Privacy policy

Who is responsible

Shapelabs operates Sellessa and is responsible for information used to run the platform. Email support@sellessa.com for privacy questions; business details are on Contact. Independent sellers are responsible for their own handling of buyer data outside platform services.

Information we process

We process account emails, hashed passwords, sessions, shop and listing details, seller applications, order contact and delivery information, messages, saved products, follows, reviews, support requests and moderation records. Public listings, reviews and published seller details can be read and indexed by others. Private application and verification data is not automatically copied into public business details. Downloadable product files are held privately.

Purposes and legal bases

We use information to provide requested services and take steps requested before an agreement, meet legal obligations, and pursue legitimate interests in account security, fraud prevention, complaint handling and reliability, subject to your rights. Optional analytics rely on consent.

Product and shop views use a hashed random 30-minute session identifier within a 90-day reporting window. Sellers see aggregate counts, not visitor identities. View records contain no IP addresses or account IDs. With analytics consent, we also record public page visits, cart additions, campaign labels and referrer domains using a separate hashed 30-minute session. Checkout attribution links that session to an order so we can measure confirmed sales; it is therefore pseudonymous, not anonymous. Staff see aggregate acquisition reports. Do not include personal information in campaign labels. No advertising trackers are currently installed.

Providers and sharing

Hostinger supplies the VPS infrastructure. Resend processes recipient addresses and email content for account and transactional notifications. Support email is handled through Microsoft 365 supplied through GoDaddy.

Sellers access data needed for their own orders and messages. Authorized staff access information needed for support and administration. Shopify and CJ support catalog imports; the importer does not itself place supplier fulfillment orders or automatically transmit buyer delivery addresses. Sellessa does not collect payment-card details through its website.

Storage, retention and security

Browser storage supports sessions, carts, country, currency and preferences. Recent product identifiers and return-to-browsing location remain in session storage; see Cookies.

Account and shop data remains while needed for the service. Orders, accounting, acceptance and complaint records may require retention for legal obligations or disputes after closure. Deletion requests are reviewed and do not automatically erase records that must be retained. Sessions expire after seven days, verification links after 24 hours and reset links after one hour. Analytics records older than 90 days are removed as new views are recorded. Other records and backups require controlled deletion.

Passwords are hashed and access is checked on the server. Providers may process data in multiple countries; contact us for the applicable provider arrangements and safeguards. Do not send passwords, payment credentials or unnecessary identity documents through support messages.

Your rights

Depending on the circumstances, you can request access, correction, deletion, restriction or portability, or object to legitimate-interest processing. Withdraw analytics consent in Cookie preferences. Use Account → Privacy & data or email support@sellessa.com without an account. Proportionate identity checks may be needed. GDPR responses are normally due within one month; permitted extensions must be explained. You may complain to the Autoriteit Persoonsgegevens or your relevant data-protection authority.