Privacy Policy

This policy describes what information Zyra E-Commerce ("we", "us") collects, how we use it, and the choices you have. We aim to be straightforward — if anything here is unclear, email support@zyra.eco and we'll answer in plain language.

1. What we collect

We only collect what we need to operate the storefront, run auctions, and fulfill orders.

• Account info — your email address, optional display name, phone number, and shipping/billing addresses you choose to save.
• Bidder details — for users who register to bid in auctions: legal first/last name, mailing address, and the timestamp you accepted our auction terms.
• Order and bid history — items purchased, bids placed, lots won/lost, payment outcomes, and pickup or shipping status.
• Payment data — handled by Stripe. We see only the last four digits of cards and high-level billing details. Full card numbers, CVCs, and bank credentials never touch our servers.
• Device and usage — IP address, browser type, pages viewed, and similar standard request logs needed to operate the site, prevent abuse, and improve performance.
• Communications consent — your opt-in/out preferences for email and SMS notifications.

2. How we use it

• To create and manage your account, process orders, and run auctions you participate in.
• To send transactional messages (order confirmations, shipping updates, magic-link sign-in emails, outbid alerts, pickup reminders).
• To send marketing or promotional messages — only when you've opted in. You can opt out from any such message or in your account settings.
• To prevent fraud, enforce our terms, and meet legal obligations.
• To improve the storefront via aggregated, non-identifying analytics.

3. Who we share it with

We do not sell your personal information. We share only what specific service providers need to deliver the service:

• Stripe — payment processing.
• Supabase — database and authentication.
• Vercel — hosting and CDN.
• Resend — transactional and marketing email delivery.
• Twilio — SMS delivery (only if you've opted in).
• Sentry — error tracking (request metadata; we scrub user content where feasible).

In an auction, your display name may appear in publicly visible bid history alongside your bid amounts. Your full legal name, address, and email are never shown to other bidders.

We may disclose information if required by law (subpoena, court order) or to protect our rights, our customers' safety, or the integrity of the platform.

4. Your choices and rights

• Access and correction — view and edit your profile, addresses, and notification preferences from your account dashboard.
• Deletion — email support@zyra.eco to request deletion of your account and personal data. We'll respond within seven business days. Some records (e.g. completed orders, tax-relevant transactions) may be retained as required by law even after the rest of your account is deleted.
• Marketing opt-out — every marketing email has an unsubscribe link. SMS marketing requires explicit opt-in.
• Do-not-track — we honor browser DNT signals for analytics, where supported.

5. Cookies

We use a small set of cookies for sign-in sessions, cart persistence, theme preferences, and aggregated analytics. We do not use third-party advertising cookies. You can clear cookies in your browser at any time; doing so will sign you out and may reset preferences.

6. Data retention

Account, order, and bid records are kept for as long as your account is active and for a reasonable period after deletion to satisfy accounting, tax, and legal requirements. Request logs are kept short-term (typically thirty days) for operational and security purposes.

7. Security

Connections to the site are encrypted with TLS. Passwords are not stored — sign-in uses magic links delivered to your email. Database access is gated by row-level security so users can only read or modify records that belong to them. Card data is tokenized by Stripe and never lands in our systems.

8. Children

The site is not directed at children under 13. If you believe a child has provided personal information, email support@zyra.eco and we will remove it.

9. International users

Our infrastructure is hosted in the United States. By using the site from elsewhere, you consent to your information being processed in the U.S. We'll honor good-faith deletion and access requests from users in jurisdictions with stronger privacy rights (e.g. the EU/UK) regardless of where the data is hosted.

10. Changes

When we update this policy, we'll bump the "Last updated" date at the top. Material changes will be announced by email to active accounts at least seven days before they take effect.

11. Contact

Questions, corrections, or requests: support@zyra.eco.