Privacy Policy

Effective date: May 8, 2026 Last updated: October 15, 2026

This Privacy Policy explains how Inventory Connect LLC ("Inventory Connect," "we," "us," or "our") collects, uses, shares, and protects information when you use the InventoryConnect.io platform (the "Service"), including the website at inventoryconnect.io, the dashboard application, the public lead and storefront APIs, and related services.

This policy covers two distinct kinds of relationship:

• You as our customer — the businesses and the people they authorize who sign up to use the Service. You're the "data subject" in this category.
• Your customers' personal information — names, contact details, and purchase history that you put into the Service so it can run your business. You are the "controller" / "business" for that data; we're the "processor" / "service provider" acting on your instructions. See your Terms of Service Section 3 for that distinction.

If you want the short version of what we will never do with your customers' data, read Our promise to dealers just below. If you connect Gmail, Google Calendar or Google Drive, Google user data after it explains exactly what we do with what we receive from Google.

If something is unclear, email support@inventoryconnect.io and we'll answer.

Our promise to dealers: your customers are yours

Most people who use InventoryConnect are dealers, and the people behind Inventory Connect LLC have run a watch business themselves. We know exactly why a dealer hesitates before putting a client list, cost prices and sales history into someone else's software. This section is the plain-language answer, and it is binding on us under the Terms of Service.

1. We never use your Customer Data for our own dealing. Your customer profiles, contact details, wishlists, purchase history, cost prices, sale prices, margins, supplier names, notes and photos are used for one purpose only: running the Service for your store. No one at Inventory Connect LLC, and no business affiliated with it or with its owners, may use that information to source, price, buy, sell, market or broker anything, to approach your customers or suppliers, or to gain any commercial advantage. This is a hard rule, not a preference, and it does not change when a store leaves the platform.

2. Affiliated dealers get nothing from your store. Any business owned by, related to, or sharing staff with Inventory Connect LLC uses the Service as a tenant, on the same terms as every other store. It cannot open your inventory, customers, costs, suppliers or sales, and it receives no reports, exports, summaries or hints drawn from them. The one arrangement that lets stores work inside each other's records is a small partner group of stores that trade together and asked for it (the owners' own store is in it): we switch it on only for the stores in that group, it works only between those stores, and it can never reach a store outside it. Your store is not in it unless you asked to be.

3. Every store is walled off. Your records are keyed to your store, and the Service reads and writes only the store you are signed in to; our tests check that a request naming another store's record by id is refused. Another store cannot open, search, export or be shown your customer records, sale records, cost prices, supplier names or notes. The cross-store features that exist show only what they say they show, and none of them carries anything about your customers:

• The Dealer Marketplace shows other dealers your available pieces with a photo and a wholesale price, under your store's name. It is on for every store by default so dealers can trade with each other, and you can turn it off in Settings. Dealer-to-dealer chat, the wanted board (wants you publish) and the dealer-to-dealer invoice directory (your store name and city, so another dealer can address an invoice to you) follow the same switch.
• A dealer-to-dealer invoice is shown to the dealer you addressed it to, and to no one else.
• WatchDrop shows trade-group posts collected from an outside service. Nothing in it comes from your store's records.
• Market-price comparisons (the Marketplace price signal and Market Logic) use asking prices and sale prices from across the platform as anonymous market data: ranges and medians only, never a name, a row, a cost, a customer, a store or a supplier, and only where at least three different dealers contributed, with your own store's figures left out of your own reads. This is how the platform's market numbers are built; it is not switched off per store, it is the only use of your prices outside your store, and it treats every store alike.

Nothing about your customers ever appears on any other store's screen.

4. We do not sell, rent, trade, license or share your Customer Data. Apart from the sharing features described in 3, which show only what they say they show: not to data brokers, not to marketing companies, not to other dealers, not to marketplaces, not to "partners", and not in anonymised or aggregated form that could be traced back to you or your customers. Your customers' names and contact details are never used to market InventoryConnect or anything else to them.

5. We do not mine your data for our own benefit. Beyond the anonymous market numbers described in 3, we do not build buyer lists, demand signals, pricing models or competitive reports from your Customer Data for ourselves or for anyone else. Any feature that shows market-wide numbers uses figures that carry no customer, store or supplier identity, and it treats your store exactly like every other.

