Privacy Policy
This Privacy Policy explains what data Quartermast collects, how we use it, and the choices you have. We design the Service to handle the minimum data needed to run your overnight shift — and nothing more.
1. What we collect
Account data: name, email, and a hashed password (or a session token if you sign in with a single-sign-on provider). Billing data: billing address and the last four digits and brand of your card, provided by Stripe; we never see or store full card numbers. Store and supplier data: the Shopify, Meta, TikTok, CJ, Spocket, Wholesale2B, and Doba credentials and identifiers you connect, plus the rules, lists, and audit logs the Service generates from those connections. Usage data: timestamps, IP address, and user agent for security and abuse prevention.
2. What we do not collect
We do not collect payment-card numbers, government ID numbers, or sensitive personal information. We do not run third-party advertising trackers on the dashboard or the marketing site, and we do not sell your data to data brokers.
3. How we use it
To operate the Service (run the overnight shift, sync your connected platforms, deliver the profit digest), to bill you, to protect your account and ours, and to respond when you contact support. We do not use your data to train third-party AI models, and we do not share it with advertising networks.
4. The third parties that receive your data
Stripe processes payments on our behalf. Meta and TikTok receive ad-set identifiers when we pause an underperforming ad set. Supplier platforms (CJ, Spocket, Wholesale2B, Doba) receive order and product identifiers when we place a restock. Our hosting and email providers process data on our behalf under confidentiality agreements. We share the minimum data required for each integration to function.
5. Cookies and authentication
The Service uses a single first-party session cookie to keep you signed in and a small set of preference cookies (theme, locale). We do not use advertising cookies and we do not embed third-party tracking pixels in the authenticated app.
6. Data retention
We keep account data for the life of your account and delete it within 30 days of account closure, except where retention is required for legal, tax, or audit purposes. Billing records are retained for the period required by applicable tax law. Audit logs of automated actions are retained for at least 90 days and aggregated usage telemetry for up to 24 months.
7. Your rights and choices
You can update your name, email, and connected stores from the dashboard at any time. You can request an export or deletion of your data by emailing quartermast-mmwz7u@polsia.app; we action verified requests within 30 days. If you are in the EEA, UK, or California, you also have the right to object to processing, request portability, and lodge a complaint with your local data protection authority.
8. Security
We encrypt data in transit with TLS, store credentials and tokens encrypted at rest, require strong passwords, and keep a tamper-evident audit log of every automated action the Service takes on your behalf. No system is perfectly secure, but we work continuously to reduce risk and notify affected customers promptly if a breach materially affects them.
9. Children
The Service is intended for adult merchants and is not directed to children under 16. We do not knowingly collect personal information from children.
10. Changes to this Policy
We will post material updates on this page with a new effective date and, for material changes, notify active subscribers by email at least 14 days before the changes take effect.
11. Contact
Privacy questions and data requests: quartermast-mmwz7u@polsia.app. We read every message and respond within one business day.