Privacy Policy

1. Who and what this Policy covers

This Policy covers information about U.S.-based adult account holders, including Authors, Booksellers and the named people who operate Bookseller accounts, and ConsignWrite staff who use administrative accounts. It also covers information visitors provide or that our hosting providers receive when people use our website and Services. It also covers information that a Bookseller enters about an Author who has not yet created an account, as described in Section 3.

Our Shopify integration currently imports order line items rather than retail-customer records. ConsignWrite does not import a retail shopper's name, email address, phone number, or billing or shipping address as part of that integration. Users may nevertheless enter other people's information in free-text communications or notes; please avoid including personal information not needed for a consignment relationship.

The Services are intended for people aged 18 or older and are not directed to children.

2. Information we collect

The categories below reflect the features currently present in the live application. Some information is optional, depending on the account and features you use.

Account and authentication data. Email address, authentication identifiers, sign-in sessions, account role, and account status. Passwords are handled by Supabase Auth and stored in hashed form, rather than as readable passwords in ConsignWrite's user records.

Author and Bookseller profiles. Names, biography, hometown, website, social-media links, avatar, and time zone (initially read from the browser at sign-up and later editable). Author profiles can include genres written and a discoverability setting. Bookseller profiles can include store name, street address, city, state, telephone number, website, description, logo, genres carried, and whether the store accepts requests.

Images and book listings. Uploaded author avatars, store logos, book covers, and book metadata, such as titles, ISBNs, descriptions, prices, genres, and book-representation tags (including LGBTQ+ representation tags referring to books, not to an Author's personal identity). Publicly accessible images and active listings are described in Section 4.

Consignment and communication records. Requests, counter-offers, related messages and comments, agreements, commissions, inventory counts, sales, waitlist entries, release notices, and related activity. Records can concern both parties to a consignment relationship.

Settlements and records of payments outside the platform. Settlement statements, line items, amounts due, adjustments and reasons, disputes and Author notes, payment amounts and dates, methods (such as check, cash, bank transfer, or other), check numbers or transfer references, payment notes, and Author confirmations or disputes. These entries record payments that Booksellers say they made outside ConsignWrite; they do not cause ConsignWrite to transfer money.

Subscription information and Stripe events. Subscription plan, customer and subscription identifiers, subscription status, period end, and copies of full subscription-related Stripe webhook event payloads. Webhook payloads may include billing names, email and mailing addresses, card brand, and the last four digits of a card. Stripe processes payment methods on its own systems.

Stripe Connect testing metadata. In test mode only, a connected-account identifier and onboarding status. Stripe handles onboarding identity and bank-account details directly; the live ConsignWrite application does not receive or store those details. Live settlement payouts are disabled.

Shopify integration and sale information. For a Bookseller who connects Shopify, we store the shop domain, integration credentials and access token, selected Shopify location, and imported order identifiers and line-item details: product, quantity, price, and time. We also keep sync and unmatched-item logs for review. The currently imported sale records do not include retail-customer contact or address information.

Support, account enforcement, and administrative records. Support messages; account suspensions and reasons; user-facing and staff-only case notes; and audit logs showing which administrator performed an action concerning an account and when. Comments that a user deletes are generally hidden from the ordinary user interface but retained in the database with a deletion indicator.

Technical information. Our hosting and database providers may process request and server logs, including IP address, browser or device user-agent information, request times, and information sent with a request. We also maintain authentication-session information. The exact content and duration of provider-managed technical logs depend on those providers and the services in use.

We do not obtain personal information from third-party data brokers. We do not ask users to place Social Security numbers, complete card numbers, banking credentials, or identification documents in general-purpose notes, comments, dispute descriptions, or support messages.

3. Where information comes from

We receive information directly from users when they sign up, manage profiles, upload files, enter books or records, send messages, make comments, or request support. A counterparty to a consignment relationship may also enter information about another user in a request, agreement, settlement, or payment record.

Author records created by a Bookseller. A Bookseller may create an Author record before the Author has a ConsignWrite account, so that books the Bookseller already holds on consignment can be tracked. The Bookseller may enter, or import from its connected Shopify store, the Author's name, email address, book titles, ISBNs, prices, commission rate, inventory counts and sales. Until the Author claims the account, the record is managed by that Bookseller and is not shown in Author discovery; its book listings are otherwise treated like the book listings described in Section 4. We send the Author an invitation email only when the Bookseller chooses to. An Author who claims the account can review and correct this information, and any Author may contact us under Section 16 about it.

