Privacy Notice

We collect:

• Account & profile data you provide — name, email, password (stored hashed), and any profile details.
• Order & transaction data — shipping and billing addresses, items purchased, and the payment status Stripe reports back (we never see full card numbers).
• Content you create — messages to sellers, reviews, listings, and support requests.
• Technical data needed to run the marketplace securely — device and usage information, and log data used for fraud prevention and debugging.
• Records of what you agreed to — which version of the Seller Agreement a store accepted, when, which member accepted it, and the IP address and browser the acceptance came from. That last part is the ordinary corroboration for an online agreement; it is kept as evidence of the acceptance and used for nothing else.
• Seller identity data if you sell — see Seller identity.

We use your data to:

• process orders and connect you with the sellers who fulfil them;
• take payment and pay out sellers through Stripe;
• provide customer support and resolve disputes;
• prevent fraud, abuse, and other unlawful activity;
• keep the marketplace secure and working reliably; and
• with your consent, send marketing such as the newsletter — which you can stop at any time.

We share data with a small set of service providers who process it on our behalf, only as needed to provide their service:

Stripe

Payment processing and identity verification for sellers. Card details go directly to Stripe and are never stored by Klatchit.

Sentry

Error and performance monitoring. Configured to not collect IP addresses, cookies, or request headers, with an additional scrubber that strips personal data before an event is sent.

S3-compatible object storage

Hosting product images, uploaded documents, and time-limited data-export bundles.

Transactional email provider

Sending order confirmations, shipping updates, security notices, and — only if you opt in — the newsletter.

We also share what's strictly necessary to complete a purchase — for example, your shipping details with the seller fulfilling your order. We do not sell your personal data (see Do Not Sell or Share).

If you sell on Klatchit we collect identity information about your business: legal name, business address, contact phone and email, and — for verification only — a bank account or tax identifier. Verification runs through Stripe. Klatchit does not store bank account numbers, tax identification numbers, or government ID numbers; what we keep is a verified identity snapshot.

The federal INFORM Consumers Act requires marketplaces to publish this information for high-volume third-party sellers. If your store crosses the statutory threshold, your name, business address, and contact details are shown on your storefront and in the order details of buyers who purchase from you, and consumers are given a way to report your store to us. This disclosure is a legal requirement — it is not something you or Klatchit can opt out of while you sell at that volume. We will also ask you to certify periodically that the information is current, and selling privileges can be suspended if it is not.

Reports consumers make about a seller are read by Klatchit's trust and safety team and kept as part of that store's compliance record.

Handling an infringement complaint means moving information between the person who complains and the person complained about. There is no way to run the process without it, so here is exactly what moves.

If you file a notice about a listing, what you submit — your name, the organization you act for, your contact details, the rights you assert, and the material you attach — is shown to the seller whose listing you named. A seller cannot answer an accusation they are not allowed to see, and an anonymous complaint is not one we can act on.

If you file a counter-notice as a seller, 17 U.S.C. §512(g)(2)(B) requires us to send a copy to the person who complained. That copy includes your name, the physical address you gave for service of process, your phone number and email, and your consent to the jurisdiction of a federal court. We cannot redact any of it — the statute is what makes the restoration clock run, and forwarding is the condition of it. Do not file one unless you are content for the claimant to have those details.

Notices sent to our designated agent — at the address published on the DMCA page — are handled by the same team and become part of the claim record, including the message, its attachments, and the sender's contact details.

Evidence retention is decided by outcome, not by age. Documents supporting a claim that was rejected, withdrawn, or closed without any listing being touched are deleted 90 days after the decision. Where a listing actually came down or was restored, the supporting evidence is kept: that is an action Klatchit may have to justify years later, and the evidence is the justification. The claim record itself and its timeline are always kept.

We keep personal data only as long as needed for the purposes above. Financial and order records are retained longer where the law requires it (for example, tax and accounting rules).

When you erase your account, we anonymize the personal information tied to it. Records we must keep for legal reasons remain, but they no longer identify you.

You can review and update your information at any time. Depending on where you live, you may also have the right to access, export, correct, or delete your personal data, and to object to or restrict certain processing.

Two of these are self-serve from your privacy settings: download a machine-readable copy of your data and erase your account. For anything else, contact us.

Klatchit uses only first-party cookies — no third-party advertising or analytics scripts. See the Cookie Notice for the full list and to opt out of attribution cookies.

Klatchit does not sell your personal data, and does not share it for cross-context behavioral advertising, as those terms are defined under California law. There is nothing to opt out of, because we don't do it.

We honor the Global Privacy Control (GPC) signal: if your browser sends it, we treat it as an opt-out of attribution cookies automatically. You can also opt out manually from the Cookie Notice.