In plain words: We keep what we need to run a marketplace — your account, orders and addresses. Your card number never touches us (it goes straight to Stripe), we don’t sell your data, and if a seller links their Shopify store we see their products and stock, never their customers. This summary is here to get you oriented — the full text below is the binding version.
What we collect
Account data (name, email), listings and shop content, orders and shipping addresses, reviews/reports/messages, and technical basics (IP, device, pages viewed). Payment card numbers never touch our servers — they go directly to Stripe. Seller identity/KYC documents go directly to Stripe Identity; we never see them.
How we use it
To run the marketplace: process orders, release payouts, send transactional email (Resend), prevent fraud, moderate reports, and improve the product. We do not sell your personal data.
AI & automated decision-making
IonxSupply does not currently use artificial intelligence or automated decision-making on your personal data — no AI chatbots, no algorithmic profiling, no AI-generated content from your information. If we ever add an AI-powered feature, this policy will be updated to name it and what data it touches before the feature launches.
Processors
Supabase (database & auth), Stripe (payments, payouts, identity), Resend (email), Vercel (hosting), and Shopify where a seller chooses to connect their store. Each processes data under its own DPA; data may be processed in the United States.
Shopify connections (seller-optional). If a seller connects their Shopify store, we store an encrypted access token and read their products and inventory only, and write inventory back so stock stays accurate in both places. We deliberately do not request order or customer access, so we never receive their buyers’ names, emails, addresses, or payment details. Product images we import are copied into our own storage. A seller can disconnect at any time from their dashboard, or remove IonxSupply from their Shopify apps — either kills our access immediately, and disconnecting deletes the stored token.
Cookies
We use essential cookies only: session authentication and security. No third-party advertising cookies.
Retention & deletion
Order records are kept 7 years for tax and dispute purposes. Everything else lives as long as your account does. Email us to request access, correction, or deletion of your data (GDPR/CCPA-style requests honored); order records required by law survive deletion.
Uploaded files: when you delete a listing, its photos are deleted from storage; when your account is deleted, your uploads (shop logos, banners, review photos) are deleted with it. Public marketplace images (product photos, shop branding) are hosted publicly by design — never upload personal documents; we will remove any we find. Identity documents never touch our storage at all — they go directly to Stripe.
Contact
Privacy requests: support@ionxsupply.com.