ShopItUp US — Privacy Policy

Effective date: 2026-09-16 · Last updated: 2026-10-03

1. Who we are

This Privacy Policy applies to the ShopItUp platform at shopitup.us. That includes the marketplace, seller tools, subscriptions, Connected Channels (including Autopilot), AI features, and the ShopItUp browser extension (together, the "Platform").

The Platform is operated by ShopItUp Inc., a Delaware corporation ("ShopItUp," "we," "us," "our"). Our mailing address is 2810 N Church St STE 90010, Wilmington, DE 19802.

The ShopItUp platform for users in Canada is operated by a separate company under its own terms and privacy policy. That company is not a party to your use of the Platform.

The marketplace hosts independent sellers (each, a "Store"). Each Store is a separate business responsible for its own products, fulfillment, and handling of the personal information it receives (see Section 9). This Policy forms part of our Terms of Service, Terms of Sale, and Seller Agreement, and applies alongside our Shipping Policy, Prohibited and Restricted Items Policy, and Listing Reporting and DMCA Policy.

2. Who this Policy covers

This Policy applies to:

buyers and visitors who browse the marketplace, create an account, or place an order (Section 3);
sellers, including individuals and sole proprietors, who operate a Store or subscribe to our seller tools (Section 4); and
Connected Channels users, meaning sellers who connect third-party platforms to the Platform (Section 5).

3. Information we collect from buyers and visitors

Category	Examples	Source
Identifiers and contact information	Name, email address, phone number (if provided), shipping address	You
Order information	Items purchased, order history, pickup selections	You and the Store
Account information	Name, email, password (stored in hashed form)	You
Payment information	Card brand, last four digits, payment status, fraud-screening results. We do not receive or store full card numbers.	Stripe
Communications	Messages to us or to Stores, support requests, return and refund records	You and Stores
Internet and device information	IP address, browser and device type, pages viewed, actions taken, timestamps, error diagnostics	Automatically
Approximate location	Derived from IP address or shipping address, used for tax and fraud prevention	Automatically and from you

3.1 Shopping through an AI assistant or another app

You can shop ShopItUp through an AI assistant (such as Claude or ChatGPT) or another app that uses our Shopping API.

Without signing in: the app sends us what it needs to answer your request — what you are searching for (words, sizes, price range), the items you are interested in, and, to price an order, the shipping address it gives us. We use this only to answer that request and keep it with any checkout it creates. The app does not tell us who you are.
If you connect your ShopItUp account: you sign in on our website and choose what the app may see — your name and email address, your saved sizes, your saved shipping address, and your orders. We share only what you approved, only with that app, and only to answer your requests.
What we record: which app made each request (counted per app, not per person), the checkouts it created, and which app an order came through. We do not receive or keep your conversation with the assistant.
Paying: you always review and pay on ShopItUp's own checkout page. Apps never receive your payment details.
Disconnecting: you can disconnect an app at any time under Connected apps in your account settings. It loses access to your account immediately.
The app's own handling: what you tell an assistant, and what it does with information we return to it, is governed by that assistant's or app's own privacy policy.

4. Information we collect from sellers

Category	Examples
Identity and contact information	Name, business name, email address, phone number, and address
Verification information	Government ID details, date of birth, and other information needed to verify your identity and business, collected by us or by Stripe, including under the INFORM Consumers Act
Tax information	Social Security number (SSN), employer identification number (EIN), or other taxpayer identification number, and tax forms such as Form W-9
Payout information	Bank account details, provided directly to Stripe. We receive only limited information needed to manage payouts.
Subscription and billing information	Your plan, add-ons, trial status, billing history, and payment status
Catalog and inventory information	Products, images, descriptions, prices, and listings you create, import, or manage
Store and transaction information	Sales, fees, payouts, refunds, chargebacks, and disputes
Intellectual property and listing reports	Notices and reports about your listings, and your responses to them

5. Connected Channels and Autopilot

Connected Channels let sellers link their own accounts on third-party platforms (each, a "Channel") so that we can sync listings and perform other actions they enable, including through Autopilot. ShopItUp is not affiliated with, endorsed by, or partnered with any Channel unless we expressly say so.

5.1 How Channels connect

Type	Channels	How you connect	What we store
API	Shopify, eBay, Google Merchant Center	An authorization you approve on the Channel (OAuth)	Access and refresh tokens
Feed	Pinterest, Microsoft Merchant Center (Bing)	A product feed you set up (Pinterest); Microsoft Merchant Center when available	Feed settings and any tokens
Session	Poshmark, Depop, and Mercari (when available)	Our browser extension, with your consent	A session token from your logged-in browser

We never ask for or store your passwords for Channels.

