ThriftShopper Privacy Notice

Effective Date: November 1, 2025
Last Updated: December 15, 2025

ThriftShopper Inc. ("ThriftShopper," "we," "us," or "our") operates an online marketplace and related services that connect buyers and sellers of secondhand, vintage, and collectible items, as well as a newsletter and related content (together, the "Services").

This Privacy Notice explains how we collect, use, share, and protect personal information when you:

• Visit our website or mobile experience
• Create a buyer or seller account
• List or purchase items on ThriftShopper
• Subscribe to our newsletter
• Communicate with us or with other users through our Services

We respect your privacy and aim to be transparent about our data practices in compliance with laws like the EU's GDPR and California's CCPA/CPRA. We collect only what we need to operate and improve ThriftShopper and never sell your personal information.

1. Information We Collect

1.1 Information You Provide to Us

Account & Profile Information

When you register for a ThriftShopper account (as a buyer, seller, or both), we may collect:

• Name
• Email address
• Username or display name
• Password (stored in encrypted form)
• Profile details (photo, bio, city/state, links, preferences)
• Whether you are a "founding seller," "founding buyer," or other special status

Marketplace Activity

When you use the marketplace features, we collect:

• Listing details: titles, descriptions, categories, prices, and item photos
• Favorites/wishlists and saved items
• Reviews, ratings, and feedback you leave
• Messages you send or receive through ThriftShopper (buyer–seller messaging)

Transactions & Payments

We use third-party payment processors (such as Stripe) to handle payments securely. When you buy or sell on ThriftShopper:

• Certain payment details (such as card number, bank account, or payout details) are collected and processed directly by Stripe or another payment provider, not by us.
• We may receive limited transaction information from the payment provider, such as:
  • Transaction amount and currency
  • Date and time of payment
  • Status (paid, refunded, failed)
  • Partial payment identifiers sufficient for reconciliation, not full card numbers

Newsletter and Marketing

If you subscribe to our newsletter or marketing emails, we collect:

• Email address
• Your content preferences (if you choose to provide them)
• Your marketing choices (e.g., whether you consent to receive promotional emails)

A standard line next to your checkbox could be:

"I agree to receive emails about ThriftShopper news, offers, and updates. You can unsubscribe anytime."

Customer Support & Communications

When you contact us (e.g., email, contact form, social media, in-app support), we collect:

• Your contact details (such as email address)
• The content of your messages or requests
• Any other information you voluntarily provide

1.2 Information Collected Automatically

When you use the Services, we automatically collect certain technical and usage data, such as:

• Device and browser information (IP address, browser type, operating system, device identifiers)
• Log data (pages viewed, features used, time and date of visits, referring/exit pages)
• Marketplace activity (searches, filters used, items viewed, clicks, scrolls, and other interactions)

We use cookies, pixels, and similar technologies for these purposes. This includes:

• Analytics cookies to understand how users interact with ThriftShopper (for example, via Google Analytics).
• Functional and security cookies to keep you logged in, protect your account, and help our Services run securely (for example, Cloudflare security cookies).

You can adjust cookie settings in your browser. Disabling some cookies may affect site functionality.

1.3 Information from Third Parties

We may receive information about you from:

• Payment providers (e.g., Stripe) for fraud prevention and to confirm payment or payout status.
• Email and newsletter platforms (e.g., Beehiiv) to manage subscriptions and track engagement (like open rates or link clicks in aggregate).
• Social networks or sign-in providers if we enable login via a third-party account (such as "Continue with Google"), according to their privacy policies and your settings.

1.4 Children's Privacy

Our Services are intended for adults (18+). We do not knowingly collect personal information from children under 16. If you are under 16, please do not create an account, subscribe, or provide us with personal data. If we learn that we have collected information from a child, we will delete it.

2. How We Use Your Information

We use the information we collect for the following purposes:

To Operate the Marketplace and Provide Services

• Create and manage your account
• Enable buyers to find, view, and purchase items
• Enable sellers to create listings, manage inventory, and receive payouts
• Facilitate buyer–seller communication and order fulfillment
• Process payments and refunds through our payment providers

To Communicate with You

• Send transactional emails (receipts, order updates, account notifications, policy updates)
• Respond to your questions, requests, and support inquiries
• Send newsletters and optional marketing communications, where you have given consent or where permitted by law

To Improve and Personalize ThriftShopper

• Analyze how users discover, browse, and use the marketplace
• Understand which listings or features are popular
• Debug and improve the performance, usability, and reliability of our Services
• Develop new features, tools, and experiences for buyers and sellers

Legal, Compliance, and Security

• Detect, prevent, and address fraud, spam, abuse, or security incidents
• Enforce our Terms of Use, seller rules, and other policies
• Comply with legal obligations and respond to lawful requests from authorities

We do not use your personal data for any purpose inconsistent with this Privacy Notice.

