Privacy Policy — InVelocity

Effective Date: March 10, 2026 Version: 2.0

---

1. Introduction

InVelocity ("we," "us," or "our") operates the InVelocity inventory management platform (the "Service") at https://invelocity.app. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this Policy.

2. Information We Collect

2.1 Information You Provide

• Account information: Email address and display name when you register via Firebase Authentication (Google SSO or email/password).
• Profile information: Store name, business details, and preferences you configure in Settings.
• Payment information: Handled directly by Whop, Inc. (our Merchant of Record). We do not store your payment card data. We receive subscription status, plan tier, and membership identifiers from Whop.
• Communications: Messages you send us through the in-app support widget, email, or other channels.
• Inventory data: Product information you enter or import, including card names, set names, conditions, quantities, cost basis, selling prices, SKUs, and custom notes.
• Product photos: Images you upload of collectible items for inventory tracking and AI-powered identification. Photos are stored via Cloudinary, a third-party media management service.
• Storefront customer information: If you create a Customer account on an InVelocity-powered storefront, we collect your email address, name, phone number (optional), and shipping address (when provided at checkout). Your Customer account works across all InVelocity-powered storefronts.
• Marketplace credentials: eBay OAuth tokens and Shopify access tokens (encrypted at rest) when you connect marketplace integrations.
• Listing content: Titles, descriptions, item specifics, and shipping preferences for marketplace listings.
• Sales records: Transaction data from point-of-sale checkout and marketplace order synchronization.

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, time spent, actions performed, and interactions with the Service.
• Device information: Browser type, operating system, screen resolution, IP address, and device identifiers.
• Error and performance data: Application errors and performance metrics collected via Sentry (our error monitoring service) to maintain Service reliability. Sentry is configured to exclude personally identifiable information (PII) from error reports.
• Cookies and session data: See Section 9 (Cookies and Tracking).

2.3 Information from Third Parties

• eBay: When you connect your eBay account, we receive your eBay username, user ID, active listings, order history, and seller analytics via the eBay API.
• Shopify: When you connect your Shopify store, we receive product listings, inventory levels, order data, and location information via the Shopify Admin API.
• TCGPlayer: We retrieve publicly available product catalog data and market pricing from TCGPlayer to power pricing analytics. No personal data is exchanged with TCGPlayer.

2.4 Market Intelligence Data

As described in our Terms of Service (Section 8), we collect anonymized data to power our Market Intelligence system:

• Anonymized sales data (sale prices, sale dates — no seller identity)
• Anonymized cost basis information (acquisition costs)
• Anonymized engagement metrics (views, watchers, days listed)

This data is stripped of all identifying information before aggregation.

3. How We Use Your Information

We use your information for the following purposes:

| Purpose | Data Used | Legal Basis | |---------|-----------|-------------| | Provide the Service — manage inventory, sync marketplaces, process checkout | Account info, inventory data, photos, marketplace credentials, sales records | Contract performance | | AI-powered features — card identification, pricing analysis, listing optimization | Product photos, inventory data (card names, sets, conditions) | Contract performance | | Market Intelligence — aggregate pricing, trends, velocity metrics | Anonymized sales, cost, engagement data | Legitimate interest | | Process subscriptions — manage billing, enforce usage limits | Account info, subscription status, inventory count | Contract performance | | Communicate — service updates, support responses, security alerts | Email address, support messages | Contract performance / Legitimate interest | | Improve the Service — analyze usage patterns, fix bugs, enhance features | Usage data, error data, device info | Legitimate interest | | Security — detect fraud, prevent abuse, protect accounts | IP address, usage patterns, login activity | Legitimate interest | | Legal compliance — tax obligations, regulatory requirements | Transaction records, account info | Legal obligation |

We do not sell your personal information to third parties. We do not use your personal information for targeted advertising.