6. Our staff access is limited and reviewable. Inventory Connect staff open a store's records only to answer a support request you made, to fix a problem you reported or one our monitoring found, to comply with law, or with your written permission. Staff accounts can reach any store on the platform, which is what makes support possible; the rule above is what governs when they may. Every staff member signs in with their own named account, and we limit what they do to what the task needs. Changes staff make to your inventory items and customer records are written to the same item history and customer timeline your own team sees; privileged staff actions (such as stepping into a store's view, or team and API-key changes) are written to an internal audit log; and we will give you the entries for your store on request. Staff are bound by written confidentiality obligations that cover everything in this section.

Email synced from a Gmail or Outlook mailbox you connected, and documents and shipment files you imported from Google Drive, are held to a stricter rule: our staff cannot see them at all unless an owner or admin of your store grants support access (Settings → Support access, or from a support ticket). A grant lasts 72 hours unless you choose another length, never more than 7 days, and you can end it at any time. Your store's grant covers the store's shared mailboxes and Drive files; a teammate's own mailbox opens only when that teammate grants access to it, the same way, from My mailbox. Every time staff view that email or those files while a grant is open, it is logged, and the Support access page lists those views for you. The section Google user data below describes the only other exceptions.

7. Your data is not used to train AI models. The assistant features described below act on your store's records to do what your team asks, to finish work your team started (such as a batch of listing descriptions), and, for our staff, to handle a support request you sent us. We do not use your data, or Google user data, to train generalized AI or machine-learning models, and the AI providers listed in Section 3.1 process it only to answer those requests, under the contractual obligations described there.

8. When you leave, your data leaves. You can export your inventory, customers, sales, purchases and shipments as spreadsheets at any time from the dashboard, and we will give you a full export of the rest on request (Terms, Section 8.4). When you delete your account yourself in the dashboard it is deleted at once; when you close it by asking us, we delete your Customer Data on the schedule in Section 4. Until it is deleted every promise in this section continues to apply.

9. If we get this wrong, you will hear it from us first. If your Customer Data is accessed or disclosed in breach of this section we will tell you without undue delay and no later than 72 hours after we confirm it, tell you what was involved, and tell you what we are doing about it.

If any other part of this policy could be read to allow something this section forbids, this section wins.

Google user data (Gmail, Google Calendar and Google Drive)

InventoryConnect's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This section covers the information we receive when someone in your store connects a Google account. Each connection asks Google for its own permission, and you can disconnect any of them at any time.

What each connection accesses, and why

Gmail (a Store email, or a teammate's own mailbox, connected in Settings). We ask Google for permission to read, send and modify mail (gmail.modify) and to see the account's email address (userinfo.email). We use them to:

• Bring new mail into your Inbox. From the moment you connect, new messages that arrive in the mailbox (not drafts, spam, trash, or mail sent from Gmail itself) are copied into InventoryConnect: the sender and recipients, subject, date, the message text and its formatted (HTML) version, and Gmail's message and thread ids. Older mail is not copied in. If you list "only bring in mail sent to these addresses", other mail is skipped. Attachments are not downloaded. Google's Pub/Sub notification service tells us when the mailbox changes, so new mail appears quickly.
• Send the email your team writes in InventoryConnect from that address, so replies stay in the same Gmail conversation.
• Keep deletes in step, only if your store switched on Sync deletes for that mailbox: a message someone in your store deletes in InventoryConnect is moved to Gmail's Trash, and a message moved to Trash in Gmail is hidden in InventoryConnect. We never permanently delete anything in Gmail, and apart from that we don't change your mailbox.

A teammate's own mailbox is visible only to that teammate and to the people your store allows to see every mailbox.

Google Calendar (the booking calendar, connected in Settings → Appointment types). We ask to create and change events on calendars the account owns (calendar.events.owned), to see when the calendar is busy (calendar.freebusy) and to see the account's email address (userinfo.email). We use them to add the appointments booked through InventoryConnect to your calendar, with your customer invited, to update or remove those events when the booking changes, and to check busy times so we don't offer a slot you're not free for. We keep the ids of the events we created and the account's address. Busy times are read when slots are offered and are not stored.

