Privacy Policy

Who we are

SalemNexus is operated by the entity named below, which is the data controller for the personal data described in this policy.

What SalemNexus does

SalemNexus reads the order and shipping-label emails that marketplaces send to a mailbox you connect, and turns them into bookkeeping records. It has no connection to Vinted and does not access your selling account. Where a marketplace offers an API instead — currently eBay — it reads orders directly from that marketplace with your authorisation.

Data we collect about you

Account details. When you sign in, our authentication provider gives us your email address, your name where your sign-in provider supplies one, and a unique identifier for your account.

Connected accounts. The address of each mailbox you connect, the marketplace accounts you authorise, and encrypted access and refresh tokens for each. Tokens are encrypted with AWS KMS and are only ever used to read on your behalf.

Your business records. Orders, items, prices and dates parsed from your emails or read from a marketplace API; shipping labels extracted from those emails; and any stock codes and quantities you enter.

Subscription status. Whether your subscription is active, when the current period ends, and an identifier linking you to our payment provider. We never see or store your card details — those are handled entirely by Stripe.

Technical logs. Our infrastructure records request logs which may include IP addresses, for security and diagnosing faults.

Data about your buyers

This is the part most policies leave out, so it is stated directly: your order emails and shipping labels contain personal data about people who are not SalemNexus users and have no relationship with us. Specifically a buyer’s marketplace username, their name where a label or invoice carries one, their email address where the order email includes it, and their delivery address where the order email or shipping label includes it.

We store this because it is inseparable from the order record you are asking us to keep. We do not use it for anything else. We do not market to buyers, build profiles of them, or share their details with anyone beyond the infrastructure providers listed below.

Mailbox access

Connecting a mailbox grants SalemNexus read-only access to it. We cannot send, delete, or alter anything in your mailbox, and we have no ability to act as you.

We search only for marketplace order and shipping-label emails, matched on the sender address and subject line. Other mail is not read, stored or processed. From the emails that do match, we extract the order details, buyer details and shipping labels described above, and we retain the original message only where it failed to parse, so the fault can be diagnosed and fixed.

Google user data. Where you connect a Google mailbox, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Gmail data for advertising, we do not sell it, and we do not allow humans to read it except where you have given explicit consent for a specific issue, where it is necessary for security or to comply with the law, or where the data has been aggregated and anonymised.

You can disconnect a mailbox in SalemNexus at any time, and you can revoke our access independently from your Google account permissions page. Either stops all further reading immediately.

Marketplace accounts

Where you authorise a marketplace account such as eBay, we request the narrowest scope that lets us read your completed orders. We do not list items, message buyers, alter your listings, or take any action on your account. Authorisation can be withdrawn from within SalemNexus or from the marketplace’s own account settings.

Where a marketplace notifies us that a user has closed their account, we delete or anonymise that person’s data in line with the deletion section below.

Why we process it, and on what basis

To provide the service — reading your mailbox or marketplace account, producing your records and labels, and showing your analytics. Basis: performance of our contract with you.

To take payment and manage your subscription. Basis: performance of our contract with you.

To keep the service secure and working — logging, fault diagnosis, preventing abuse. Basis: our legitimate interests in operating a reliable service.

To hold buyer details within your order records. Basis: legitimate interests — yours in keeping accurate business and tax records, ours in providing them. We have weighed this against buyers’ interests and limited it to the data already present in the order.

To meet legal obligations, such as responding to lawful requests. Basis: legal obligation.

Who we share it with

We do not sell personal data, and we do not share it for advertising. We use the following providers to run the service. Each receives only what it needs, processes it on our instructions, and is bound by contract. This data is identifiable, not aggregated or anonymised.

Amazon Web Services — hosting, databases and file storage. Holds your records, your labels and your encrypted tokens.

Auth0 (Okta) — authentication. Holds your sign-in identity.

Stripe — payments and subscriptions. Holds your billing relationship and card details, which never reach us.

Google and eBay — only where you connect them, and only to read on your behalf.

We may also disclose data where the law requires it, or where it is necessary to investigate fraud or protect someone’s safety.

Where it is stored

Your records, labels and tokens are stored in Amazon Web Services in the London region (eu-west-2). Some of our providers operate internationally and may process data outside the UK; where they do, we rely on the transfer mechanisms permitted under UK data protection law, such as the International Data Transfer Agreement or Addendum, or an adequacy decision.

How long we keep it

We keep your records for as long as your account is open, because they are the service. After you close your account we keep them only as long as set out below.

While your account is open — your orders, buyers, labels and stock records are kept, because they are the service.

After you close your account — 30 days, then deleted. The delay exists so an account closed by mistake can be restored and any final billing question settled.

Emails we could not read — where an order email fails to parse we keep the original message for up to 90 days so the fault can be found and fixed, then delete it.

Technical logs, including IP addresses — 90 days.

Anonymised data — kept indefinitely. Once it can no longer identify anyone it is not personal data, and we use it to understand how the service performs.

Where the law requires us to keep something for longer, we keep only that and for only as long as required.

Your rights

Under UK data protection law you have the right to access your data, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent you can withdraw it at any time, which does not affect anything done beforehand.

To exercise any of these, email TODO: contact email. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office, the UK supervisory authority. We would rather you raised it with us first so we can put it right.

If you are a buyer

Your details appear in SalemNexus because a seller you bought from uses it to keep their records. That seller decides what happens to those records, so contact the seller first — through the marketplace you bought on. We will act on their instruction.

If you cannot reach them, or you are not sure who they are, email TODO: contact email with the marketplace and the approximate date, and we will help. Where a record has to be kept because the seller is legally required to retain the transaction, we remove your name, address and contact details from it rather than deleting the order itself.

Deleting your data

You can disconnect any mailbox or marketplace account at any time, which stops all further collection immediately. To delete your account and the data in it, email TODO: contact email. We will verify it is you, then remove your records, your stored labels and your encrypted tokens, keeping only what the law requires us to keep.

Security

Access and refresh tokens are encrypted with AWS KMS. Data is encrypted in transit and at rest, databases are not reachable from the public internet, and access is limited to what each component needs. No system is perfectly secure, but we would rather describe what we actually do than offer reassurance in the abstract.

If something goes wrong

If a breach affects your personal data and is likely to result in a risk to you, we will tell you without undue delay, and we will report it to the Information Commissioner’s Office where required.

Children

SalemNexus is a business tool for marketplace sellers and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will remove it.

Cookies and local storage

We use storage in your browser that is necessary for the service to work — keeping you signed in, and holding a short-lived value during the account-connection process to protect against request forgery. We do not use advertising or third-party tracking cookies.

Changes to this policy

We may update this policy. Where a change materially affects how we use your data we will tell you before it takes effect. The effective date at the top of this page always reflects the current version.

Contact

Questions about this policy or about your data: TODO: contact email.