4. How We Share Your Information

We share your information only in the following circumstances:

4.1 AI Processing Providers

When you use AI-powered features (card identification, pricing suggestions, listing optimization), your data may be processed by:

• OpenAI, L.L.C. ("OpenAI") — Primary AI provider. Processes product photos and inventory text data. OpenAI does not use API data to train its models. See: https://openai.com/policies/api-data-usage-policies
• Anthropic, PBC ("Anthropic") — Secondary/fallback AI provider. Processes the same data types when the primary provider is unavailable. Anthropic does not use API data to train its models. See: https://www.anthropic.com/policies/privacy

Data sent to AI providers includes product photos, card names, set names, card numbers, and listing content. We do not send personal information (name, email, payment data) to AI providers.

4.2 Marketplace Platforms

When you connect marketplace accounts:

• eBay, Inc. — Receives listing data, photos, prices, quantities, and order fulfillment information via the eBay API.
• Shopify Inc. — Receives product data, inventory levels, and pricing via the Shopify Admin API.

4.3 Service Infrastructure Providers

• Google / Firebase — Authentication services (processes email address and login credentials).
• Whop, Inc. — Merchant of Record for payment processing (receives email, subscription tier, membership data).
• Cloudinary Ltd. — Photo storage and processing (receives uploaded product photos).
• Render Services, Inc. — Backend hosting and PostgreSQL database hosting (processes all Service data).
• Vercel Inc. — Frontend hosting (processes browser requests and static assets).
• Upstash, Inc. — Redis caching service (processes temporary session and cache data).
• Sentry (Functional Software, Inc.) — Error monitoring (receives anonymized error reports; PII excluded by configuration).
• Resend, Inc. — Transactional email delivery (receives email addresses for Service communications).

4.4 Store Owners (Storefront Customers)

When you create a Customer account on an InVelocity-powered storefront, your information is shared with the Store Owner who operates that storefront:

| Data Shared with Store Owner | Purpose | |------------------------------|---------| | Name, email, phone | Customer identification and communication | | Shipping address | Order fulfillment | | Order details (items, quantities, prices) | Transaction records and fulfillment | | Trade-in submissions (items, photos, notes) | Trade-in evaluation and processing |

Multi-store accounts: Your Customer account works across all InVelocity-powered storefronts. When you interact with a new storefront, your basic profile information (name, email, phone, shipping address) is shared with that Store Owner. Each Store Owner only sees your activity on their storefront — they cannot access your interactions with other Store Owners.

Store Owner responsibilities: Store Owners are independent data controllers for the customer data they receive through their storefronts. They are responsible for their own compliance with applicable privacy laws regarding your information.

Payment data: Storefront purchases are processed through Stripe, Inc. via the Store Owner's connected Stripe account. InVelocity does not store your payment card information. See Stripe's privacy policy at https://stripe.com/privacy.

4.5 Market Intelligence

Anonymized, aggregated data is shared with other InVelocity users to power pricing recommendations and market trends. Your personal information, store identity, and customer details are never included.

4.6 Legal Requirements

We may disclose information when required by law, court order, subpoena, or governmental authority, or when we believe disclosure is reasonably necessary to protect our rights, your safety, or the safety of others.

4.7 Business Transfers

In connection with a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as a business asset. We will notify you via email and/or prominent notice before your information is transferred and becomes subject to a different privacy policy.

We do not share your information for advertising purposes.

5. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

5.1 Right to Know

You may request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collection, and the categories of third parties with whom we share it.

5.2 Right to Delete

You may request that we delete the personal information we have collected from you, subject to certain exceptions (e.g., data required for legal compliance, completing transactions, or security purposes). Anonymized data already contributed to Market Intelligence cannot be deleted as it is no longer associated with your identity.

5.3 Right to Correct

You may request that we correct inaccurate personal information we maintain about you. You can also correct most account and inventory information directly through the Service.

5.4 Right to Opt-Out of Sale/Sharing

We do not sell or share (as defined by CCPA) your personal information for cross-context behavioral advertising. There is nothing to opt out of.

5.5 Right to Limit Use of Sensitive Personal Information

We do not collect or process "sensitive personal information" as defined by CCPA (e.g., Social Security numbers, financial account credentials, precise geolocation, racial/ethnic origin). If this changes, we will provide a mechanism to limit use.