Google Drive (connected in Settings → Integrations; offered to a limited group of stores for now). We ask to read files (drive.readonly) and to see the account's email address (userinfo.email). Your store admin chooses which shared drives or folders can be used, and your team can browse only those. A file is copied into InventoryConnect only when someone in your store imports it into a piece's photos, a piece's documents or a shipment, or when your store sets a folder to be watched so new photos in it are imported into one piece's gallery. We never change anything in your Drive. Photos you import into a piece's photo set become that piece's photos and appear wherever its photos appear, including your public listings and sales channels. Documents and shipment files you import are stored as your store's files, like ones you upload. We keep a list of which Drive file became which record, so the same file isn't imported twice.

How we use it

Only to provide the features your team uses: showing your email in the Inbox and on client timelines, searching it, replying, notifying your team about new email, running the automations your store set up, the booking calendar, the Drive imports, and answering your team's questions in Ultron. We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized AI or machine-learning models.

Ultron, the in-app assistant, reads synced email or a Drive-imported document only when someone signed in to your store asks it a question that needs it. To answer, the relevant text is sent to the AI provider handling that question, Anthropic or OpenAI (Section 3.1); requests to OpenAI are sent with storage of the response switched off; and when Ultron reads an answer out loud with Natural voice on, the text of that answer is sent to OpenAI to create the voice. Under the API terms we use them on, these providers do not use that data to train their models. Nothing else in InventoryConnect sends your email to an AI service: the handling of website lead notifications and automated senders follows fixed rules, with no AI involved.

Who receives it

• The providers that run the Service for us (Section 3.1): Vercel runs the application, Neon holds the database the email is stored in, Cloudflare carries traffic to the Service and stores imported Drive files, and Fly.io keeps our standby copy of the Service, a read-only copy of the database and the nightly backups.
• The AI providers above, only to answer your team's own questions.
• Push notification services (Apple, Google and your browser's push service): when a teammate has switched on notifications for new email, the notification carries the sender, the subject and a short preview.
• Places your store sends it. An API key or connected AI app reads synced email only if an admin ticked the separate Read synced email (Gmail and Outlook) permission for it (Section 3.6). Outbound webhooks never carry the text of synced email. Automations your store builds never receive a synced email's text, and the text is not stored with the automation's run. An automation does run when one arrives, with who it is from — the sender's name and email address — and a webhook step your store adds can send those on.
• Nobody else, except as required by law (Section 3.4) or in a business transfer (Section 3.5), where this section continues to apply.

Information from an email can also become part of your store's own records when your team or a feature your store switched on puts it there, for example a client's contact details or a note. Those records are your Customer Data like any other. In particular, a deal or client created from a website lead notification copies the visitor's details, their message and the notification's subject into your records, which then behave like the rest of your Customer Data: an API key or app with read:crm can read them, deal and customer webhooks and automations can send them on, and our support staff see them under the usual rules for your store's records. Delete all synced email does not remove them — delete that deal or client to do so.

Who at InventoryConnect can see it

Synced email, and documents and shipment files imported from Drive: no one, unless your store grants support access (see Our promise to dealers, point 6) — and a teammate's own mailbox only if that teammate grants it — with every view logged and listed for you. The only other exceptions are automated processing for security and abuse prevention, with no person reading the content; where necessary for security purposes, such as investigating abuse; to comply with applicable law; and aggregated, anonymised figures for running the Service (such as how many messages were synced), which never include the content of a message.