3. Legal Bases for Processing (GDPR/UK GDPR)

If you are in the EU/EEA or UK, our legal bases for processing your personal data include:

• Contract: To provide the Services you sign up for (e.g., operating your account, facilitating your purchases and sales).
• Consent: For optional marketing emails, certain cookies/analytics, and any processing where we specifically ask for your consent.
• Legitimate Interests: To improve our Services, ensure security, prevent fraud, and understand usage patterns, balanced against your rights and interests.
• Legal Obligation: To comply with applicable laws, regulations, and legal processes.

You can withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

4. Sharing and Disclosure

We do not sell your personal information.

We may share your information in the following limited circumstances:

Service Providers ("Processors")

We use third parties to help us run ThriftShopper, such as:

• Website hosting and infrastructure
• Database and storage providers
• Payment processors (e.g., Stripe)
• Email and newsletter platforms (e.g., Beehiiv)
• Analytics providers (e.g., Google Analytics)
• Customer support and security providers

These service providers access personal data only to perform services on our behalf and are obligated to protect it.

Buyer–Seller Interactions

When you buy or sell through ThriftShopper, limited information is shared to complete the transaction, which may include:

• Buyer's first name or username and shipping address to the seller
• Seller's display name and any contact details you choose to share in your listing or profile

We encourage all users to respect privacy and use information only for transaction-related purposes.

Aggregated and De-identified Data

We may share anonymized or aggregated data (for example, "X% of users favor vintage décor") with partners, sponsors, or in marketing materials. This data does not identify any individual.

Legal and Safety

We may share information if necessary to:

• Comply with the law, a subpoena, court order, or other legal process
• Protect the rights, property, or safety of ThriftShopper, our users, or the public
• Detect and address fraud, security, or technical issues

In the event of a merger, acquisition, or similar corporate transaction, your information may be transferred as part of that deal, subject to this Privacy Notice or a successor notice.

5. Cookies and Tracking Technologies

We use cookies and similar technologies:

• To keep you logged in and remember your preferences
• To secure our Services (e.g., Cloudflare)
• To understand site usage and performance (e.g., Google Analytics)

You can control cookies through your browser settings. Some browsers offer "Do Not Track" signals; at this time, our Services do not respond to every such signal, but you can still manage cookies and analytics preferences directly.

Google provides tools to opt out of Google Analytics in many browsers. For more details, see Google's explanation of how it uses data from partner sites and apps.

6. Data Security and Retention

We take reasonable precautions to protect your data, including:

• Encryption in transit (HTTPS)
• Limiting access to authorized personnel and service providers
• Using reputable third-party providers with their own security safeguards

No system is 100% secure, but we follow industry-standard practices to reduce risks.

We retain:

• Account and transactional data for as long as your account is active and as necessary to operate the marketplace and meet legal obligations (e.g., tax and accounting rules).
• Newsletter/marketing information until you unsubscribe or request deletion.
• Aggregated, de-identified analytics data for longer, where it does not identify you.

When we no longer need personal data, we take steps to delete or anonymize it.

7. Your Rights and Choices

Depending on where you live, you may have the following rights:

EU/UK (GDPR)

You may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion ("right to be forgotten") in certain circumstances
• Restrict or object to certain processing
• Request a portable copy of your data
• Withdraw consent where our processing is based on consent

You can also lodge a complaint with your local Data Protection Authority.

California (CCPA/CPRA)

California residents have the right to:

• Know what categories of personal information we collect, use, and disclose
• Access and obtain details about their personal information
• Request deletion of personal information (subject to certain exceptions)
• Correct inaccurate personal information
• Opt out of the "sale" or "sharing" of personal information, if applicable

We do not sell or share your personal information as those terms are defined under California law. If that ever changes, we will update this Notice and provide an opt-out mechanism.

Other Regions

Residents of other jurisdictions may have similar rights under local laws.

Exercising Your Rights

To exercise your privacy rights or ask questions about your data:

Email us at: support@thriftshopper.com

We may take steps to verify your identity before fulfilling your request. We will respond within a reasonable time and in accordance with applicable law.

You can also:

• Unsubscribe from marketing emails at any time by using the "unsubscribe" link in our emails or contacting us.
• Update certain account information directly in your ThriftShopper account settings.

8. International Data Transfers

ThriftShopper is based in the United States, and your information may be stored or processed there and in other countries where our service providers operate. These locations may have privacy laws that differ from those in your jurisdiction.

Where required by law, we use appropriate safeguards (such as standard contractual clauses) to protect personal data transferred across borders.

9. Changes to This Privacy Notice

We may update this Privacy Notice from time to time (for example, if we add new features or change how we process data). The "Effective Date" above tells you when it was last revised.

If we make material changes, we will notify you (for example, by email or by posting a prominent notice on our site). Your continued use of the Services after the effective date means you accept the updated Privacy Notice.

10. Contact Us

If you have questions, concerns, or requests related to this Privacy Notice or your personal data, please contact:

Email: support@thriftshopper.com

If you are an EU/UK resident, you may also contact your local Data Protection Authority or the UK's Information Commissioner's Office (ICO) for guidance.