For connected Booksellers, Shopify supplies authorized product, inventory, order-line and related synchronization information. Stripe supplies subscription and billing event data, and limited test-mode Connect account metadata. Supabase and Vercel process authentication, database, storage, application requests, and related technical records. We also create administrative and audit records while providing the Services.

4. Visibility of profiles, books, images, and shared records

Profiles visible to other users. Profiles are not visible to people who are not signed in. A signed-in ConsignWrite user can see the public-facing fields of an Author who is marked discoverable, or of a Bookseller that accepts requests, unless the account is suspended or, for a Bookseller, its subscription has ended. Public-facing fields may include names, biography, hometown, genres, websites and social links, avatar, and for Booksellers, store name, city, state, phone number, website, description, logo, and genres carried. Profiles on a paid plan show a checkmark and are listed first when users browse for Authors or Booksellers; the specific plan is not shown.

Public images and active books. Uploaded avatars, store logos and book covers are stored in publicly accessible storage locations and can be viewed by anyone who has their direct links, even if the associated profile is not otherwise discoverable. Active book listings, including their titles, descriptions, prices and other book metadata, are accessible without sign-in. Do not upload images or book information you expect to remain confidential.

Additional account information visible to counterparties. Under the current application permissions, a person with whom you have or have had a consignment request, agreement, waitlist entry, or release notice (a "counterparty") can view your public profile fields, even if your profile is not discoverable, and these additional account details: email address, time zone, and whether the account is suspended (shown in the application only as "Temporarily unavailable"). These fields may remain visible to past counterparties even after their related relationship ends. Database-level controls restrict counterparties from viewing your street address, subscription plan, subscription status or renewal date, Stripe customer/subscription/connected-account identifiers, Stripe payout-onboarding status, and internal administrator flag. These restrictions do not affect information you independently provide in messages, comments, or other shared records.

Consignment and settlement records. The Author and Bookseller associated with a record can access their shared requests, agreements, sales, inventory, settlement statements, recorded payments, comments, disputes, adjustment reasons, and related records. Unrelated ordinary users cannot access those private shared records through the normal application permissions. Counterparties do not see the internal staff-only notes within a suspension case, although affected users may see their own suspension communications.

Staff access. Authorized ConsignWrite administrators have access to account, support, transaction, and operational records to administer and support the Services. Staff or service personnel with appropriately provisioned database or hosting-provider dashboard access may technically be able to access more extensive information, including integration credentials and stored event payloads.

Email notifications. The Services also send selected record details to other participants by email, as described in Section 8. Recipients may retain or forward emails outside ConsignWrite's control.

Please review profile details, uploaded images, and notes before sharing them. Avoid entering highly sensitive information in fields visible to another user.

5. How we use information

We use information to:

• create and authenticate accounts and maintain user profiles;
• display book listings, profiles, discoverability settings, and store-request availability;
• administer consignment requests, agreements, inventory, sales imports, settlement statements, payments recorded outside ConsignWrite, disputes, adjustments, waitlists, and release notices;
• provide each Author and Bookseller with the shared records and notifications relating to their relationship;
• connect Shopify shops, synchronize products and transaction line items, and troubleshoot unmatched records;
• administer recurring subscription billing through Stripe;
• send account, operational, settlement, comment, overdue, release and support notifications;
• provide support, enforce our Terms, investigate suspected abuse, and keep administrative activity records;
• maintain, secure, debug and improve the Services; and
• comply with law, respond to valid legal process and maintain records relevant to disputes or legal rights.

We do not use the information collected through the Services for advertising targeting, cross-context behavioral advertising, or the sale of personal information. We do not currently send marketing email or use information from data brokers.

