This privacy policy describes how Deltapp ("we", "us", "Deltapp") processes personal data when you visit our website, sign up for an account, or use the application. It is written to meet UK GDPR, EU GDPR, and US state privacy law (including the California Consumer Privacy Act as amended) transparency requirements. Different sections apply depending on where you live: the EU and UK rights in section 6 apply to users in those regions, and the US state rights in section 7 apply to US residents.
1. Who we are
Deltapp is operated by an independent software developer established in Bulgaria (European Union). For privacy enquiries or to exercise your data rights, email privacy@deltapp.io.
For most of what you do here, Deltapp is the data controller of your account data (your name, email, login, eBay connection, and how you use the app). For the buyer personal data that flows through your orders (buyer names and delivery addresses synced from eBay), Deltapp acts as a data processoron your behalf: you, the seller, are the controller of your buyers' data.
2. Data we collect
- Account data: name, email, and authentication metadata. Passwords are hashed by our authentication provider Clerk using industry-standard algorithms; Deltapp never stores or sees plaintext passwords.
- Connected store data: eBay store ID, OAuth tokens (encrypted at rest), policy and listing data necessary to provide the service.
- Product data: ASINs, scraped Amazon product information, prices, your draft and published listings.
- Order data: eBay orders synced into the platform, buyer name and shipping address (data minimised - we only store what we need to fulfil orders).
- Usage data: IP address, browser metadata, timestamps, structured logs of your actions in the app.
- Analytics data (optional, consent-based): if you accept analytics cookies on our marketing site, Google Analytics 4 collects pseudonymous usage events (pages viewed, device and browser type, approximate location derived from an IP address that Google does not retain). The lawful basis is your consent, which you can withdraw at any time via the cookie banner. Analytics does not run inside the signed-in app.
- Payment data: handled entirely by our payment processor; we never see card numbers.
3. How we use it
- Provide the service you signed up for (the lawful basis is contract performance).
- Send transactional emails (order alerts, stockout and repricing notices, account notices).
- Diagnose errors and prevent abuse (legitimate interest).
- Comply with legal obligations (record-keeping, tax).
We do notsell your data or train AI models on it. We use Google Analytics only for aggregate measurement with your consent; we do not enable Google's advertising or cross-site signals features, so your data is not used to target ads.
4. Sub-processors
We use a small number of trusted sub-processors to operate the service. Each is bound by a data processing agreement. See the live list on our sub-processors page.
5. Retention
- Account data is retained while the account is active.
- Activity logs are retained for 90 days, then deleted.
- Scrape attempt logs are retained for 30 days.
- Database backups are retained for 14 days before being overwritten.
- On account deletion we keep a 30-day recovery window during which you can reactivate your account. After that window we remove your personal data from live systems without undue delay and clear it from backups within 14 days, except where the law requires us to keep certain records (for example tax).
eBay buyer account closures:eBay notifies us when a buyer closes their eBay account or requests erasure (the eBay Marketplace Account Deletion notification). On receipt we anonymise that buyer's personal data (name, delivery address, username, and message content) across all affected seller accounts, retaining only the anonymised transactional record needed for sellers' accounting.
6. Your rights (EU and UK)
Under UK and EU GDPR you have the right to access, correct, erase, restrict, port, and object to processing of your personal data. Email privacy@deltapp.io to exercise any of these rights. You also have the right to complain to a supervisory authority. Our lead authority is the Bulgarian Commission for Personal Data Protection (CPDP); if you are in the UK or another EU country, you may also complain to your local authority (in the UK, the ICO).
7. US state privacy rights (California and other states)
If you are a resident of California or another US state with a comprehensive privacy law (for example Virginia, Colorado, Connecticut, Texas, Oregon, and a growing list of others), you have specific rights over your personal information. This section applies on top of, not instead of, the rest of this policy.