5.2 What the browser extension does

When you choose to connect a session-based Channel, the extension reads the session cookies for that Channel's website (poshmark.com, poshmark.ca, and depop.com) from your browser and sends them securely to us.

The extension does not read:

cookies or content from other websites;
your browsing history; or
your passwords.

The extension requests only the "cookies" and "storage" permissions, and only for those domains.

5.3 What a session token allows

A session token gives the Platform the same access to your Channel account as your logged-in browser, for as long as the session remains valid. Depending on the Channel, this may include your listings, sales, offers, messages, and account settings.

We use this access only to perform the actions you enable, such as:

syncing listings, prices, and inventory;
sharing or relisting your own listings;
delisting items that have sold or that you have removed; and
publishing new listings you create on the Platform.

5.4 How Autopilot performs actions

For session-based Channels, Autopilot performs enabled actions from our servers using your session token. When it does:

Network routing. We route requests through third-party network service providers, which may use IP addresses located in your region.
Verification challenges. If a Channel presents a verification challenge (such as a CAPTCHA), we may use a third-party verification service to complete it. That service receives the challenge information, and may use human workers to complete it.

These providers receive session tokens or request data only as needed to transmit requests, and are bound by confidentiality and security obligations.

5.5 Other people's information in your connected accounts

Your connected accounts may contain personal information about other people, such as your buyers' names, addresses, and messages. We access that information only as necessary to perform the actions you enable, and we process it on your behalf.

You are responsible for having a lawful basis to allow us to access it, as set out in the Seller Agreement.

5.6 Disconnecting

You can disconnect a Channel at any time in your dashboard. When you do, we delete the stored token from our active systems within 7 days.

For session-based Channels, disconnecting may not end your session on the Channel. To end that session, log out of the Channel on all devices or change your password there.

We may suspend or discontinue any Connected Channel at any time, including if a Channel requests it.

5.7 Google user data and Limited Use

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We use the Google Merchant API only to sync your own product listings to your own Google Merchant Center account at your direction. Information received from Google APIs:

is not used for advertising;
is not sold;
is not transferred to third parties except as necessary to provide or improve this feature, for security, to comply with law, or as part of a merger, acquisition, or sale of assets;
is not routed through the network or verification providers described in Section 5.4; and
is not read by humans except with your consent, for security purposes, to comply with law, or where the data has been aggregated for internal operations.

5.8 Other Channel developer policies

Where a Channel's developer terms restrict how we use data received through its API, such as eBay's API License Agreement, we follow those restrictions. This includes deleting data when the Channel notifies us that a user has closed their account.

6. AI features

When you use AI features, the content you submit, such as product details and images, is processed by our AI service provider, OpenAI, which is located in the United States. We use that content only to generate results for you, and our provider is contractually restricted from using it to train its models.

7. How we use personal information

We use personal information to:

create and manage accounts, Stores, trials, and subscriptions;
process orders and arrange shipping or pickup;
facilitate payments, payouts, and subscription billing through Stripe;
provide Connected Channels, Autopilot, and AI features, and perform the actions you enable;
calculate, collect, and remit sales tax where we are required to, and meet tax reporting obligations such as Form 1099-K;
verify sellers and meet our obligations under the INFORM Consumers Act;
send order confirmations, receipts, trial and renewal notices, and other service messages;
provide customer support and handle returns, refunds, chargebacks, and disputes;
detect, prevent, and investigate fraud, security incidents, counterfeit goods, and violations of our terms;
handle intellectual property notices, including under the Digital Millennium Copyright Act;
operate, maintain, secure, and improve the Platform; and
comply with law and respond to lawful requests.

Decisions we make automatically. Some of the checks above run without a person looking first:

Import checks. Automated checks screen the rows you import against our Prohibited and Restricted Items Policy. A rejected row is returned to you with the reason it was rejected.
Listing and image checks. Automated checks screen listings and images. A check can hold an item so it cannot be published or sold, before anyone has reviewed it. A held item goes to our team, and a person decides whether to release it. We email you when an item is held, with the reason, unless the law prevents us from telling you.
Payments. Our payment processor runs automated fraud checks and may decline a payment on its own. We cannot reverse the processor's decision, but you can ask us to look at what happened.

If a decision like this affects you, you can ask for a person to review it and give your point of view: use Feedback & support in your dashboard, or contact us (Section 17).

8. How we share personal information

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising. We share personal information only as described below.