6. When we disclose information and to whom

Information is disclosed to Authors, Booksellers, signed-in users, the public, and ConsignWrite staff in the specific circumstances described in Section 4. We also use the following service providers:

• Supabase: database storage, authentication and sign-in sessions, and file storage. It processes account, profile, consignment, settlement, billing-event, and other application records stored in the service.
• Vercel: application hosting and request processing, including a scheduled job that sends overdue reminders. Requests to the application pass through Vercel and may contain information submitted or requested through the Services.
• Stripe: checkout and billing for paid subscriptions, subscription-account information and payment information supplied to Stripe, and test-mode Connect onboarding for non-live payout development.
• Resend: delivery of transactional emails. It receives recipient names and addresses and the content of the notifications, which can contain names, settlement amounts, time periods, notes, comments, payment-dispute descriptions, or adjustment reasons.
• Shopify: when a Bookseller enables the integration, we read authorized product (including each product's vendor name), inventory and order-line information and may create Shopify products using book information. Shopify processes this information under its own terms and notices.

We may also disclose information where reasonably required to respond to lawful legal process, prevent fraud or misuse, protect rights or safety, or complete a lawful business transfer such as an acquisition, subject to applicable law.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use advertising networks, advertising pixels, behavioral analytics services, or data brokers in the current application.

7. Shopify and Stripe specifics

Shopify. A connected Bookseller authorizes us to access selected Shopify information and to create products based on book records. ConsignWrite currently imports Shopify order identifiers and line-item data, not the retail customer's identity or contact information. Connection details include credentials and tokens required to maintain the integration. Booksellers remain responsible for their storefront disclosures, customer relationships, and data they enter into ConsignWrite.

Stripe subscriptions. Stripe handles checkout for paid ConsignWrite subscription plans. We store subscription identifiers and status and retain full subscription webhook event payloads, which can contain billing contact details and limited card descriptors. Stripe independently handles its payment-processing information and cookies on Stripe-hosted pages. Stripe's notice is available at https://stripe.com/privacy.

Author settlement payments. ConsignWrite currently only documents payments made by Booksellers to Authors outside the platform. Stripe Connect account identifiers and onboarding status are currently present only for test-mode development; live settlement transfers are disabled. We will revise this Policy and any necessary user agreements before introducing a live integrated settlement-payment feature.

8. Service emails and notifications

We send transactional and account-related email, not marketing email. Examples include sign-up verification and password-reset emails sent through Supabase Auth, as well as these application notifications sent through Resend:

• New comments, including the commenter's name and comment text;
• Issued settlements, including the store, period, amount owed and due date;
• Overdue settlement reminders, scheduled daily to check for overdue balances and sent approximately every seven days while a statement remains overdue, to the Bookseller with a copy to the Author;
• Payment confirmations or disputes, statement disputes or withdrawn disputes, and adjustments, including relevant names, notes, or adjustment reasons;
• Invitations a Bookseller asks us to send to an Author it has added, including the store's name;
• Waitlist and release notices, including names, notes, titles and release dates; and
• Account suspension messages and support responses.

The substance of a comment, dispute or adjustment may therefore be delivered in an email to the other party, not only displayed inside the Services. Please do not put passwords, financial credentials, identity documents or unrelated sensitive personal information in those fields.

There is presently no marketing mailing list or marketing-unsubscribe mechanism because we do not send promotional email. Account and settlement notifications are part of the operation of the Services.

9. Cookies and tracking

The current ConsignWrite site uses authentication/session cookies needed for sign-in through Supabase Auth. We do not currently operate analytics, advertising, tag-management or other behavioral tracking services, and we do not set advertising or analytics cookies. Site fonts are bundled with the application and are not requested from Google Fonts by a visitor's browser.

Stripe-hosted checkout and billing pages may use cookies and similar technologies under Stripe's own practices. You may control cookies using browser settings, although blocking necessary sign-in cookies can prevent the Services from working.

10. Retention, account closure and deletion

Present retention practice. ConsignWrite does not currently operate an automatic routine that deletes or expires account records, consignment information, settlement histories, support records, Stripe subscription webhook payloads, or Shopify synchronization logs after a set period. These records generally remain in our active database until an authorized person manually removes them or another action requires their removal. In practice, some records may be retained for an indefinite period. We are reviewing category-specific retention and deletion procedures.

Shared records. A consignment agreement, sale, statement, payment entry, or comment is shared between an Author and a Bookseller. There is ordinarily one underlying record used by both parties. Removing it can affect both participants' access, bookkeeping and evidence of their obligations. Some records, such as payment confirmations and adjustments, are designed to preserve an audit history.

