CaratShelf Privacy Policy

The Platform is intended solely for business users, including resellers, jewelry business operators, and brand operators. By using the Platform, you represent that you are acting for commercial or professional purposes and not primarily as an individual consumer.

Information We Collect

Account registration. When you register a CaratShelf seller account, we collect: your full name, your brand or company name, your chosen storefront subdomain, your email address, one contact method of your choosing (phone, WhatsApp, or another contact value you provide), and, optionally, your country/region and a description of your business. Your password is stored using industry-standard hashing and is never stored or transmitted in plain text.

Contact inquiries. The Contact page does not include a form and does not transmit any information to our servers. It provides a direct email link (hello@caratshelf.com); any information you choose to send us that way is handled as an email, subject to your own email provider's practices, not stored in our application database through that page.

Technical and session data. Like most web applications, the Platform uses a small number of strictly necessary cookies to maintain your login session and to protect against cross-site request forgery. These cookies do not track you across other websites.

Analytics. We do not currently use Google Analytics or any other third-party analytics or advertising tool on the Platform. If this changes, we will update this Privacy Policy before any such tool is enabled.

How We Use Information

We use the information above to create and manage seller accounts, review and approve seller applications, operate and secure the Platform, communicate with you about your account or inquiry, and comply with applicable legal obligations.

Data Retention

We retain personal data only for as long as reasonably necessary to provide and secure the Platform, maintain business records, resolve disputes, enforce our agreements, and comply with applicable legal obligations.

Unless a longer retention period is required or permitted by applicable law, we generally apply the following retention periods:

• Account, profile, reseller storefront, and business contact information is retained while the account remains active and for up to ninety (90) days after the account is closed.
• Custom domain, DNS, hostname verification, and SSL/TLS configuration records are retained while the relevant domain is connected to the Platform and for up to ninety (90) days after disconnection.
• Partnership inquiries, customer support communications, and related correspondence may be retained for up to twenty-four (24) months after the most recent interaction.
• Login records, IP addresses, device information, access logs, and security records are generally retained for up to twelve (12) months, unless a longer period is reasonably necessary to investigate fraud, abuse, security incidents, or violations of our Terms.
• Session information and cookies are retained until they expire, are no longer required, or are removed by the user.
• Personal data contained in rolling system backups may remain for up to ninety (90) additional days after deletion from active systems and will be removed when those backups are overwritten in the ordinary backup cycle.
• Contractual, accounting, tax, compliance, and dispute-related records may be retained for the period required by applicable law or for the establishment, exercise, or defence of legal claims.

When personal data is no longer required, we will delete or anonymize it. Where immediate deletion from backups is not technically practicable, the data will be isolated from ordinary use and deleted through the applicable backup rotation process.

Service Providers and Other Recipients

We do not sell or rent personal data.

We may disclose or make personal data available to service providers that process data on our behalf where reasonably necessary to operate, maintain, protect, and support the Platform. These service providers currently include:

• Cloudflare, Inc. and its relevant affiliates and subprocessors, which provide DNS, content delivery, SSL/TLS, custom hostname, network security, traffic routing, firewall, and denial-of-service protection services;
• RackNerd LLC, which provides server hosting, database, file storage, backup, and infrastructure services, as well as email hosting, in the United States;
• professional advisers, auditors, insurers, and legal service providers where reasonably necessary;
• courts, regulators, government authorities, or law-enforcement bodies where disclosure is required by applicable law or is reasonably necessary to protect legal rights, users, the Platform, or the public.

Service providers are permitted to process personal data only for the relevant service purposes and subject to appropriate contractual, confidentiality, and security obligations.

Because our service providers and technical infrastructure may operate in multiple countries and regions, personal data may be transferred to, stored in, or processed outside the user's country or region. Where required by applicable law, we will provide additional notices, obtain required consent, conduct applicable personal information protection assessments, and implement appropriate contractual or technical safeguards for such transfers.

Your Privacy Rights and Requests

Subject to applicable law, users may have the right to:

• request confirmation of whether we process their personal data;
• access or obtain a copy of their personal data;
• request correction or completion of inaccurate or incomplete data;
• request deletion of personal data;
• withdraw consent where processing is based on consent;
• object to or request restriction of certain processing;
• request account closure;
• request an explanation of our personal data processing practices; and
• lodge a complaint with an applicable data protection authority.

To exercise a privacy right, please send an email with the subject line "Privacy Request" to: privacy@caratshelf.com

The request should include sufficient information to allow us to identify the relevant account or records, such as the account email address, reseller storefront, or connected domain, together with a description of the requested action.

To protect personal data from unauthorized disclosure or deletion, we may request reasonable information to verify the requester's identity or authority. We will use verification information only for the purpose of processing the request.

We will respond without undue delay and generally within thirty (30) days after receiving a verifiable request. Where additional time is permitted by applicable law, we will inform the requester of the extension and the reason for it.

Deletion is not absolute. We may retain limited information where necessary to comply with legal obligations, maintain security, prevent fraud or abuse, resolve disputes, enforce agreements, or establish, exercise, or defend legal claims. Closing or deleting an account may also result in the removal or deactivation of the associated reseller storefront, custom domain connection, content, and Platform access.

Requests will generally be processed without charge. Where permitted by applicable law, we may refuse or charge a reasonable administrative fee for requests that are manifestly unfounded, excessive, repetitive, or technically disproportionate, and we will explain the applicable reason.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date at the top of this page.

Contact

Questions about this Privacy Policy: privacy@caratshelf.com