5.6 Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA rights. Exercising your rights will not affect your Service access, pricing, or quality.

5.7 Automated Decision-Making Technology (ADMT)

InVelocity uses AI-powered automated processing for:

• Card identification: Analyzing product photos to identify trading cards (game, set, card name, card number).
• Pricing suggestions: Analyzing market data and sales history to recommend selling prices.
• Listing content generation: Generating listing titles, descriptions, and item specifics from catalog data.
• Product matching: Matching user inventory to product catalog entries using text and image analysis.

These automated processes assist your business decisions but do not make autonomous decisions that produce legal or similarly significant effects. All AI-generated output is presented as suggestions that you review and may accept, modify, or reject. You retain full control over pricing, listing, and inventory decisions.

If you have questions about our automated processing or wish to request information about the logic involved, contact us at [email protected].

5.8 How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected]. We will verify your identity and respond within 45 days of receiving your request. If we need additional time, we will notify you in writing of the extension (up to an additional 45 days) and the reason for the delay. You may also designate an authorized agent to submit requests on your behalf.

5.9 Categories of Personal Information

For CCPA disclosure purposes, we collect the following categories:

| Category | Examples | Source | Purpose | Shared With | |----------|----------|--------|---------|-------------| | Identifiers | Email, name, IP address | You, automatic | Account, service delivery | Firebase, Whop, Resend | | Commercial information | Inventory, prices, sales, purchases | You, eBay, Shopify | Service delivery, analytics | eBay, Shopify, AI providers | | Internet/electronic activity | Usage data, feature interactions, errors | Automatic | Service improvement, security | Sentry, Render | | Sensory data | Product photos | You | Card identification, listings | Cloudinary, AI providers, eBay, Shopify | | Professional/employment info | Store name, business details | You | Service customization | None |

We do not collect: Social Security numbers, driver's license numbers, financial account numbers, precise geolocation, racial/ethnic origin, biometric data, health information, sexual orientation, or union membership.

6. Data Retention

We retain your personal information according to the following schedule:

| Data Category | Retention Period | Reason | |---------------|-----------------|--------| | Account information | Duration of account + 90 days after deletion | Service provision + deletion processing | | Inventory and listing data | Duration of account + 90 days after deletion | Service provision | | Product photos | Duration of account + 30 days after deletion | Cloudinary cleanup cycle | | Sales and transaction records | Duration of account + 7 years after deletion | Tax and legal compliance (IRS record-keeping) | | Usage and analytics data | 24 months from collection | Service improvement | | Error monitoring data (Sentry) | 90 days from collection | Bug fixing and reliability | | AI processing logs | 30 days from processing | Cost tracking and debugging | | Support communications | Duration of account + 1 year | Quality assurance | | Marketplace OAuth tokens | Until disconnection or account deletion | Marketplace integration | | Anonymized Market Intelligence data | Indefinite | Not associated with your identity |

Upon account deletion request, we delete or anonymize your personal information within the timeframes above, except where retention is required by law.

7. Data Security

We implement commercially reasonable technical and organizational security measures to protect your personal information:

• Encryption in transit: All data transmitted between your browser and our servers uses TLS 1.2+.
• Encryption at rest: Marketplace OAuth tokens and sensitive credentials are encrypted using AES-256 before database storage.
• Authentication: Firebase Authentication with secure session management, CSRF protection, and rate-limited login endpoints.
• Access controls: Role-based access controls and principle of least privilege for internal systems.
• Infrastructure security: Hosted on Render (SOC 2 Type II compliant) and Vercel with automated security patching.
• Error monitoring: Sentry configured with PII scrubbing — request bodies, auth headers, cookies, and breadcrumb data are stripped from error reports.
• Regular reviews: Periodic security audits, dependency vulnerability scanning, and code review.

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data using industry-standard practices.

