Sellerviva Privacy Policy

Version 2.1 — effective 7 October 2026. This Privacy Policy explains how Sellerviva collects, uses and protects your information when you use our website, application, API and Chrome extension. It also serves as the notice required by Article 10 of Turkish Law No. 6698 (KVKK) and by Articles 13 and 14 of the GDPR. Version 2.1 replaces version 1.9 published on this page. It adds the section on Amazon selling partner data, which applies only if you connect an Amazon seller account, and names network security and content delivery among the categories of service providers we use. The rest of the policy is unchanged.

Who is responsible

The data controller for your account data is Bays Trade LLC, a limited liability company established in the United States, operating the Sellerviva brand. Privacy requests: [email protected] · Legal notices: [email protected] · Support: [email protected].

Where we are the controller. For your user account, for authentication (sign-in, two-factor authentication, password changes and changes to your contact details), for the account-security records described in this policy, for billing and for our own support processes, Sellerviva decides why and how the data is processed. For that data Sellerviva is the controller (in KVKK terms, the data controller).

Where we are your processor. For the buyer, order and delivery data of the eBay store you connect, you are the controller and Sellerviva is your processor: we process that data only to provide the service to you and on your instructions. A single account-takeover incident can engage both roles at the same time — our own account data as controller, your buyers' order data as processor — and our incident procedure keeps the two separate.

Where we are established, and our representatives. Bays Trade LLC is established solely in the United States and the service is operated from the United States. We have no branch, office, establishment, staff or servers in the European Union, the European Economic Area, the United Kingdom or Türkiye. Several laws require a controller or a provider that has no local establishment to designate a local representative: Article 27 of the GDPR, Article 27 of the UK GDPR, Article 37 of Regulation (EU) 2023/2854 (the Data Act) and Article 11 of the Turkish Regulation on the Registry of Data Controllers. Where such an obligation applies to us, we designate a representative, complete any registration required, and publish that representative's name, address and contact details in this section. As at the effective date of this version, no representative has been designated in the European Union, the European Economic Area, the United Kingdom or Türkiye; for the European Union, the European Economic Area and the United Kingdom, this is because we do not currently have users or other data subjects located there. Whether or not a representative is named for your territory, you can always reach us directly at [email protected], and we answer within the periods stated in this policy.

Information we collect

Account information (email address, optional name and company name, language), authentication data (password hash, two-factor settings, recognised-device identifiers, and sign-in records including IP address and browser information kept for security), your connected marketplace and supplier settings and access tokens (stored encrypted), billing data handled by our payment provider (we do not store full card numbers), the products, listings, orders, messages and settings you import into or create in the service, support conversations, and usage data needed to operate and secure the service.

Account-security data. To protect your account we also keep: sign-in events (time, result, IP address, the source from which that IP address was taken, and basic browser information); recognised-device records; records that your email address, telephone number, password or two-factor settings were changed; one-time verification codes and the digests of one-time security links; and account-recovery cases. How long each of these is kept is set out under "Data retention".

How we use your information

To provide and secure the service, to process subscriptions and payments, to send transactional emails (such as verification, security, billing and order notifications), to provide support, to detect abuse and fraud, to comply with legal obligations and to improve Sellerviva. Marketing emails are sent only with your separate, freely given consent, which is off by default and can be withdrawn at any time from Account → Notifications or the link in the message.

AI features and data use

The service's AI features provide (a) listing text drafts from product data, (b) suggested replies to buyer messages and (c) an in-app help assistant that answers questions about the panel. These features are provided by an artificial intelligence system; the application tells you so wherever such a feature is offered, and outputs are presented as AI-generated drafts or answers that you review before use. For draft replies the model receives the bodies of the most recent messages of the conversation; the buyer's name is not sent. For listing drafts the product data is sent. For the help assistant, your question together with the current page guide and matching help articles is sent; no order or account data is sent, and questions are limited by a daily quota per account. No other data of yours (no passwords, payment data or buyer addresses) is sent to the model provider. Our model provider is Anthropic, which acts as our sub-processor; under its commercial terms it does not use our inputs or outputs to train its models.

Automated checks

The service performs a limited number of automated operations. They are listed here by purpose rather than by number, so that this section stays accurate as the service changes:

• Security analysis of sign-ins — described in the next paragraph.
• Trial-abuse check — we compare the payment card fingerprint provided by our payment provider to prevent repeated free trials with the same card. If this affects your trial eligibility you may request human review via [email protected].
• Notification routing — notifications are delivered according to the channels, quiet hours and daily caps you configure. This has no legal effect on you.

Automated security analysis. To protect your account, we automatically compare current sign-in signals with previous sign-ins. These signals may include a recognised-device identifier, IP address and network prefix, browser family, the country inferred from the IP address, and the autonomous system organisation associated with the network. If the system identifies a potentially unusual sign-in, it sends a security alert. This processing may constitute limited profiling for security purposes. It does not by itself freeze the account, deny access, remove two-factor authentication, or produce legal or similarly significant effects. Disputed account-recovery and restriction decisions are subject to human review. Country and network-organisation estimates may be inaccurate, particularly when a VPN, mobile network or corporate network is used.

The approximate country and the network organisation — the organisation that operates the autonomous system to which the IP address prefix belongs — are looked up in a database held on our own servers. Your IP address is not sent to the supplier of that database or to any other third party for this purpose, and we do not collect or store your city. These signals are used only for the security of your account: they are not used for advertising, are not combined with analytics or marketing data, and are not used to build a commercial profile of you.