Account deletion by request. There is currently no in-app delete-account button. You may request deletion by contacting us under Section 16. Deleting a sign-in account by itself does not remove all associated consignment records, and our current database may prevent full account deletion while associated books, agreements, sales, settlements or other records exist. We review such requests individually, including lawful obligations to maintain shared records, and explain what can and cannot be deleted. We will honor applicable legal rights and exceptions rather than treating a product limitation as a reason to deny a legally required request.

Cancelled subscriptions. Cancellation does not automatically delete data. A cancelled Bookseller subscription is currently read-only for most purposes, while still permitting the Bookseller to view and settle existing records as provided by the Services.

Hidden comments and historical data. When a comment is deleted through the ordinary interface, it is typically marked as deleted and hidden from ordinary users rather than erased from the database. Account suspensions, administrative audit entries and historical settlement records also remain stored unless separately removed under an authorized process.

Provider backups and logs. Supabase and Vercel retain their own backup and technical log data according to the applicable provider services and account plans. Specific retention periods for those copies have not yet been verified. Information deleted from the live application may remain in backups or provider logs for a further period, subject to provider controls and legal requirements.

We may preserve information where reasonably necessary or legally required to resolve disputes, enforce agreements, prevent misuse, or satisfy applicable recordkeeping duties. We also recognize that some privacy laws require data minimization and impose limits on retention; our practices are subject to those obligations where applicable.

11. Security

Our application uses authenticated accounts and database row-level controls to govern ordinary users' access to different records. Database-level access controls restrict which profile fields counterparties can view, as described in Section 4. Certain profile details and active-book information are intentionally publicly accessible or shared more broadly. Administrative and provider-level access is separate from ordinary user access.

No online service can guarantee absolute security. We review our access controls and data handling practices and will provide security incident notices when applicable law requires them. Users should secure their login credentials and avoid entering sensitive payment or identity information in general-purpose text fields.

12. Your choices and privacy requests

You may edit certain profile information and, where available, change Author discoverability or Bookseller request-acceptance settings. These settings do not necessarily remove direct access to previously uploaded public images or erase historical records already shared with a counterparty.

You may request access to, correction of, or deletion of personal information by contacting legal@consignwrite.com. Depending on your residence, the nature of the information, and applicable privacy law, additional rights may apply, including obtaining a copy of information, appealing a denial, or exercising rights through an authorized agent. We may verify a requestor's identity and authority before disclosing or changing records, and we will respond as required by applicable law.

If a Bookseller created a record about you before you had an account, you may claim the account using the invited email address to review and correct it, or contact us at legal@consignwrite.com to make any of the requests above.

Our current account deletion process requires support assistance. Shared Author–Bookseller records and data needed for a legal purpose may not be removable immediately, but a product constraint does not eliminate a statutory privacy right. If we cannot fulfill all of a request, we will explain the reason to the extent required by law.

We do not provide a sale-of-data or behavioral-advertising opt-out tool because our current practices do not involve selling personal information or sharing it for cross-context behavioral advertising. If that changes, we will update our disclosures and provide applicable choices. We will not unlawfully discriminate against individuals who exercise privacy rights.

13. Children

The Services are intended for adults aged 18 and older. We do not knowingly offer accounts to children. If you believe a child has registered or supplied personal information to us, contact legal@consignwrite.com so we can review the concern.

14. U.S. service and processing locations

ConsignWrite currently offers accounts to U.S.-based users. Our service providers operate their own infrastructure; the precise hosting and support-access regions for our current plans have not yet been verified. We do not represent that all information remains exclusively in the United States. We will comply with applicable location and transfer requirements where they apply.

15. Changes to this Policy

We may revise this Policy as our practices, Services or applicable law change. We will post a revised policy with an updated date and provide additional notice or obtain consent when required. A change to this Policy does not itself authorize new settlement-payment processing or other features requiring separate agreement or authorization.

16. Contact

ConsignWrite, LLC, doing business as ConsignWritePrivacy email: legal@consignwrite.comMailing address: 14405 Reeds St., Overland Park, KS 66223Terms of Service: https://consignwrite.com/terms