8. Data Breach Notification

In the event of a data breach involving your personal information, we will:

• Notify affected users via email within 30 days of discovering the breach, as required by California Civil Code § 1798.82.
• Describe the nature of the breach, the categories of information affected, and steps we are taking to address it.
• Provide guidance on steps you can take to protect yourself.
• Notify the California Attorney General if the breach affects more than 500 California residents.

9. Cookies and Tracking

We use cookies and similar technologies for:

• Essential cookies: Maintain your login session (Firebase Auth session tokens), remember CSRF tokens, and store user preferences.
• Analytics: We use the following analytics services to understand how the Service is used and improve it:

| Service | Data Collected | Privacy Policy | |---------|---------------|----------------| | Google Analytics 4 (Google LLC) | Page views, session duration, user interactions, device/browser info. IP addresses are anonymized. | google.com/policies/privacy | | Umami (self-hosted on Hub infrastructure) | Page views, referrers, device type. Privacy-first; no cross-site tracking; no cookies; no personal data stored. | umami.is/privacy | | Microsoft Clarity (Microsoft Corp.) | Session recordings, heatmaps, click/scroll behavior, rage clicks. Personal information is masked by default. | privacy.microsoft.com | | Microsoft Bing (Microsoft Corp.) | Conversion tracking and search analytics via Universal Event Tracking (UET). | privacy.microsoft.com |

We do not use third-party advertising cookies, tracking pixels for advertising purposes, or cross-site tracking technologies.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using the Service. You may opt out of Google Analytics tracking at tools.google.com/dlpage/gaoptout.

10. Third-Party Services

The Service integrates with the following third-party services, each with their own privacy policies:

| Service | Purpose | Privacy Policy | |---------|---------|---------------| | Firebase / Google | Authentication | https://firebase.google.com/support/privacy | | eBay | Marketplace integration | https://www.ebay.com/help/policies/member-behaviour-policies/user-privacy-notice-privacy-policy?id=4260 | | Shopify | Marketplace integration | https://www.shopify.com/legal/privacy | | OpenAI | AI card identification & analysis | https://openai.com/policies/privacy-policy | | Anthropic | AI processing (fallback) | https://www.anthropic.com/policies/privacy | | Whop | Payment processing | https://whop.com/privacy | | Cloudinary | Photo storage | https://cloudinary.com/privacy | | Sentry | Error monitoring | https://sentry.io/privacy/ |

We encourage you to review the privacy policies of any third-party services you interact with through InVelocity.

11. Support Widget

Our in-app support widget allows you to contact us directly. When you use the support widget:

• Your message and email address are transmitted to our support system.
• Messages are processed through a security gateway before reaching support staff.
• Support conversations may be retained for quality assurance purposes per the retention schedule in Section 6.

12. International Data Transfers

Your information is transferred to and processed in the United States, where our servers and service providers are located. If you are located outside the United States, your use of the Service constitutes consent to transfer your information to the United States. We do not currently target users in the European Economic Area or rely on Standard Contractual Clauses or other GDPR transfer mechanisms.

13. Your Rights and Choices

Regardless of your location, you may:

• Access and update your account and inventory information through the Service at any time.
• Delete your account by contacting us at [email protected]. We will delete your data per the retention schedule in Section 6.
• Export your data — download your inventory data in CSV format through the Service.
• Disconnect integrations — revoke eBay or Shopify access at any time through Settings.
• Opt out of marketing emails by clicking the unsubscribe link in any marketing email. Administrative communications (security alerts, policy updates, service changes) cannot be opted out of.
• Request a copy of your personal data by contacting us.
• Correct inaccurate personal information by contacting us or editing it directly in the Service.

We will respond to data rights requests within 45 days.

14. Children's Privacy

The Service is designed for business use by adults and is not directed to children under 18. We do not knowingly collect personal information from anyone under 18 years of age. If you believe someone under 18 has provided us with personal information, contact us at [email protected] and we will promptly delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notification at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy. We will maintain an archive of prior versions upon request.

16. Contact Us

For privacy-related questions, data rights requests, or concerns:

InVelocity Email: [email protected] Website: https://invelocity.app