1. What we collect.

Account data: your email address, used for passwordless sign-in (magic links). We don't collect or store passwords.
Listing data: anything you enter when creating a listing — title, description, price, tags, and the files you upload.
Purchase data: the buyer email you provide at checkout, order details (which listing, price, fee, timestamp), and a Stripe-generated payment reference. We do not see or store full card numbers — Stripe handles that entirely.
Payout data: if you sell, Stripe collects identity and bank details directly during Connect onboarding. Echo Softworks never receives or stores this — we only see whether your account is verified and payout-enabled.

2. Who processes it. Three third-party services handle data on our behalf, each under their own privacy terms:

Supabase — database, authentication, and file storage.
Stripe — payment processing and seller payouts (Stripe Connect).
Resend — transactional email (sign-in links, purchase receipts, download links).

We don't sell your data, and we don't share it with anyone beyond what's needed to run the marketplace (e.g., a Seller can see the buyer email and order details for their own sales, since fulfillment requires it).

3. Why we collect it. Strictly to operate the marketplace: authenticating you, processing payments, delivering purchased files, calculating and routing seller payouts, and sending transactional emails (receipts, download links, sign-in links). We don't use your data for advertising, and we don't run third-party ad trackers on this site.

4. Cookies and local storage. Sign-in relies on a Supabase authentication token stored in your browser so you stay signed in between visits. No advertising or cross-site tracking cookies are used.

5. Data retention. Order and listing records are kept indefinitely for accounting, tax, and dispute-resolution purposes, consistent with standard financial record-keeping practice. You can request deletion of your account and associated listing data by emailing us (see below); order records tied to completed transactions may be retained as required by law even after an account deletion request.

6. Your rights. You can request a copy of the personal data we hold about you, request corrections, or request deletion, by emailing studio@echosoftwork.com. We'll respond within a reasonable timeframe, generally within 30 days.

7. Data location. Data is hosted with Supabase (which uses AWS infrastructure) and processed by Stripe and Resend, all of which may process or store data outside your home country. Each provider maintains its own compliance certifications — see their respective privacy policies for details: Supabase, Stripe, Resend.

8. Changes to this policy. We'll update the "last updated" date above when this policy changes. Material changes affecting how your data is used will be communicated via email where practical.

9. Contact. Questions or requests regarding your data: studio@echosoftwork.com.