Privacy policy

Sellers’ own accounts. When you sign up, invite staff or pay for a plan, we decide what’s kept and are responsible for it.

What a shop keeps about its business. Inventory, buyers, contacts, sales and newsletter subscribers belong to the shop. The shop decides what goes in, and we store and process it for them. The data processing statement covers this. If you bought from a shop or wrote to one, that shop is the one to ask first about your details.

• Accounts: your name, email address, the shops you’re in and your role in each. Passwords are stored only as a secure hash.
• Shop records: items and their photos, storage locations, costs, consignors, notes, sales and reports.
• People: buyers and contacts a shop adds by hand or that come in through its website, with their name, email, phone number and the shop’s notes; messages sent through a shop’s contact form or item inquiries; and newsletter subscribers.
• eBay: when a seller connects eBay, a token that lets us act on their eBay account (encrypted at rest), and their listings, orders, fees and buyers’ eBay usernames.
• Website checkout: what was bought, the amount and the buyer details Stripe passes back, such as name, email and shipping address. Card numbers go straight to Stripe and never reach us.
• Billing: each owner’s plan and Stripe customer reference. Card details stay with Stripe.
• Email records: for each email sent for a shop, the recipient’s address, the subject, the kind of email, when it was sent and whether it was delivered, opened, bounced or reported as spam. We keep these to help shops with email problems. The contents of the email aren’t kept.
• Security and errors: a one-way hash of the IP address of each signup attempt, to stop abuse, and reports of errors in the app. Error reports carry the shop they happened in but no names, email addresses or cookies.

Cookies. We use cookies to keep you signed in, to sign you out after a long idle spell, and to carry you safely through connecting eBay or Stripe. Shop websites set none unless the owner is previewing a theme. There are no advertising or analytics cookies.

• To run the app and the shop websites, which is the service sellers sign up for.
• To list, update and end items on eBay and bring orders back, when a seller connects eBay and asks us to.
• To send the email the app sends: sign-in links, receipts, alerts, contact form messages and shop newsletters.
• To bill for plans, answer support requests, keep the service secure and meet our legal obligations.

We don’t sell personal data, and we don’t use it for advertising.

These services run parts of Lot Master for us and only use the data to do that:

When a seller connects eBay, we send their listings to eBay and read their orders from it on their behalf. eBay’s own privacy notice covers what eBay does with it. We may also share data when the law requires it, or to protect the safety of our users or the public.

• Account and shop records: while the account is open.
• Email records: 90 days, then deleted automatically.
• Signup attempt records: one day.
• After a shop is closed and asks to be deleted: its records and photos are deleted within 30 days, and backups that still hold them are overwritten within 30 days after that.
• Billing records: as long as tax and accounting law requires.

• Sellers: export your inventory any time from Settings. To close a shop and delete its data, or delete your account, email support@lotmaster.app from the account’s address.
• Buyers and contacts of a shop: ask the shop, since it controls those records. If you can’t reach them, email us and we’ll help.
• Newsletter subscribers: every newsletter has an unsubscribe link, which takes you off that shop’s list at once.

You can also ask us what we hold about you, or to correct it. Depending on where you live, for example in California or the European Union, the law may give you further rights. We answer every request within 30 days and won’t treat you differently for making one.

We subscribe to eBay’s notices of deleted accounts. When eBay tells us someone has deleted their eBay account, we delete them as a buyer from every shop and remove their eBay username from order records. This happens automatically, usually within minutes.

Data is encrypted on its way to and from us, and eBay tokens are encrypted at rest as well. Each shop’s records are kept apart from every other shop’s by the database itself. Our staff look at a shop’s data only to give support or keep the service running, and those actions are logged.

Lot Master is for businesses. Sellers must be at least 18, and we don’t knowingly keep data about children under 13.

When this policy changes, the date at the top changes too. If a change matters, for example a new kind of data or a new service handling it, we’ll tell sellers by email or in the app before it takes effect.

Questions or requests: support@lotmaster.app.