How long we keep it, and how to delete it

• Synced email stays in your store until you delete it. Deleting a message or conversation in the Inbox removes it from your team's view (it is kept as a record of what was said); to remove synced email from our systems, choose Delete when you disconnect the mailbox — we ask every time — or use Delete all synced email for that mailbox in Settings → Email accounts, at any time after. That permanently deletes every message we synced from or sent through that mailbox for your store. Email from before October 2026 whose mailbox we can't tell is listed there as Email of unknown origin, treated as synced email (hidden from our staff like the rest) and can be deleted the same way. An answer Ultron already gave stays in that person's Ultron history.
• Disconnecting a Gmail, Calendar or Drive connection deletes the access tokens Google gave us and stops all access straight away. To also remove InventoryConnect from your Google account, use your Google Account's security settings (third-party apps and services).
• Drive files you imported are your store's files, imported at your direction; they stay until you delete them, also after you disconnect Drive. Calendar events we created stay in your calendar.
• Closing your account deletes the synced email with it: deleting a store (or the last account on it) deletes all of the store's synced email at once; deleting one teammate's account deletes the email their own mailbox synced; and if you ask us by email, we delete it within 30 days of confirming the request.
• Copies. The read-only database copy follows a deletion within seconds. Nightly backups are kept for 15 days and removed by the next nightly run after that, so a deleted message is gone from every backup within 16 days.

The access tokens Google gives us are encrypted when stored, and everything is encrypted in transit.

1. Information we collect

1.1 Information you give us when you sign up or use the Service

1.2 Information your business creates inside the Service

This is "Customer Data" under the Terms:

• Inventory records (watches, handbags, photos, prices, costs, internal notes)
• Customer profiles you add (names, emails, phones, addresses, tags, notes, lifetime-value rollups)
• Sale transactions, invoices, payment records
• Wishlists, opportunities, tasks, pipelines
• Repair tickets and service-center records
• Integration credentials (Shopify access tokens, QuickBooks tokens, Klaviyo API keys, webhook URLs and secrets)

You control this data; we process it under your direction.

1.3 Information we collect automatically

Our public marketing website (the home page, features, developers, contact and similar pages — not the privacy policy, terms, EULA or data-deletion pages) uses the Meta Pixel and Google's tags (Google Analytics and Google Tag Manager) to measure visits and our advertising. They are described in Section 10, with how to opt out. They never run once you are signed in, inside the dashboard or the mobile app, on your storefront, or on any page that carries a private link. We do not use fingerprinting or third-party session-replay tools. We do operate a first-party, in-app session-recording feature used solely to debug and support the dashboard — described in Section 1.5.

1.5 In-app session recording (dashboard)

To diagnose bugs and provide support, we operate a first-party session-recording tool built into the dashboard. When enabled for a dashboard session, it records a replay of how you moved through the dashboard — the pages and views you navigated, clicks, scrolling, and the visual structure of the page — so our team can reproduce and fix issues.

What it does and does not capture, and how it's protected:

• On-screen text and inputs are masked. Both the text you type into form fields and the text displayed on the page (customer names, emails, phone numbers, prices, notes, and other business data) are masked at capture time and are not recorded in readable form. The recording captures interaction and layout — where you clicked, what you navigated to, how the page was laid out — not the contents of what you type or view. Page-address query strings (which can contain search terms) are stripped before recording as well.
• Storage on our own infrastructure. Recordings are stored, encrypted at rest, in our own Cloudflare R2 bucket (the same provider that holds your photos). They are not sent to any third-party session-replay service.
• Operator-only access. Recordings are viewable only by Inventory Connect platform operators (our engineering/support staff) for debugging and support. They are not exposed to other dealers or to anyone outside our operator team.
• Short retention. Recordings are automatically deleted after 30 days (see Section 4).
• Internal / demo sessions are excluded. We do not record our own operators' or demo sessions.

If you have a view or field that must never appear in a recording, contact support and we can additionally exclude it.

1.4 Information from integrations you connect

When you connect Shopify, QuickBooks, Klaviyo, etc., the relevant integration exchanges data with that service on your behalf — inventory pushes, sales metrics, customer events, etc. We act on your authorization. The third-party service's privacy policy governs what it does with the data on its side. What we receive from Gmail, Google Calendar and Google Drive is covered in Google user data above.

2. How we use information

2.1 To provide and improve the Service

• Authenticate users, secure sessions, and gate access by role
• Run inventory, CRM, sales, and integration workflows
• Send transactional emails (verification, password reset, ticket receipts, repair updates, sale notifications)
• Investigate bugs, errors, and performance regressions
• Build and improve features based on aggregated usage

2.2 To communicate with you (the account holder)

We send a small number of operational emails to the address on your account. These include:

• Account verification, password reset, security alerts
• Billing receipts and payment-method updates
• Material changes to these policies (with at least 30 days' notice for substantive changes)
• Major product announcements (you can opt out without losing account access)

We do not send promotional / advertising email to your customers without your separate authorization through an integration you connect.

