Privacy Policy

1. What We Collect

• Account data: email address, name, and password (hashed — never stored in plain text)
• Subscription billing data: processed entirely by Stripe. We never store full card numbers. We retain only non-sensitive references (Stripe customer ID, subscription status) needed to manage your subscription.
• Store connection data: your Shopify or WooCommerce domain and OAuth access tokens. Tokens are stored encrypted in Supabase and used solely to sync inventory and order data to power the Service.
• Supplier data: supplier names, email addresses, and product links you enter. This is used to send purchase order emails on your behalf.
• AI interaction data: messages you send to the AI assistant, inventory analysis requests. These may be sent to our AI provider (xAI/Grok) in anonymized form to generate responses.
• Usage data: IP address, browser type, pages visited, and session metadata, collected by Vercel and Supabase for infrastructure and fraud prevention.
• SMS number (Pro plan): if you enable SMS notifications, we collect your phone number and pass it to Twilio to send alerts. We do not store SMS message content beyond delivery confirmation.

2. What We Do NOT Collect or Process

• We do not collect, process, hold, or transmit purchase order payments. You pay suppliers directly using their preferred method (bank transfer, PayPal, wire, etc.). REUP is a coordination platform — money never flows through us.
• We do not store customer payment card numbers or bank account details.
• We do not sell your data to third parties.

3. How We Use Your Information

• Provide and operate the Service (inventory analysis, PO automation, supplier email coordination, dropship order routing)
• Send transactional emails (digest summaries, low-stock alerts, PO status updates) via Resend
• Send SMS notifications (Pro plan) via Twilio
• Process subscription billing via Stripe
• Prevent fraud, abuse, and unauthorized access
• Comply with applicable legal obligations

4. Third-Party Services We Use

• Supabase — database and authentication
• Stripe — subscription billing only
• xAI / Grok — AI-powered inventory analysis and digest generation (anonymized queries)
• Resend — transactional email delivery
• Twilio — SMS notifications (Pro plan only)
• Vercel — hosting and infrastructure
• Shopify / WooCommerce — accessed via OAuth tokens you authorize

5. Data Storage & Security

• Data stored in Supabase (US regions) with row-level security — each user can only access their own data
• Store API tokens encrypted at rest
• All traffic served over HTTPS
• We apply reasonable technical and organizational security measures

6. Internal Support Access

To provide customer support and troubleshoot issues, authorized REUP support staff may access your account data, including inventory levels, order history, supplier information, and account settings. All support access is logged and auditable. Support staff cannot view your payment credentials, API tokens, store passwords, or your customers' personal financial information.

7. Your Rights

• Access, correct, or delete your data — email Support@getreup.ai
• GDPR and CCPA rights apply where applicable — contact us to exercise them
• You can disconnect your store integrations at any time from Dashboard → Integrations
• You can cancel your subscription at any time from Dashboard → Settings → Manage Subscription

8. Children's Privacy

We do not knowingly collect personal data from anyone under 13 (or 16 in applicable regions). If we discover such data has been collected, we will delete it promptly.

9. Changes to This Policy

We may update this policy. Material changes will be communicated by posting the updated policy here with a new effective date. Continued use of the Service constitutes acceptance.