One thing to be clear about: a Store may add its own analytics or advertising tools to its own storefront, and those tools send information about your visit to the companies that provide them. Those are the Store's tools and the Store's decision, not ours. They load only if you accept cookies, and never if you send a Global Privacy Control signal. See Section 13.

Stores: when you place an order, we share your name, shipping address or pickup selection, contact details needed for fulfillment, and the items you purchased with the Store you ordered from.
Buyers: where the INFORM Consumers Act requires it, we show buyers certain information about high-volume sellers, such as name and contact details.
Channels: at your direction, we send your listings and account actions to the Channels you connect (Section 5).
Stripe: payments, payouts, and subscriptions are processed by Stripe, Inc. ("Stripe"). Stripe collects and uses payment, identity, and device information as an independent business for its own purposes, including fraud prevention and legal compliance, as described in Stripe's Privacy Policy at https://stripe.com/privacy.
Service providers: we use service providers for website hosting, email delivery, shipping labels, network routing, verification challenges, AI features, error monitoring, and customer support. We do not use a third-party web analytics tool on the ShopItUp marketplace; a Store may add its own tools to its own storefront, as described in Section 13. They may use personal information only to provide services to us.
Our affiliate in Canada: we use an affiliated company located in Canada to provide technology, operations, and customer support services to us, under a written agreement that restricts its use of personal information to providing those services.
Tax authorities: we disclose seller and transaction information to the Internal Revenue Service and to state and local tax authorities where required by law.
Intellectual property notices: when we receive a notice of claimed infringement, we may share the notice, including the complainant's contact information, with the affected seller. We may share a seller's counter-notice with the complainant.
Legal requirements and protection: we may disclose personal information to comply with law, a subpoena, or a court order, to respond to lawful requests from government authorities, or to protect the rights, property, or safety of ShopItUp, our users, or others, including to investigate fraud.
Business transactions: we may disclose personal information in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality obligations.
With your consent: we may share personal information for other purposes with your consent.

9. Stores

Each Store is an independent business responsible for its own handling of the personal information it receives. Our agreement with Stores requires them to:

use buyer information only to fulfill orders, provide customer service, and comply with law;
protect buyer information with reasonable safeguards; and
not send marketing messages to buyers except as permitted by law.

For questions about how a specific Store handles your information, contact that Store. ShopItUp remains responsible for personal information in its own control, and you may direct any request about that information to us (Section 17).

10. Where your information is processed

We and our service providers process personal information principally in the United States and Canada. Two providers used for Connected Channels (Section 5.4) sit outside both: requests to Channels are routed through a Lithuanian company that processes within the European Economic Area, and verification challenges are completed by a provider whose operating company is registered in Bahrain and which does not publish where it processes data or where the people completing challenges are located — a challenge may be completed by a worker in any country. That provider receives only what is needed to complete the challenge, not your account, order, or payment information.

Personal information processed in another country is subject to that country's laws and may be accessible to its courts, law enforcement, and national security authorities.

11. How long we keep personal information

We keep personal information only as long as needed for the purposes described in this Policy or as required by law:

Order, transaction, payout, subscription billing, and tax records: at least seven years, as required by federal and state tax laws.
INFORM verification records: as long as required by law.
Account information: while your account is active, and for 24 months after closure, unless a longer period is required by law.
Connected Channel tokens: until you disconnect the Channel, the token expires, or your account closes. Tokens are then deleted from our active systems within 7 days.
Connected apps (AI assistants and other apps): an app keeps access to your account until you disconnect it or your account closes. Its access expires after one hour and is renewed only while the connection stands; a connection unused for 30 days ends on its own. Checkouts an app creates are kept with the order records described above.
Catalog and inventory information: while your account is active, and for 30 days after closure so you can export it.
Usage logs and diagnostics: up to 90 days, unless needed longer to investigate a security or fraud incident.
Support communications and intellectual property notices: up to 3 years after the matter is resolved.

When personal information is no longer needed, we securely delete it or de-identify it. Backups. Backups are retained on a rolling schedule: daily backups for 16 days, weekly backups for 8 weeks, monthly backups for 4 months, and yearly backups for 2 years. Information you ask us to delete is removed from our active systems promptly, but a copy may remain in a backup until that backup ages out of the schedule, which can be up to two years. We do not use backups to restore deleted accounts or deleted information, and if we restore a backup for another reason we re-apply deletions to it.

12. Security

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including:

encryption in transit (HTTPS);
encryption at rest for session tokens, taxpayer identification numbers, and other sensitive information; and
access controls that limit access to what is needed to operate the Platform.

No system is completely secure, and we cannot guarantee absolute security.