Human involvement. No automated decision that produces legal effects concerning you, or that similarly significantly affects you, is made by the service. Disputed account-recovery decisions and account restrictions are open to human review: write to [email protected] and a person reviews the case.

Amazon selling partner data

This section applies only if you connect an Amazon seller account to Sellerviva. On your authorisation, we receive information about your own seller account through Amazon's Selling Partner API: your listings, prices, inventory quantities and the status of fulfilment orders. When you ask Amazon to ship one of your eBay orders from your Amazon inventory, we send that order's delivery address to Amazon for that shipment. We use this information only to provide the features you have enabled, for your account. We do not combine it with other sellers' information, show it to other users, sell it, or use it to develop or train artificial intelligence or machine-learning models; if you choose AI assistance for a listing draft, the product data of that listing is sent to our AI provider to generate the draft, as described under "AI features and data use". We do not share it with third parties other than the service providers needed to operate the service. When you disconnect your Amazon account, close your Sellerviva account or your authorisation ends, this information is deleted within 30 days; disconnecting in the application deletes it immediately. Your eBay listings, orders and shipment records are your own content and are kept under the retention rules below.

Service providers and international processing

We use service providers (sub-processors) for hosting and storage, network security and content delivery, payments, email delivery, error monitoring, sign-in with Google or Apple (only if you use it) and AI features. Our systems are operated in the United States; your data is therefore processed there. Our providers are engaged under written data processing terms. Where the law of your country requires a mechanism for such processing (EU/EEA, United Kingdom, Türkiye), the mechanism available under that law applies, such as standard contractual clauses or an adequacy-based framework; details for a specific provider are available on request at [email protected]. We do not sell personal data and do not share it for advertising.

The country and network-organisation lookup described under "Automated checks" is not a sub-processor relationship: the database runs on our own servers and no data about you is sent to its supplier when a sign-in is checked. The licence attribution for that database is published on our legal notices page before that lookup is put into use.

Cookies

We use only cookies and browser storage that are strictly necessary to run the service — including the security cookie that lets us recognise a browser you have previously signed in from — or that remember your preferences. We use no analytics, advertising or tracking cookies, so no cookie consent is requested. The full inventory, durations and the "Cookie Preferences" window are described in the Cookie Policy at /cookies.

Data retention

We retain your data while your account is active. You may delete your account at any time from within the application; 7 days after the request your personal data is deleted or anonymised (you may withdraw the request within that period). Records we must keep under tax, accounting or other legal obligations, and evidence of contract acceptance, are retained for the period required by law with restricted access.

Account-security records. The records described under "Account-security data" are kept for the following periods:

Record	Retention
Sign-in event — raw IP address and detailed browser information	90 days
Sign-in event — the remaining row (time, result, event type and low-detail security fields)	180 days
Recognised-device record	180 days from last use
Previous email address or telephone number, stored encrypted so that you can undo the change	96 hours
Record that a contact detail, password or two-factor setting was changed, without the old value	180 days
One-time email verification code	valid for 10 minutes, deleted within 24 hours at the latest
Digest of a one-time account-freeze or undo link	at most 30 days after the link expires
Account-recovery case record	1 year after the case is closed

You can remove a recognised device yourself at any time under Account → Security → Recognised devices → Forget, and recognised-device records are revoked when an account is frozen.

Your rights

Depending on your location (including under the GDPR, the UK GDPR and KVKK), you have the right to access, correct, export, restrict, object to the processing of or delete your personal data, and to withdraw consent where processing is based on consent. Requests are free of charge; write to [email protected] or use the account settings. We may ask for reasonable information to verify your identity and answer within the statutory period (GDPR and UK GDPR: one month; KVKK: at most 30 days). You can download your account data in machine-readable form from within the application.

Complaints. You may lodge a complaint with your supervisory authority: in Türkiye the Personal Data Protection Board (kvkk.gov.tr), in the EU/EEA the data protection authority of your country, in the United Kingdom the Information Commissioner's Office (ico.org.uk).

United States state privacy rights. Where a US state comprehensive privacy law applies to you, you may know and access the personal data we hold about you, correct it, delete it, obtain a portable copy, and opt out of the sale of personal data, of sharing for cross-context behavioural advertising, of targeted advertising and of profiling with legal or similarly significant effects. We do not sell personal data, do not share it for cross-context behavioural advertising, do not serve targeted advertising and do not carry out profiling in furtherance of decisions that produce legal or similarly significant effects concerning you — the security analysis described under "Automated checks" produces no such effect — so the opt-out rights require no action; we treat a browser Global Privacy Control signal as an opt-out for any future sale or sharing. We do not discriminate against you for exercising your rights. You may use an authorised agent; we may verify the agent's authority and your identity. If we decline a request, you may appeal by replying to our decision or writing to [email protected] with the subject "Privacy appeal"; we answer appeals within 45 days and tell you how to contact your state Attorney General if you disagree. We have not sold or shared personal data in the preceding 12 months.

European Union customers. The switching and data-retrieval rights of Regulation (EU) 2023/2854 (the Data Act) apply as set out in the Terms of Service; the in-app download feature is the technical means.

Buyers of our users. If you are a buyer whose data reached us through one of our users, please contact that seller; we assist them in responding to your request.

Age

The service is intended for persons aged 18 or over acting for business purposes. We do not knowingly process the personal data of children.

Changes to this policy

This policy is versioned; each version states its effective date and prior versions are available on request. For material changes (such as a new data category, a new category of provider, a new purpose or a change in retention) we give notice in the application and/or by email before the change takes effect.

Contact

Questions about this policy? Email [email protected].