2.3 For analytics and product development

We use aggregated, de-identified usage statistics to understand how the Service is used and to improve it. We do not sell this data and we do not combine it with personally identifying data for advertising purposes.

2.4 To comply with law and protect rights

We may use information to comply with subpoenas, court orders, or legal obligations, to enforce these Terms, to investigate fraud or security incidents, and to protect the rights, property, or safety of Inventory Connect, our users, or others.

2.5 What we don't do

• We do not sell, rent, trade, license or share your personal information or your Customer Data with anyone for their own use.
• We do not use your Customer Data, or anything derived from it, for our own dealing, sourcing, pricing, marketing or brokering, or for that of any affiliated dealer — see "Our promise to dealers".
• We do not use your data, or Google user data, to train generalized AI or machine-learning models.
• We do not use your customers' contact details to market InventoryConnect, or anything else, to them.
• We do not show one store's customers, costs, suppliers, notes or sales records to another store, ever, except through the sharing features described in "Our promise to dealers", which show only what they say they show.
• We do not access your records except for the reasons listed in "Our promise to dealers", and never for curiosity.

3. How we share information

We share information only with these categories of recipients:

3.1 Subprocessors and infrastructure providers

The Service runs on a small set of trusted vendors that process data on our behalf. Current subprocessors:

Each is bound by contractual confidentiality and security obligations equivalent to those in this policy. We may add or remove subprocessors and will update this list.

3.2 Integrations you authorize

When you connect a third-party service (Shopify, QuickBooks, Klaviyo, Mailchimp, Twilio, Stripe, Authorize.net, Affirm, Facebook Lead Ads, etc.), the integration exchanges data with that service. Each is governed by its own privacy policy. You can disconnect at any time from the Integrations page; disconnection stops future data exchange but doesn't recall data already shared.

3.3 Other users in your store

Information you record (sales, customer notes, opportunities, tasks) is visible to other staff in your store with appropriate roles. Per-employee scoping rules apply for tasks and opportunities; see the in-app help for specifics.

3.4 Legal requests and protection

We may disclose information when required by law, valid legal process (subpoena, court order, etc.), or when necessary to investigate fraud, abuse, or security threats. Where lawful, we will notify the affected account before disclosing.

3.5 Business transfers

If Inventory Connect is involved in a merger, acquisition, asset sale, financing, or bankruptcy, your information may be transferred. The acquirer will be bound by this Privacy Policy or will give you advance notice and a chance to opt out before any material change in how your information is used.

3.6 API keys and AI apps you connect

An owner or admin of your store can create an API key, or connect an AI app, that reads your store's records with the permissions they tick. Reading message history (read:conversations) covers texts, calls, social messages and email at your store's built-in address. Email synced from a connected Gmail or Outlook mailbox is returned only when the separate Read synced email (Gmail and Outlook) permission (read:email) is ticked as well; it is never ticked for you, and keys and apps connected before it existed do not have it. A teammate's own mailbox is never readable this way. You can revoke a key or app at any time in Settings → API keys.

4. How long we keep information

You can delete your account yourself at any time, from any device, in Settings → Your profile → Danger zone → Delete account. It takes effect immediately. If you are the only person on your store, the store and everything in it goes with your account; if colleagues remain, the store's records stay with the business. See Data deletion for the detail. You can also request deletion by emailing us, subject to legal retention obligations.

5. Security

We use reasonable technical and organizational measures to protect information, including:

• TLS 1.2+ in transit; encryption at rest for the database and photo storage
• Hashed passwords (never stored in plaintext)
• Role-based access controls inside the dashboard
• HMAC-signed webhook deliveries (where supported)
• Segregated production / preview environments with separate databases
• Logged + audit-trailed administrative actions
• Vendor security reviews before adding new subprocessors

No system is 100% secure. If we discover a security incident affecting your information, we will notify you without undue delay, consistent with applicable law.

