Privacy Policy - Seller's Bay

1. Information We Collect

We collect several types of information from and about users of our Service:

1.1 Personal Information

Account Information: When you register, we collect your name, email address, password, and other contact details.
Payment Information: When you purchase credits, subscribe to our service, or sign up for a trial, we collect payment details through our secure payment processor (Stripe). For paid trial sign-ups, we process a verification charge (with discount applied to first month) and store payment information for automatic billing after the trial period.
Store Information: When connecting your WooCommerce store, we collect your store URL and API credentials.

1.2 Usage Data

Product Data: Information about products you import or manage through our Service.
AI Requests: Content you submit for AI processing and the resulting outputs.
Log Data: Information about your usage of our Service, including IP address, browser type, referring pages, and timestamps.
Cookies and Similar Technologies: Information collected through cookies and similar tracking technologies.

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our Service
Process transactions and manage your account
Communicate with you about your account, updates, and support
Connect with your WooCommerce store and sync product data
Process AI requests and generate the content, recommendations, or analysis requested by the user
Monitor service usage and ensure compliance with our Terms of Service
Detect, prevent, and address technical issues or fraudulent activities

3. How We Share Your Information

We may share your personal information with:

Service Providers: Third-party vendors who provide services on our behalf (e.g., payment processing, hosting, analytics)
AI Partners: When you use our AI features, your content may be processed by our AI service providers (e.g., OpenAI, Google Cloud Vision)
Business Partners: When necessary to provide integrated services you've requested
Legal Requirements: When required by law or to protect our rights

We do not sell your personal information to third parties.

4. Google User Data

Seller's Bay lets you sign in with Google and, if you choose, connect your own Google account to Marketing Reports for read-only Google Search Console reporting. This section describes how we handle Google user data for the integrations that are currently enabled.

4.1 OAuth scopes used for Search Console (Marketing Reports)

When you connect Google Search Console in Marketing Reports, Seller's Bay may request these OAuth scopes:

openid
email
profile
https://www.googleapis.com/auth/webmasters.readonly

openid, email, and profile: identify the Google account you approved during OAuth and show which Google account is connected in Seller's Bay.
webmasters.readonly: provides read-only access to the Search Console properties and reporting data available to that Google account.

Seller's Bay cannot modify your Search Console settings or data through this scope. After connecting, you select the exact Search Console property used for your reports.

4.2 Google sign-in (optional)

If you choose Sign in with Google, Seller's Bay uses your Google account identifier, name, and email address only to authenticate you and manage your Seller's Bay account. This sign-in flow does not request Search Console access.

4.3 Search Console data we may access

If you connect Google Search Console, we access read-only data for the Search Console property you select, such as:

Property identifiers (for example URL-prefix or sc-domain: properties)
Search performance metrics such as queries, pages, clicks, impressions, CTR, and average position

We do not modify your Search Console settings or data. Access is read-only.

4.4 Why we use Google data

To authenticate your Seller's Bay account when you choose Google sign-in
To display Marketing Reports you request for your selected Search Console property
To refresh those reports while your connection remains authorized

4.5 How Google OAuth tokens are stored

Search Console OAuth access and refresh tokens are stored in our database in the oauth_tokens table under the google_search provider.
Each Seller's Bay user has separate token records per connected Google service.
Access and refresh tokens are encrypted at rest using libsodium authenticated encryption and a dedicated server secret (OAUTH_TOKEN_ENCRYPTION_KEY).
We do not store your Google password.

4.6 How data is separated between users

Google tokens, selected Search Console properties, and imported report data are stored and queried per Seller's Bay user account. One customer cannot access another customer's Google connection, selected property, or report data through the application.

4.7 How we do not use Google user data

We do not sell Google user data.
We do not use Google user data for advertising or ad targeting.
We do not use Google user data to build unrelated user profiles.

4.8 How to disconnect or revoke access

In Seller's Bay, open Marketing Reports Settings and click Disconnect for Google Search Console.
In your Google Account, visit Google Account permissions and remove Seller's Bay access.

4.9 Future Google integrations

Google Merchant Center integration is planned but is not currently available. Seller's Bay does not request the Merchant Center content OAuth scope while that feature is disabled.

4.10 Google API Services User Data Policy

Seller's Bay use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Other API Integrations

Our Service also integrates with:

WooCommerce: When you connect your WooCommerce store, we access your store data through their API. Your API credentials are encrypted and securely stored.
OpenAI: Content submitted for AI processing is sent to OpenAI to generate the content, recommendations, or analysis you request. We limit the personal information shared with OpenAI to what is necessary for the service. Seller's Bay does not use your content to train its own AI models.
Stripe: Payment information is processed securely by Stripe. We do not store your full credit card details.

6. Data Retention

We retain your personal information for as long as necessary to provide you with our Service and as needed to comply with our legal obligations.

You can request deletion of your account and personal information at any time. However, some information may be retained for legitimate business or legal purposes.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information. These include:

Encryption of sensitive data at rest and in transit
Regular security assessments and updates
Access controls and authentication requirements
Secure handling of API credentials

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Your Privacy Rights

Depending on your location, you may have rights regarding your personal information, including:

The right to access your personal information
The right to correct inaccurate information
The right to delete your personal information
The right to restrict or object to processing
The right to data portability
The right to withdraw consent

To exercise these rights, please contact us using the information in Section 12.

Account Deletion

We offer two methods for closing your account:

Temporary Deactivation: Your account data is preserved but inaccessible until you reactivate by logging in.
Permanent Deletion: Your data will be permanently deleted after a 30-day grace period. During this period, you can cancel the deletion request.

When your account is permanently deleted, we will:

Delete all your personal information from our active databases
Archive limited information for legal and accounting purposes
Retain anonymized data that cannot be linked back to you

You can initiate account deletion from your Account Settings page. Please note that some information may persist in backup copies for a limited time after deletion.

9. Children's Privacy

Our Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

10. International Data Transfers

Your personal information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.

When we transfer your personal information internationally, we take appropriate safeguards to ensure your information receives adequate protection.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date.

We encourage you to review this Privacy Policy periodically for any changes. Your continued use of our Service after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Email: privacy@sellersbay.com
Address: Seller's Bay
3 Green Street
Waterford City
Ireland
X91 NY5A