How we collect, use, and protect your information
Effective Date: October 12, 2026 Version: 2.8
InVelocity ("we," "us," or "our") operates the InVelocity inventory management platform (the "Service") at https://invelocity.app. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.
By using the Service, you agree to the collection and use of information in accordance with this Policy.
As described in our Terms of Service (Section 8), we collect anonymized data to power our Market Intelligence system:
This data is stripped of all identifying information before aggregation.
We use your information for the following purposes:
| Purpose | Data Used | Legal Basis | |---------|-----------|-------------| | Provide the Service — manage inventory, sync marketplaces, process checkout | Account info, inventory data, photos, marketplace credentials, sales records | Contract performance | | AI-powered features — card identification, pricing analysis, listing optimization | Product photos, inventory data (card names, sets, conditions) | Contract performance | | Market Intelligence — aggregate pricing, trends, velocity metrics | Anonymized sales, cost, engagement data | Legitimate interest | | Process subscriptions — manage billing, enforce usage limits | Account info, subscription status, inventory count | Contract performance | | Communicate — service updates, support responses, security alerts | Email address, support messages | Contract performance / Legitimate interest | | Improve the Service — analyze usage patterns, fix bugs, enhance features | Usage data, error data, device info | Legitimate interest | | Security — detect fraud, prevent abuse, protect accounts | IP address, usage patterns, login activity | Legitimate interest | | Legal compliance — tax obligations, regulatory requirements | Transaction records, account info | Legal obligation |
We do not sell your personal information to third parties. We do not use your personal information for targeted advertising.
We share your information only in the following circumstances:
When you use AI-powered features (card identification, pricing suggestions, listing optimization), your data may be processed by:
Data sent to AI providers includes product photos, card names, set names, card numbers, and listing content. These features do not send personal information (name, email, payment data) to AI providers.
AI chat assistant. The chat assistant on our website and in the app is an AI, not a person. Your chat messages, and anything you choose to include in them (such as your name or email address), are processed by an AI provider to generate replies. See Section 11.
When you connect marketplace accounts:
When you create a Customer account on an InVelocity-powered storefront, your information is shared with the Store Owner who operates that storefront:
| Data Shared with Store Owner | Purpose | |------------------------------|---------| | Name, email, phone | Customer identification and communication | | Shipping address | Order fulfillment | | Order details (items, quantities, prices) | Transaction records and fulfillment | | Trade-in submissions (items, photos, notes) | Trade-in evaluation and processing |
Multi-store accounts: Your Customer account works across all InVelocity-powered storefronts. When you interact with a new storefront, your basic profile information (name, email, phone, shipping address) is shared with that Store Owner. Each Store Owner only sees your activity on their storefront — they cannot access your interactions with other Store Owners.
Store Owner responsibilities: Store Owners are independent data controllers for the customer data they receive through their storefronts. They are responsible for their own compliance with applicable privacy laws regarding your information.
Payment data: Storefront purchases are processed through Stripe, Inc. via the Store Owner's connected Stripe account. InVelocity does not store your payment card information. See Stripe's privacy policy at https://stripe.com/privacy.
Anonymized, aggregated data is shared with other InVelocity users to power pricing recommendations and market trends. Your personal information, store identity, and customer details are never included.
We may disclose information when required by law, court order, subpoena, or governmental authority, or when we believe disclosure is reasonably necessary to protect our rights, your safety, or the safety of others.
In connection with a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as a business asset. We will notify you via email and/or prominent notice before your information is transferred and becomes subject to a different privacy policy.
We do not share your information for advertising purposes.
If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:
You may request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collection, and the categories of third parties with whom we share it.
You may request that we delete the personal information we have collected from you, subject to certain exceptions (e.g., data required for legal compliance, completing transactions, or security purposes). Anonymized data already contributed to Market Intelligence cannot be deleted as it is no longer associated with your identity.
You may request that we correct inaccurate personal information we maintain about you. You can also correct most account and inventory information directly through the Service.
We do not sell or share (as defined by CCPA) your personal information, and we do not use it for cross-context behavioral advertising. Because no sale or sharing is taking place, there is no opt-out to offer.
