Privacy Policy
Effective: May 15, 2026
Seller Suburban ("Seller Suburban," "we," "us," or the "Service") is an inventory and listing tool operated at sellersuburban.com(the "Operator") for the eBay seller account "Seller Suburban." This Privacy Policy explains what data we collect, how we use it, how we share it, how long we keep it, and your rights. By using the Service you agree to this Policy.
The Service integrates with eBay using eBay's public APIs in accordance with the eBay API License Agreement, the eBay Developer Program Agreement, and the eBay User Privacy Notice. eBay's own notice governs data eBay collects when you interact with eBay directly.
1. Information We Collect
- Operator account data. Email address and a bcrypt password hash for users authorized to operate the Service.
- eBay authorization credentials.When you grant consent via eBay's OAuth flow, we store the encrypted (AES-256-GCM) refresh token plus short-lived access tokens for the Operator's own eBay seller account.
- Listing and inventory data you author. UPC/GTIN, title, condition, price, quantity, photos, descriptions, templates, locations.
- Operational telemetry. Request IDs, timestamps, sanitized eBay API request/response metadata used for debugging and audit.
- Server logs. IP address (used only for rate limiting and abuse detection), user agent, request path.
2. Information We Do Not Collect
- We do not collect, store, or persist eBay buyer personally identifiable information (name, postal address, phone, email, message content, or order details).
- We do not store payment instrument data; eBay processes payments directly.
- We do not act on behalf of any seller other than the Operator's own eBay account. The Service is single-tenant.
- We do not use third-party analytics, advertising trackers, or data brokers.
- We do not knowingly collect data from children under 16.
3. How We Use Information
- Create, update, and publish listings to the Operator's eBay account.
- Synchronize local inventory quantities with eBay when sales are reported.
- Allow Operator and authorized users to manage their own drafts and inventory.
- Generate audit logs of who changed what and when.
- Protect the Service from abuse via rate limiting and bot mitigation.
We do not use eBay user data for marketing, profiling, advertising, model training, or any purpose beyond what is necessary to operate the integration the Operator authorized.
4. How We Share Information
- eBay.Listing payloads, inventory updates, and webhook acknowledgments are transmitted to eBay's APIs as directed by the Operator.
- Infrastructure providers. Cloudflare (TLS termination and DDoS protection) and the underlying hosting provider (compute and storage). These providers only process data as needed to deliver the Service and are bound by their own data-protection commitments.
- Legal compliance. We may disclose information if required by valid legal process or to enforce our terms.
- We do not sell or rent personal information. We do not share data with third parties for cross-context behavioral advertising.
5. Data Retention
- Operator account records: while the account is active.
- eBay refresh tokens: until the Operator disconnects, the Operator's eBay account revokes consent, or the token expires per eBay's schedule (~18 months).
- Listing and inventory records: retained for ongoing operations; may be soft-deleted (hidden from active views but retained for audit history).
- Operational telemetry and server logs: up to 90 days.
- Backups: encrypted and retained up to 14 days.
6. Security
- TLS 1.2/1.3 in transit, Cloudflare Origin Certificate end-to-end.
- bcrypt password hashing for Operator credentials (cost factor 12).
- AES-256-GCM encryption at rest for eBay refresh tokens.
- Strict Content Security Policy, HSTS preload, and CSRF protection.
- Server-side input validation, HTML sanitization, and parameterized database queries.
- Database and queue are isolated to an internal Docker network with no public exposure.
- Daily encrypted database backups with documented restore procedure.
No system is perfectly secure. We will notify affected users without undue delay if we become aware of a security incident materially affecting them.
7. Cookies and Tracking
The Service sets only a strictly necessary HTTP-only, SameSite=Lax session cookie used for authentication. We do not use advertising cookies, third-party analytics, web beacons, or cross-site tracking technologies.
8. Your Rights
Depending on your jurisdiction (e.g., GDPR/UK GDPR or CCPA/CPRA) you may have the right to:
- Access, correct, or delete the personal information we hold about you.
- Receive a portable copy of your data.
- Restrict or object to processing.
- Withdraw consent at any time (eBay consent: revoke via your eBay account).
- Lodge a complaint with a supervisory authority.
- California residents: we do notsell or share personal information for cross-context behavioral advertising, so no "Do Not Sell or Share" mechanism is necessary.
To exercise these rights, contact us at the address below. We will respond within the timelines required by applicable law.
9. eBay Marketplace Account Deletion
The Service does not store eBay buyer personal data and claims exemption from Marketplace Account Deletion notifications. As a defensive measure we operate a deletion notification endpoint at /api/ebay/account-deletionthat validates eBay's challenge handshake and logs any deletion events received. If a deletion event ever references local data, the matching records will be anonymized or removed within 30 days.
10. International Transfers
The Service is operated from the United States. If you access it from outside the U.S., your information is transferred to and processed in the U.S.
11. Children's Privacy
The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
12. Contact
Privacy contact: [email protected].
13. Changes
We may update this Policy from time to time. Material changes will be posted at this URL with a new "Effective" date. Continued use of the Service after a change constitutes acceptance of the revised Policy.