Privacy Policy & Data Protection

1. Information We Collect

Depending on whether you participate as a Business Merchant, Salesperson, or Customer Buyer, we collect the following categories of data:

• Account & Identity Information: Full name, registered email address, company name, phone number, and password (stored exclusively as salted PBKDF2-SHA256 hashes with 600,000 iterations).
• Payment & Payout Details: Payout destination preferences (PayPal account email, Bank account/routing numbers, or Venmo/Zelle handles). All payment destination fields are encrypted at rest using authenticated AES-256-GCM encryption.
• ID Verification Documents: Tax ID/EIN, business registration, or government-issued identity documents uploaded during seller verification, protected via restricted access control.
• Click & Referral Attribution: Anonymous visitor session identifiers, referral slug tokens, browser device metadata, IP address (hashed for fraud prevention), and timestamp logs to reliably track 30-day affiliate cookie attribution.
• Customer Order & Shipping Details: Recipient full name, email address, phone number, and physical shipping address collected during product checkout. To safeguard customer privacy, recipient phone numbers and physical shipping addresses are stored using authenticated AES-256-GCM encryption at rest.
• AI Product Assistant Interactions: Product queries submitted to the "Ask CSN Product Assistant". Queries are processed server-side in a stateless request-in-response-out format with hashed response caching.

2. How We Use Your Information

We process your data for the following lawful business purposes:

3. Data Sharing & Third Parties

We do not sell, rent, or monetize your personal data. We share information only with trusted service providers necessary to operate the platform:

• Payment Processors (PayPal Holdings, Inc.): For processing checkout authorizations, webhook reconciliation, and automated commission transfers.
• Email Infrastructure (Resend Technologies): For transactional dispatch of OTP codes, password resets, and order receipts.
• Database & Cloud Infrastructure (Neon PostgreSQL & Vercel, Inc.): For secure, SOC-2 compliant serverless data hosting and edge runtime execution.
• Fulfilling Business Merchants: When a customer purchases a product, only the specific merchant responsible for fulfilling and shipping the order receives decrypted recipient shipping details (name, delivery address, phone) strictly for courier logistics and package delivery.
• Salespeople & Affiliates (Zero-PII Policy): Salespeople and affiliate referrers who promote products never receive customer Personally Identifiable Information (PII). Salesperson dashboards and audit logs strictly redact customer names, email addresses, phone numbers, and physical addresses, displaying only anonymized order identifiers, product titles, commission earnings, and fulfillment progress.

4. Data Retention & Security Encryption

- Encryption in Transit & at Rest: All traffic is enforced over TLS 1.3. Sensitive financial fields, authentication secrets, customer phone numbers, and delivery addresses are encrypted at rest using AES-256-GCM authenticated ciphers.

- Retention Period: Active account data is maintained for the lifetime of your account. Transaction ledger entries are retained for 7 years to comply with commercial tax and financial auditing standards.

5. Your Rights: Data Access, Export & Deletion

You have full ownership of your personal data. You may at any time:

• Request an export of all personal data held about your account.
• Request immediate deletion or anonymization of your profile and listings.
• Opt out of non-essential transactional digests.