Data processing statement
Last updated October 31, 2026
Draft. This page isn’t in effect yet. It will be once it names the company that runs Lot Master, and shops will be told by email when it is.
Shops keep personal data about other people in Lot Master: buyers, contacts, consignors and newsletter subscribers. This statement sets out how Lot Master (“we”) handles that data for each shop (“you”). It’s part of the terms of service, and it applies wherever data protection law, such as the GDPR or the California Consumer Privacy Act, asks for an agreement like it.
Who decides what
You decide what personal data goes into your shop and what it’s for, so you’re the controller (or “business”). We store and process it on your behalf, so we’re your processor (or “service provider”). Data about sellers’ own accounts is covered by the privacy policy instead.
What we process
- Whose data: your buyers and contacts, consignors, people who write to you through your website, newsletter subscribers and your staff.
- What data: names, email addresses, phone numbers, shipping addresses, eBay usernames, messages, purchase history and your notes about them.
- Why: only to provide Lot Master to you: storing your records, running your website and checkout, syncing with eBay, sending your email and newsletters, and support.
- How long: for as long as you use Lot Master, then deleted as the privacy policy describes.
What we promise
- We process your data only to provide the service and as you instruct through the app, unless the law requires otherwise.
- We never sell it, use it for advertising, or use it for our own purposes beyond running and securing the service.
- Everyone at Lot Master who can reach it is bound to keep it confidential.
- We keep it secure: encrypted in transit, each shop’s records kept apart from the others’ by the database, access limited to the people who need it, and staff access logged.
- We help you answer requests from people to see, correct, export or delete their data. Most of this you can do yourself in the app; for the rest, email us.
- If we learn of a breach affecting your data, we tell you without undue delay, and within 72 hours, with what we know and what we’re doing about it.
- When you leave, we delete your data, or give you an export first if you ask.
- We’ll give you the information you reasonably need to show you’re meeting your own obligations.
Services we use
You allow us to use these services (“subprocessors”) to run Lot Master. Each is bound by a contract to protect the data at least as well as we do.
| Service | What it does for us | What it handles |
|---|---|---|
| Supabase | Database and sign-in | Everything a shop keeps in the app: accounts, inventory, people, sales, settings |
| Vercel | Hosting for the app and shop websites | Every request passes through it, including the visitor’s IP address |
| Cloudflare | Photo storage (R2), domain names, and the bot check on signup (Turnstile) | Item photos; the signup visitor’s browser and IP address for the bot check |
| Stripe | Subscription billing, and website checkout on each shop’s own Stripe account | Owners’ billing details; buyers’ payment and shipping details at checkout |
| Resend | Sending email: sign-in links, receipts, alerts, contact form messages and shop newsletters | Recipients’ email addresses and the email itself while it’s sent; shops’ newsletter subscriber lists |
| OpenAI and Anthropic | Reading item photos to suggest a title and description, only when a seller asks | The item’s photos and the details already typed in. Neither may train on it. |
| Sentry | Error tracking | Technical details of an error and the shop it happened in. Names, emails and cookies are removed first. |
| Featurebase | Support chat, the support inbox and the help center | A seller’s name, email, shop and plan, and whatever they write to support |
Before we add or replace one, we’ll update this list and tell shop owners by email at least 30 days ahead. If you object for a good reason and we can’t resolve it, you can cancel and we’ll refund any prepaid time you haven’t used.
Where data is processed
Lot Master runs mainly in the United States, and some of the services above work worldwide. When data from the European Economic Area, the United Kingdom or Switzerland goes elsewhere, it’s protected by the European Commission’s standard contractual clauses or another safeguard the law recognizes.
Your part
You confirm that you have a lawful reason to keep the personal data you put into Lot Master, that you’ve told people what your shop does with it, and that newsletter subscribers asked to hear from you.