Privacy Policy

Trace is a consignment management platform that helps stores manage consigned inventory, consigners, orders, payouts, and their Shopify storefront. This policy covers:

• Our website at jointrace.co (the “Website”);
• The Trace application, including the store admin dashboard, consigner portals hosted on store-specific domains, and our embedded Shopify app (together, the “Services”);
• Email, support, and other communications between you and Trace.

It does not apply to third-party websites or services that we link to or integrate with (such as Shopify or Stripe), which have their own privacy policies.

Our Website and Services are intended for businesses and are not intended for children. No one under the age of 18 may provide any personal information to or on the Website or Services. We do not knowingly collect personal information from anyone under 18. If you believe we might have any information from or about a child under 18, please contact us at support@jointrace.co.

We collect several types of information from and about users of our Website and Services, including information:

• By which you may be personally identified, such as name, email address, phone number, business name and address, and payout details (“personal information”);
• That is about you but individually does not identify you, such as your role at a store or your product and sales activity;
• About your internet connection, the equipment you use to access our Website and Services, and usage details.

We collect this information:

• Directly from you when you provide it to us;
• Automatically as you navigate through the Website and Services, including through cookies and similar technologies;
• From third parties with your authorization — most notably from Shopify when a store connects its Shopify account (see Section 5).

The information we collect on or through our Website and Services may include:

• Account information. When a store signs up for Trace, we collect the information provided during registration and onboarding, such as owner and employee names, email addresses, phone numbers, business name, business address, and country.
• Consigner information. Stores using Trace create accounts for their consigners. This may include consigner names, email addresses, phone numbers, addresses, and payout preferences. When we process consigner information on a store’s behalf, the store is the controller of that data and consigners should direct requests about it to their store.
• Business records. Products, inventory, pricing, orders, sales, and payout records that you create in Trace or that sync from your connected Shopify store.
• Payment information. Subscription payments for Trace are processed by Stripe. We do not store your full card number; we retain only billing identifiers and subscription status provided by Stripe.
• Communications. Records and copies of your correspondence (including email addresses) when you contact us, request a demo, or use support.
• Search queries on the Website and within the Services.

When a store connects its Shopify account, Trace accesses Shopify data through Shopify’s APIs using the minimum permissions needed to operate the Services. This may include:

• Products, variants, images, and inventory levels;
• Orders and fulfillment information;
• Limited customer information attached to orders (such as name and contact details), used only to display and reconcile sales for the store.

We use Shopify data solely to provide the Services to the connected store — syncing inventory, matching sales to consigned items, and generating reports. We do not sell Shopify customer data or use it for advertising. When a store uninstalls the Trace app or asks us to delete its data, we honor Shopify’s data deletion webhooks and remove the associated personal information in accordance with Shopify’s requirements.

As you navigate through and interact with our Website and Services, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Details of your visits, including traffic data, logs, and the resources that you access;
• Information about your computer and internet connection, including your IP address, operating system, device information, and browser type.

This information helps us improve the Website and Services, estimate audience size and usage patterns, recognize you when you return, and maintain security. The technologies we use include cookies and local storage (including to remember your cookie consent choice and keep you signed in). We also use Cloudflare Turnstile to protect our forms from spam and abuse; Turnstile may process technical information about your browser and device to distinguish humans from bots.

With your consent, we use third-party analytics and advertising services on our Website, which may include Google Analytics and Meta (Facebook) Pixel. These services use cookies and similar technologies to collect information about your use of our Website over time and may combine it with other information they hold. Analytics and advertising cookies are not set until you accept them via our cookie banner, and you can decline them at any time.

We do not control these third parties’ tracking technologies or how they may be used. If you have questions about targeted content, you should contact the responsible provider directly.

We use information that we collect about you or that you provide to us, including any personal information:

• To present our Website and its contents to you;
• To provide, operate, and maintain the Services, including inventory sync with Shopify, consigner management, order reconciliation, payouts, reporting, and search;
• To manage your account, including billing and subscription management through Stripe;
• To send transactional and service emails, such as account notifications, sales and payout notifications, weekly reports, and onboarding or trial reminders (sent via our email providers);
• To respond to your inquiries and provide customer support;
• To improve, secure, and troubleshoot the Website and Services, including error tracking and audit logging;
• To market our services where permitted, and to notify you about changes to our Services;
• To comply with legal obligations and enforce our agreements;
• In any other way we may describe when you provide the information, or for any other purpose with your consent.

