Privacy Policy

This Privacy Policy explains how Sellway collects, uses, stores, and protects information in connection with the platform.

• The seller is the data controller for all buyer data collected through their Sellway-powered checkout.
• Sellway acts as a data processor on behalf of the seller, processing buyer data solely to facilitate order creation and fulfillment.

Buyers wishing to exercise data rights should contact the seller directly.

From sellers:

• Name and email address
• Login credentials - passwords are handled by our managed auth provider (hashed, never stored in plain text by Sellway)

From buyers (on behalf of sellers):

• Full name
• Delivery address, city, state, zip/postal code, country
• Phone number

• Payment card numbers, CVVs, or any financial credentials — handled entirely by Stripe
• Sensitive personal data such as national ID numbers, health information, or biometric data

• Seller account data is used to authenticate and manage dashboard access
• Buyer data is stored and displayed to the relevant seller solely for order fulfillment
• No data is used for advertising, profiling, or sold to any third party

• All data is stored in Supabase with row-level security
• Buyer data is isolated per seller through unique owner and product identifiers
• Data is retained for as long as the seller's account is active, or as required to resolve disputes

• Stripe — for payment processing only
• The seller — buyer data is visible to the seller who owns that product listing
• No data is shared with advertisers, data brokers, or any other third parties

Sellway relies on the following sub-processors to operate the platform. Each processes data only as needed to provide its service:

• Supabase (database, authentication) - hosted in Singapore
• Cloudflare (hosting, CDN, WAF)
• Cloudflare R2 (product/digital file storage - private, zero egress)
• Backblaze B2 (encrypted database backups only)
• Stripe (payment processing, on the seller's own connected account)
• Email delivery providers (configured per seller, e.g. Brevo or Resend)
• Groq (chatbot AI responses)
• Sentry (error monitoring - strictly necessary)
• PostHog (optional product analytics - activated only with your consent)

Strictly necessary cookies are always used - they keep you signed in securely (session tokens in httpOnly cookies) and cannot be disabled.

Product analytics (PostHog autocapture) is opt-in. It activates only if you press "Accept all" in the consent banner, and stays off if you choose "Essential only". You can change your choice any time by clearing your browser storage for this site and reloading.

No advertising or cross-site tracking cookies are ever used.

• All traffic is encrypted in transit (TLS); payment gateway credentials are encrypted at rest with AES-256-GCM
• Database access is protected by row-level security on every table
• Auth sessions live in httpOnly, Secure, SameSite cookies - JavaScript never holds raw tokens

In the event of a personal-data breach affecting you, Sellway will notify affected users without undue delay. Material cyber incidents affecting the platform are assessed and reported to the relevant authorities as required under applicable law.

Under applicable data-protection law, you may exercise the following rights by contacting the Grievance Officer:

• Access - obtain a summary of the personal data we hold about you
• Correction & erasure - correct inaccurate data or request deletion, subject to statutory retention obligations (e.g. tax and invoice records)
• Grievance redressal - complaints are acknowledged within 48 hours and resolved within one month

Buyers should contact the seller who processed their order first; Sellway assists sellers in fulfilling buyer requests as their processor.

• Operational telemetry (rate-limit buckets, presence heartbeats, sent email queue rows) is pruned automatically within hours to weeks
• Analytics events and access logs are retained for up to 90-180 days, then deleted
• Order and invoice records are retained as required by tax law; when an account is deleted, personal identifiers in those records are anonymized while financial totals are preserved for the books

Sellway may update this Privacy Policy from time to time. Updates will be posted on the platform with a revised date.

This Privacy Policy is governed by the governing law as stated in your agreement with Sellway. (Legal review needed: insert governing law and forum before relying on this clause.)