Between July 21 and October 8, 2026, the Exact Match Marketing visitor script on our website (invelocity.app, not the InVelocity app) linked website visitor data — a visitor ID, a daily-changing hash of your IP address, your browser's user agent, the pages you viewed and, for a small number of visitors, an email address, name and in some cases phone number entered in a form on our website — into Exact Match Marketing's cross-customer identity graph, which Exact Match uses for its own identity-resolution purposes. That was a disclosure of personal information to a third party for its own use, and it stopped on October 8, 2026. Exact Match has since deleted the records that script created from our website. On October 8, 2026, it deleted the identity records of every visitor it had seen only on our website, and on October 12, 2026, the records of visits and page views, the device records of those visitors, the links between our website and visitors it had also seen on other websites that use its service, and the contact details a small number of those visitors had entered in our form. Device records for visitors Exact Match had also seen on other websites remain; none of them is linked to our website. If you visited our website in that period and believe a record of your visit remains, email [email protected]; we will pass your request to Exact Match Marketing, which can delete records matched to the visitor ID stored in your browser (the _em_vid cookie). We will confirm when it is done.
We do not collect or process "sensitive personal information" as defined by CCPA (e.g., Social Security numbers, financial account credentials, precise geolocation, racial/ethnic origin). If this changes, we will provide a mechanism to limit use.
We will not discriminate against you for exercising your CCPA rights. Exercising your rights will not affect your Service access, pricing, or quality.
InVelocity uses AI-powered automated processing for:
These automated processes assist your business decisions but do not make autonomous decisions that produce legal or similarly significant effects. All AI-generated output is presented as suggestions that you review and may accept, modify, or reject. You retain full control over pricing, listing, and inventory decisions.
If you have questions about our automated processing or wish to request information about the logic involved, contact us at [email protected].
To exercise any of these rights, contact us at [email protected]. We will verify your identity and respond within 45 days of receiving your request. If we need additional time, we will notify you in writing of the extension (up to an additional 45 days) and the reason for the delay. You may also designate an authorized agent to submit requests on your behalf.
During our service suspension. The InVelocity app is currently suspended, so in-app tools for exporting, correcting, or deleting your data are unavailable. Send any request to know, delete, correct, or receive a copy of your personal information to [email protected]. We will respond within 45 days, as described above.
For CCPA disclosure purposes, we collect the following categories:
| Category | Examples | Source | Purpose | Shared With | |----------|----------|--------|---------|-------------| | Identifiers | Email, name, IP address | You, automatic | Account, service delivery | Firebase, Resend, Whop (past subscribers only) | | Commercial information | Inventory, prices, sales, purchases | You, eBay, Shopify | Service delivery, analytics | eBay, Shopify, AI providers | | Internet/electronic activity | Usage data, feature interactions, errors, website page views, website visitor ID cookie | Automatic | Service improvement, security, measuring how visitors find our website | Sentry, Render, Google Analytics, Vercel, Exact Match Marketing (EM VIP) | | Chat communications | Chat messages, visitor ID, referral source, approximate location (city level) | You, automatic | Answering questions, follow-up | Total Chat, Anthropic, Langfuse, Voyage AI | | Sensory data | Product photos | You | Card identification, listings | Cloudinary, AI providers, eBay, Shopify | | Professional/employment info | Store name, business details | You | Service customization | None |
We do not collect: Social Security numbers, driver's license numbers, financial account numbers, precise geolocation, racial/ethnic origin, biometric data, health information, sexual orientation, or union membership.
We retain your personal information according to the following schedule:
| Data Category | Retention Period | Reason | |---------------|-----------------|--------| | Account information | Duration of account + 90 days after deletion | Service provision + deletion processing | | Inventory and listing data | Duration of account + 90 days after deletion | Service provision | | Product photos | Duration of account + 30 days after deletion | Cloudinary cleanup cycle | | Sales and transaction records | Duration of account + 7 years after deletion | Tax and legal compliance (IRS record-keeping) | | Usage and analytics data | 24 months from collection | Service improvement | | Error monitoring data (Sentry) | 90 days from collection | Bug fixing and reliability | | AI processing logs | 30 days from processing | Cost tracking and debugging | | Support communications | Duration of account + 1 year | Quality assurance | | AI chat transcripts | 90 days in full; after that, kept with contact details removed until deleted | Answering questions, quality assurance | | Chat visitor attribution data | Until deleted | Understanding how visitors find us | | Marketplace OAuth tokens | Until disconnection or account deletion | Marketplace integration | | Anonymized Market Intelligence data | Indefinite | Not associated with your identity |
Upon account deletion request, we delete or anonymize your personal information within the timeframes above, except where retention is required by law.