We do not sell your personal information. We may disclose aggregated or de-identified information about our users without restriction. We may disclose personal information that we collect or you provide as described in this policy:

• To service providers we use to support our business, who are bound to use it only to perform services for us. These include: cloud hosting and infrastructure (Heroku/Salesforce, PostgreSQL and Redis hosting), payment processing (Stripe), authentication (Google Firebase), commerce integration (Shopify), image storage and delivery (Cloudflare R2), search (Algolia), email delivery (Resend, SendGrid), and anti-spam (Cloudflare Turnstile);
• To your store. If you are a consigner or employee, information about your account and activity is visible to the store that operates your Trace workspace;
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, financing, or other sale or transfer of some or all of our assets;
• To comply with any court order, law, or legal process, including responding to any government or regulatory request;
• To enforce our agreements, or to protect the rights, property, or safety of Trace, our customers, or others;
• For any other purpose disclosed by us when you provide it;
• With your consent.

Some of our service providers are located in countries other than your own, and your information may be transferred to and processed in those countries.

If you have a Trace account, you can review and change much of your personal information by logging in and visiting your account or settings pages. Consigners can update their profile through their store’s consigner portal, or by contacting their store directly.

You may also email us at support@jointrace.co to request access to, correct, or delete personal information that you have provided to us. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement, cause the information to be incorrect, or where the data belongs to a store acting as the controller (in which case we will refer your request to that store). Copies of information may remain viewable in cached and archived pages for a period of time after deletion.

We retain personal information for as long as reasonably necessary to provide the Services, comply with our legal obligations (including tax and accounting requirements), resolve disputes, and enforce our agreements. Business records such as orders and payouts may be retained for the life of the store’s account. When a store closes its account or uninstalls our Shopify app and requests deletion, we delete or de-identify the associated personal information within the timeframes required by law and by Shopify’s data deletion requirements.

If you are a resident of a U.S. state with a comprehensive consumer privacy law (including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia), you may have some or all of the following rights with respect to your personal information, subject to the law of your state:

• To confirm whether we process your personal information and to access it;
• To correct inaccuracies in your personal information;
• To delete your personal information;
• To obtain a copy of the personal information you previously provided to us in a portable format;
• To opt out of targeted advertising, the sale of personal information, or profiling in furtherance of decisions that produce legal or similarly significant effects.

We do not sell personal information. To exercise any of these rights, contact us at support@jointrace.co. We will respond within the timeframe required by applicable law, and you may appeal a refusal by replying to our decision.

If you are located in the European Economic Area, the United Kingdom, or Canada, you may have additional rights under applicable data protection law (such as the GDPR, UK GDPR, or PIPEDA), including the rights to access, rectify, erase, restrict, or object to the processing of your personal information, the right to data portability, and the right to withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority.

We process and store information on servers located in the United States. Where we transfer personal information from other regions, we rely on appropriate safeguards such as standard contractual clauses or our service providers’ equivalent mechanisms.

Where Trace processes personal information on behalf of a store (for example, consigner and customer data), the store is the controller and Trace acts as a processor under its instructions.

We have implemented technical and organizational measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure, including encrypted connections (TLS), multi-tenant data isolation so each store’s data is scoped to its own workspace, authentication through Google Firebase, and verification of webhooks from Shopify and Stripe. The safety and security of your information also depends on you: keep your password confidential and do not share it with anyone. Unfortunately, the transmission of information via the internet is not completely secure, and we cannot guarantee the security of your personal information transmitted to our Website or Services; any transmission is at your own risk.

It is our policy to post any changes we make to our privacy policy on this page, with the “last updated” date revised at the top. If we make material changes to how we treat our users’ personal information, we will notify you through a notice on the Website or by email. Your continued use of the Website or Services after changes take effect means you accept the updated policy.

To ask questions or comment about this privacy policy and our privacy practices, or to exercise any of your rights, contact us at support@jointrace.co.