

For personal data about your customers (the people who buy from your Shopify store), you, the merchant, are the data controller and we act as your data processor. We process that data only on your behalf and only for the purposes set out below. For data about you and your ResellIQ account, including the store details described in 4.9, we remain the controller as described in the rest of this policy.

For orders that contain products shared through Store Sync, we process the buyer's name and shipping address, and the order's line items and prices. We do not request buyers' email addresses or phone numbers, and we do not pass them to suppliers.

Only to create the matching order on the supplier's Shopify store so the supplier can ship it to your customer, and to pass tracking back to your order. We do not use your customers' details for marketing or analytics, and we never sell them.

The buyer's name and shipping address are deleted from ResellIQ as soon as the supplier's order has been created. Order records without personal data (order numbers, items, quantities and wholesale prices) are kept for as long as your store uses Store Sync, so we can produce payout statements. If an order is never sent to the supplier (for example, because it was cancelled first, or sending it failed), the name and address are deleted then. Whatever happens, we never keep a buyer's name and address for more than 7 days: a daily check deletes any that are older.

The supplier whose products were ordered receives the buyer's name and shipping address on the order created in their own Shopify store, so they can ship it. Inside ResellIQ, buyer details are not visible to other users and are only accessed by our systems to create the supplier order. The supplier's order does not send any emails to your customer.

Each time our systems read a buyer's name and shipping address, whether from your Shopify store, to create the supplier's order, or to answer a customer data request, we record it in a log with the store it relates to and the reason it was read.

We respond automatically to Shopify's customer data request, customer deletion and shop deletion notices. When one of your customers asks to see their data, we email you, the merchant, what Store Sync holds about them so you can pass it on. When a customer asks for their data to be deleted, we delete their name and shipping address from the matching Store Sync orders. Shopify's notices can include a customer's email address or phone number; we don't store them. We keep a record that each request happened and what we did, without the customer's details. If your customers contact us directly, we will refer them to you.

Store Sync data is encrypted in transit and at rest. Shopify access tokens are additionally encrypted by our application using AES-256-GCM before they are stored. Store Sync data is held in tables that other ResellIQ users cannot read.

When you connect a store, we hold: your store's Shopify domain and name, its currency, and your encrypted Shopify access tokens; whether you are a supplier or a reseller and the settings you choose; records of your connections with suppliers or resellers and of the products linked between stores; order and payout records without customer personal data; the status of your Store Sync plan as Shopify reports it (not your payment details, which Shopify holds); and sync logs recording what Store Sync did on your store and when. If you set up Store Sync from Shopify without a ResellIQ account, we create one from your store's email address. We use your ResellIQ account email to send you Store Sync notices, such as a new reseller waiting for approval, an order that needs attention, a store that needs reconnecting, or a plan that needs choosing.

To run Store Sync we use Supabase (database), Vercel (hosting) and Resend (email to merchants, including any customer data request we pass on to you; your customers are never emailed by Store Sync). Section 12 explains how we protect data that these providers process outside the United Kingdom. Shopify is the platform you connect: your store and your customers' orders are held by Shopify under your own agreement with Shopify.

You can revoke our access at any time by uninstalling the app in Shopify. When you uninstall, we delete your store's access tokens straight away and pause Store Sync for that store. Shopify sends a shop deletion notice 48 hours after uninstall; when we receive it, we delete the data we hold for that store, including its connections, product links, orders, payout records and sync logs.