If a data breach affects your personal information, we will notify you and the appropriate authorities as required by applicable state law. If a breach affects Connected Channel tokens, we will also tell you how to end the affected sessions on the Channel.

12.1 Protecting Social Security numbers

We protect the confidentiality of Social Security numbers and other taxpayer identification numbers we collect. We:

limit access to employees and service providers who need them for tax reporting, identity verification, or legal compliance;
do not publicly display them or use them as account identifiers; and
dispose of them securely when they are no longer needed.

13. Cookies, Do Not Track, and third-party tracking

Cookies we use:

Essential cookies: to keep your cart and session working, keep you signed in, and secure the Platform.
Payment and fraud-prevention technologies: Stripe places cookies and collects device information during checkout and billing to process payments and detect fraud. Stripe may use this information across its network for fraud prevention.
Our own storefront analytics: we record basic page and order activity for the Store you are visiting. This runs only if you accept cookies.

Tools a Store chooses. A Store can add its own analytics or advertising tools to its storefront — Google Analytics, Google Ads, Microsoft Advertising (Bing), Pinterest, or Meta (Facebook). Where a Store has done so:

they load only if you accept cookies. If you decline on the cookie banner, none of them load.
they are the Store's tools, not ours. Those companies receive information about your visit and may combine it with information they already hold about you, under their own privacy policies. Depending on your state, that may be a "sale" or "sharing" of your personal information by that Store.
ShopItUp runs no advertising tags of its own, and the ShopItUp marketplace pages carry none at all.

Global Privacy Control. If your browser or extension sends a Global Privacy Control signal, we treat it as an opt-out: no Store's analytics or advertising tools are loaded on any page you view, whatever your cookie choice was. You do not need to do anything else.

Do Not Track. Browsers send "Do Not Track" inconsistently and it has no agreed meaning, so we do not rely on it. Use the cookie banner or Global Privacy Control instead, both of which we honour as described above.

The browser extension's access to Channel cookies is described in Section 5.2.

14. Your privacy rights

Your rights. Wherever you live in the United States, you may ask to:

access the personal information we hold about you;
correct inaccurate information;
delete your personal information;
obtain a copy of your personal information in a portable format; and
opt out of any sale of personal information or targeted advertising. ShopItUp does neither; where a Store has added its own advertising tools, declining cookies or sending a Global Privacy Control signal stops them (Section 13).

Some state privacy laws give residents these rights only if the law applies to us. We extend them to all users. We may keep information we are required or permitted by law to keep, such as tax records.

How to make a request. Use your account settings or email support@shopitup.us.

Verification. We verify your request by matching information you provide with information already associated with your account or orders.

Authorized agents. An authorized agent may make a request for you with your written permission. We may ask you to confirm your identity directly.

Our response. We will respond within 45 days. If we need more time, we will tell you, as permitted by law.

Appeals. If we decline your request, we will explain why. You may appeal by replying to our decision within 45 days. We will respond to your appeal within the time required by law. If you are not satisfied, you may contact your state attorney general.

No discrimination. We will not charge you more or treat you differently for exercising your rights.

14.1 California residents

Your rights. If the California Consumer Privacy Act applies to us, it gives you the rights described above, including the rights to know, delete, and correct. The categories of personal information we collect, their sources, and our purposes are described in Sections 3 to 8. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit its use.
Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.
Complaints. California residents may contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or at (800) 952-5210.

14.2 Nevada residents

We do not sell covered information as defined by Nevada law. You may still send an opt-out request to support@shopitup.us.

15. Electronic and text messages

We send service messages such as order confirmations, receipts, trial reminders, renewal and billing notices, and account and security notices.

We send marketing emails only in accordance with the CAN-SPAM Act, and every marketing email includes a way to unsubscribe. We do not send marketing text messages.

16. Children and age requirements

The Platform is not directed to children under 13, and we do not knowingly collect personal information from them. You must be at least the age of majority in your state to create an account, place an order, operate a Store, or subscribe.

If you believe a child has provided us with personal information, contact us and we will delete it.

17. Contact us

ShopItUp Inc. 2810 N Church St STE 90010, Wilmington, DE 19802 Email: support@shopitup.us

18. Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy with a new effective date. If we make material changes, we will notify you by email or by a prominent notice on the Platform before the changes take effect. We will obtain your consent where required by law, including before using personal information in a materially different way than we described when we collected it.

ShopItUp™ is a trademark used under license. Poshmark, Depop, Mercari, eBay, Shopify, Google, Pinterest, and Microsoft are trademarks of their respective owners. ShopItUp is not affiliated with or endorsed by them.