We implement commercially reasonable technical and organizational security measures to protect your personal information:
No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data using industry-standard practices.
In the event of a data breach involving your personal information, we will:
We use cookies and similar technologies for:
| Service | Data Collected | Privacy Policy | |---------|---------------|----------------| | Google Analytics 4 (Google LLC) | Page views, session duration, user interactions, device/browser info. IP addresses are anonymized. | google.com/policies/privacy | | Umami (self-hosted on Hub infrastructure) | Page views, referrers, device type. Privacy-first; no cross-site tracking; no cookies; no personal data stored. | umami.is/privacy | | Vercel Web Analytics (Vercel Inc.) | Page views: page URL, referrer, approximate location (country, region, city), browser, operating system and device type. No cookies; visitors are counted with a hash of the request that is discarded after 24 hours, and results are reported only in aggregate. | vercel.com/legal/privacy-policy | | EM VIP visitor pixel (Exact Match Marketing, Inc.) | On invelocity.app only, not inside the InVelocity app. One image request per page view, which sends the page URL (including any ad click identifier such as gclid or fbclid), your browser's user-agent (browser and device type) and your IP address. Exact Match checks the IP address against ip-api.com, a third-party IP-lookup service, to classify the network it comes from (for example a data centre or proxy) so that bot and invalid traffic can be excluded; it keeps that classification with the visit record for 90 days and keeps the IP address itself only as a hash that changes daily. ip-api.com states that it holds the queried address in memory for up to one minute and does not log requests. The pixel sets a first-party visitor ID cookie (_em_vid) that lasts 90 days. It does not read anything you type into forms. We use it to count visits and see which pages and ad campaigns bring visitors to us. | exactmatch.io/legal/privacy |
Apart from the EM VIP pixel, we do not use tracking pixels, and we do not place advertising cookies from ad networks on our website.
You can control cookies through your browser settings, including blocking or deleting the _em_vid cookie. Disabling essential cookies may prevent you from using the Service. You may opt out of Google Analytics tracking at tools.google.com/dlpage/gaoptout.
We do not respond to Do Not Track signals. When your browser sends a Global Privacy Control signal, the Exact Match visitor beacon does not load on our website.
The Service integrates with the following third-party services, each with their own privacy policies:
| Service | Purpose | Privacy Policy | |---------|---------|---------------| | Firebase / Google | Authentication | https://firebase.google.com/support/privacy | | eBay | Marketplace integration | https://www.ebay.com/help/policies/member-behaviour-policies/user-privacy-notice-privacy-policy?id=4260 | | Shopify | Marketplace integration | https://www.shopify.com/legal/privacy | | OpenAI | AI card identification & analysis | https://openai.com/policies/privacy-policy | | Anthropic | AI processing (fallback) | https://www.anthropic.com/policies/privacy | | Whop | Payment processing (past subscriptions only) | https://whop.com/privacy | | Total Chat | AI chat assistant | https://thetotal.chat/privacy | | Cloudinary | Photo storage | https://cloudinary.com/privacy | | Sentry | Error monitoring | https://sentry.io/privacy/ |
We encourage you to review the privacy policies of any third-party services you interact with through InVelocity.
Our website and app include a chat assistant. The assistant is an AI, not a person. It is labeled as an AI assistant, and it says so before you send your first message. When you use it:
Do not include payment card numbers, passwords, or other sensitive information in chat messages.
Your information is transferred to and processed in the United States, where our servers and service providers are located. If you are located outside the United States, your use of the Service constitutes consent to transfer your information to the United States. We do not currently target users in the European Economic Area or rely on Standard Contractual Clauses or other GDPR transfer mechanisms.
Regardless of your location, you may:
We will respond to data rights requests within 45 days.
The Service is designed for business use by adults and is not directed to children under 18. We do not knowingly collect personal information from anyone under 18 years of age. If you believe someone under 18 has provided us with personal information, contact us at [email protected] and we will promptly delete it.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notification at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy. We will maintain an archive of prior versions upon request.
For privacy-related questions, data rights requests, or concerns:
InVelocity Email: [email protected] Website: https://invelocity.app
© 2026 InVelocity. All rights reserved.