6. Your rights

Depending on where you live, you may have rights including:

• Access — get a copy of the personal information we hold about you
• Correction — fix inaccurate information
• Deletion — ask us to delete personal information (subject to legal retention)
• Portability — receive a copy in a portable format
• Objection / restriction — object to or restrict certain processing
• Marketing opt-out — unsubscribe from product-update emails at any time via the unsubscribe link or by emailing us
• Withdraw consent — where processing is based on consent

To exercise these rights, email support@inventoryconnect.io. We will respond within 30 days (or as required by applicable law). If your rights request relates to data we process on behalf of a customer (Section 3.4 of the Terms), we will route the request to the responsible account holder.

You also have the right to lodge a complaint with a data protection authority where applicable. We will not retaliate against you for exercising these rights.

7. California residents (CCPA / CPRA)

If you live in California, you have the rights described in Section 6 above. The categories of personal information we collected in the past 12 months map to:

• Identifiers (name, email, phone, IP) — for account, billing, security
• Customer records (billing details) — for billing
• Commercial information (subscription tier, fees paid) — for billing
• Internet activity (page views, error logs, in-app session recordings) — for security, analytics, and debugging/support
• Inferences (none for advertising purposes)

We do not "sell" personal information as defined by the CCPA. Apart from the marketing-website tags described in Section 10 — which tell Meta and Google that a browser visited our public marketing pages, for our own advertising, and which you can opt out of as described there — we do not "share" personal information for cross-context behavioral advertising, and nothing from inside the Service, from your Customer Data or from Google user data is ever shared for it.

You may submit a verifiable consumer request via support@inventoryconnect.io. We will not discriminate against you for exercising your CCPA rights.

8. International users

The Service is operated from the United States. If you access it from outside the U.S., your information will be transferred to, processed, and stored in the U.S. and other countries where our subprocessors operate. By using the Service you consent to this transfer.

For data subjects in the European Economic Area, United Kingdom, or Switzerland: we rely on Standard Contractual Clauses (or equivalent transfer mechanisms) where required.

9. Children's privacy

The Service is not intended for, and does not knowingly collect personal information from, anyone under the age of 16. If you believe a child has provided us personal information, please contact us and we will delete it.

10. Cookies and similar technologies

Inside the Service (the dashboard and the mobile app, once you are signed in) we use only first-party cookies and storage that the Service needs:

• Session cookie (httpOnly, secure) — keeps you logged in
• Preference cookies and localStorage — theme, sidebar and inbox view choices, and similar UI preferences
• OAuth state cookies (httpOnly, secure, short-lived) — secure third-party connection round-trips
• An app marker — tells our server it is talking to the mobile app, so the marketing tags below are never loaded there

There are no advertising or analytics tags inside the Service.

On our public marketing website (the home page, features, developers, contact and similar pages) we use:

• The Meta Pixel (Meta Platforms) — tells Meta that a browser visited our marketing pages, so we can measure and target our own advertising for InventoryConnect.
• Google Analytics 4 and Google Tag Manager (Google) — measure how visitors use the marketing site, and manage these tags.
• A first-party signup attribution cookie — remembers, for up to 90 days, which link or ad brought you to us, so that a signup can be credited to it.

These tags set their own cookies and send the address of the page you are on, your browser details and those cookies to Meta and Google, which handle that data under their own privacy policies. They are not loaded on the privacy policy, terms, EULA or data-deletion pages, on any page with a private link, on your storefront, or anywhere once you are signed in, and they never receive anything from inside the Service. To opt out, block or clear cookies in your browser; use Google's Analytics opt-out browser add-on; and manage Meta's use of this data in your Meta ad preferences. If you clear cookies you'll be logged out and your UI preferences will reset.

Your storefront is your own website: any analytics or advertising tags on it are the ones your store adds there.

11. Changes to this policy

We may update this Privacy Policy. The "Last updated" date at the top reflects the most recent change. Material changes will be announced at least 30 days in advance via email to the account owner or an in-app banner.

12. Contact

Questions, requests, or complaints? Email support@inventoryconnect.io or write to:

Inventory Connect LLC Attn: Privacy support@inventoryconnect.io

This Privacy Policy reflects our current practices. It is not legal advice. We recommend you have your own counsel review this policy and confirm it matches your specific obligations under applicable law.