Categories of personal information we collect
In the last 12 months we have collected: identifiers (name, email, account ID, IP address, eBay store ID); commercial information (your subscription tier, and the listings and orders you manage in the app); internet or network activity (app usage events, logs, and, only if you opt in on our marketing site, pseudonymous analytics); and approximate, city-level geolocation derived from IP address (never precise location). We do not build inferences or profiles about you. We do not collect sensitive personal information (we do not collect government IDs, precise location, race, health, biometric, neural, or similar data, and we do not ask for it).
We collect this information from you directly, from your connected eBay account (which you authorize), and automatically as you use the app. We use it for the business purposes described in section 3 (running the Service, support, security, billing, and legal compliance). We disclose it only to the sub-processors listed on our sub-processors page, who act for us under contract.
We do not sell or share your personal information
We do not sell or share your personal information, and we have not done so in the preceding 12 months. We do not exchange it for money, and we do not share it for cross-context behavioral advertising or targeted advertising. Our marketing-site analytics runs only with your consent, has Google's advertising and cross-site signals features turned off, and is not used to target ads. We also do not sell or share the personal information of anyone under 16.
Your rights
Subject to verification and to the exceptions in the applicable law, you may:
- know or access the categories and specific pieces of personal information we hold about you, and how we use and disclose it;
- delete the personal information we collected from you;
- correct inaccurate personal information;
- opt out of any sale or sharing and limit use of sensitive personal information (because we do not sell or share and do not collect sensitive personal information there is nothing to opt out of here, but the right stands if our practices ever change); and
- not be discriminated against for exercising any of these rights.
How to exercise them
Email privacy@deltapp.io from the address on your account, or, where the law allows, ask an authorized agent to submit the request for you. We will confirm receipt, may need to verify your identity against your account before acting, and will respond within the timeframe your state's law requires (45 days in California, extendable once where permitted). You may make a request twice in any 12-month period at no charge.
Appeals
If we decline your request and your US state grants an appeal right (for example Virginia, Colorado, and Connecticut), you may appeal by replying to our decision email, and we will respond with our reasoning. If you remain unsatisfied you may contact your state Attorney General.
Opt-out preference signals
We honor browser opt-out signals such as Global Privacy Control (GPC) on our marketing site as a valid request to opt out of sale or sharing where the law requires it. Since we do not sell or share, accepting a GPC signal simply confirms our existing default.
8. Children's privacy
Deltapp is a business tool for online sellers and is intended for adults aged 18 or over. The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18. We do not sell or share the personal information of minors. If you believe a child has provided us personal information, email privacy@deltapp.io and we will delete it promptly.
9. Automated processing and your data
Deltapp automates routine selling tasks for you: it syncs prices and stock, applies the repricing rules you configure, and refreshes listings. These are deterministic, rules-based actions that run on your own settings and on product data. They are not profiling of any person, and they do not make legal or similarly significant decisions about you or about your buyers. We do not use automated decision-making that produces legal effects on individuals, and we do not use your personal data to train AI models. You stay in control of your pricing rules and can change or pause them at any time in the app.
Do Not Track and Global Privacy Control.Browsers can send "Do Not Track" or Global Privacy Control (GPC) signals. There is no industry-standard response to Do Not Track, so like most services we do not respond to it differently, but it does not matter here: our non-essential analytics stays off until you opt in on the cookie banner, so nothing is tracked by default. Where state law requires us to treat a GPC signal as an opt-out of sale or sharing, we honor it; because we do not sell or share, this matches what we already do.
10. International transfers
Where sub-processors are located outside the UK / EEA, transfers are protected by Standard Contractual Clauses or adequacy decisions. Details on the sub-processors page.
11. Security
Encryption in transit (TLS 1.2+) and at rest. Role-based access. Audit trails. Sentry captures errors without sensitive payloads. See our security page.
12. Changes
We update this policy as the product evolves. Material changes are emailed to account holders at least 14 days before they take effect.