Privacy Policy

1. Information We Collect

Information you provide directly

• Account registration (buyers and sellers): full name, email address, password (stored hashed — never in plaintext), and date of birth (used to determine minor status)
• Seller registration: store name, product descriptions, images and prices, payout information (processed securely through Stripe — we do not store bank account numbers), location (city, state, country), and LaunchX alumni status
• Minor seller registration: parent or guardian's full legal name, email, phone number, relationship to the seller, and signed parental consent record
• Purchases: shipping address (physical orders), email for order confirmation and digital delivery, and payment information (processed directly by Stripe — we never store card numbers)
• LaunchX Flagship external sales: when you buy through a LaunchX Flagship seller's LaunchX-hosted payment link on the seller's own website, LaunchX is the merchant of record and collects your payment and contact details through Stripe, the same as an on-platform purchase
• Communications: messages sent to hello@eshipx.com or through in-platform support and feedback forms

Information collected automatically

• Device information: browser type, operating system, device type
• Usage data: pages visited, time spent, actions taken (product views, searches, purchases)
• IP address: used for fraud detection, geographic location inference, and OFAC compliance screening
• Cookies: session cookies (required for login) and analytics cookies (optional) — see Section 7

Information from third parties

Stripe shares with us: account and customer IDs, transaction status and amount, payout status, and identity verification results (Stripe handles KYC; we receive a pass/fail result). We never receive your full financial data. We use HubSpot as our CRM, syncing your name, email, account type, and signup date. Their practices are governed by the Stripe and HubSpot privacy policies respectively.

2. How We Use Your Information

• Operate the Platform: create and manage accounts, process transactions, deliver digital products, and facilitate seller payouts through Stripe
• Minor seller compliance: determine whether a seller is under 18, trigger and track parental consent, and route payouts through guardian accounts
• Legal and safety compliance: OFAC sanctions screening, blocking sanctioned jurisdictions, IRS 1099-K reporting, and COPPA compliance (Section 5)
• Fraud prevention: detect fraudulent accounts, listings, and transactions, and enforce our Terms of Service
• Communication: transactional emails (order confirmations, shipping, receipts, digital delivery, payout notices), administrative emails (account status, moderation, consent renewals), and marketing emails only where you have opted in — you may opt out at any time
• Platform improvement: analyze usage patterns, monitor performance, and fix bugs

3. How We Share Your Information

We do not sell your personal information. We share it only in these circumstances:

With other users (limited)

Your seller store name, product listings, bio, and location (city/state) are visible to buyers. Your buyer name and shipping address are shared with the seller who fulfills your order — never your payment information.

With service providers

Other circumstances

We may disclose information when required by law, subpoena, or valid legal process (we will notify you unless prohibited); in connection with a merger, acquisition, or sale of assets (with notice to you); or where necessary to prevent imminent harm to any person, including protecting the safety of minors using the Platform.

4. Data Retention

You may request deletion of your account and personal data at any time by emailing hello@eshipx.com. Requests are processed within 30 days; some data may be retained where required by law (e.g., tax records, legal holds).

5. Children's Privacy (COPPA)

EshipX allows sellers who are 14 or older (with verified parental consent for those under 18) to operate accounts. We do not knowingly collect personal information from children under 14, and users under 14 may not create accounts. If you believe a child under 14 has provided us personal information, contact hello@eshipx.com and we will delete it promptly.

For minor sellers (14–17)

• We collect date of birth to determine minor status
• We require verified parental or guardian consent before a minor seller's products go live
• We share minor seller information with the consenting parent/guardian on request
• Parents or guardians may request deletion of their child's account and data at any time
• Parental consent expires annually and must be renewed; we send a reminder before expiry

Our practices are designed to comply with the Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.) and the FTC's COPPA Rule (16 C.F.R. Part 312).

6. Your Privacy Rights

• Access: request a copy of the personal information we hold about you
• Correction: update your account information at any time in account settings
• Deletion: request deletion of your account and personal data (subject to legal retention)
• Marketing opt-out: unsubscribe via the link in any marketing email or by contacting hello@eshipx.com

California residents (CCPA)

You have the right to know the categories and specific pieces of personal information we have collected, used, and disclosed; the right to request deletion (subject to exemptions); and the right to non-discrimination for exercising your rights. We do not sell personal information. To exercise these rights, email hello@eshipx.com with “California Privacy Request” in the subject line; we respond within 45 days.

7. Cookies

We do not use advertising or tracking cookies, and we do not share cookie data with advertising networks.

8. Data Security

• HTTPS encryption for all data in transit
• Hashed password storage — plaintext passwords are never stored
• Base44's built-in security infrastructure for data at rest
• Stripe's PCI-DSS Level 1 compliant payment processing — we never store card data
• Role-based access controls and audit logging of admin actions

No security system is impenetrable. In the event of a data breach affecting your rights and freedoms, we will notify affected users within 72 hours of becoming aware and will notify relevant authorities as required by applicable law.

9. Third-Party Links and International Transfers

The Platform may link to third-party websites (for example, seller social media profiles); this Privacy Policy does not apply to those sites. LaunchX is based in the United States — if you are located elsewhere, your information may be transferred to and processed in the U.S., where data protection laws may differ from those in your country.

10. Changes and Contact

When we make material changes to this policy, we will update the “Last Updated” date, email registered users, and display a prominent notice on the Platform for 30 days. Continued use after the effective date constitutes acceptance.

Questions, concerns, or privacy requests: LaunchX LLC — EshipX Marketplace Privacy, hello@eshipx.com. We respond to all privacy inquiries within 30 days.