gumgumroad

Pre-launch draft

This document is a working draft while gumgumroad completes its legal review. It is not a substitute for final terms; a revised version will replace it before the marketplace opens to buyers.

Legal

Privacy Policy

Version dated 2026-08-31

gumgumroad Privacy Policy

Effective Date: [DATE]

Last Updated: [DATE]

1. Introduction

This Privacy Policy describes how gumgumroad, Inc. ("gumgumroad," "we," "us") collects, uses, and shares information about you when you use our Platform at https://gumgumroad.com.

2. Information We Collect

2.1 Information You Provide.

  • Account information: email address, password (stored hashed and salted by AWS Cognito, not by us).
  • Seller information: legal name, address, date of birth, tax identification number, bank account information (collected and stored by Stripe on our behalf; we do not directly store any of this).
  • Buyer information: shipping address, payment card information (collected and stored by Stripe; we do not store card details).
  • Listings and reviews: any content you post to the Platform.
  • Support communications: any information you provide when contacting us.

2.2 Information Collected Automatically.

  • Usage data: pages viewed, search queries, click events (via PostHog).
  • Device data: IP address (truncated after use for analytics), browser type, operating system, referrer.
  • Cookies: session cookies for authentication, and analytics cookies via PostHog.
  • Error data: JavaScript errors and stack traces (via Sentry) for debugging.

2.3 Information From Third Parties.

  • Stripe: identity verification status, payout information, chargeback and fraud signals.
  • Shipping carriers (via Shippo): tracking status and delivery confirmation.
  • Limitless TCG: tournament and deck data (which is not tied to any of our users).

3. How We Use Information

  • To operate the Platform, including processing purchases and payouts;
  • To communicate with you about your account, orders, disputes, and Platform updates;
  • To detect and prevent fraud, abuse, and violations of our Terms;
  • To improve the Platform, including product analytics and error monitoring;
  • To comply with legal obligations, including tax reporting.

4. How We Share Information

4.1 With Other Users.

  • Buyer to seller: name and shipping address for the purpose of fulfillment;
  • Seller to buyer: seller display name, city/state, ratings, reviews;
  • Public: listings, listing descriptions, seller display name, seller ratings, reviews.

4.2 With Service Providers.

  • Stripe for payment processing and identity verification;
  • Shippo for shipping tracking;
  • AWS for hosting and infrastructure;
  • PostHog for product analytics;
  • Sentry for error tracking;
  • [Email provider — AWS SES or Postmark] for transactional email.

4.3 For Legal Reasons. We may disclose information to comply with a subpoena, court order, or other legal process, or to protect the rights, property, or safety of gumgumroad, our users, or the public.

4.4 In a Business Transaction. If gumgumroad is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4.5 We Do Not Sell Personal Information. We do not sell your personal information to third parties for their marketing purposes.

5. Data Retention

  • Account information: retained for the life of your account, plus seven (7) years after account closure for tax and audit purposes.
  • Order records: retained for seven (7) years for tax purposes.
  • Analytics data: aggregated indefinitely; identifying data retained per PostHog default (currently seven days for session recordings, longer for events).
  • Support communications: retained for two (2) years.

6. Your Rights

6.1 All Users.

  • Access your account information via the Platform;
  • Delete your account via account settings (subject to Section 5 retention).

6.2 California Residents (CCPA / CPRA). You have the right to:

  • Know what personal information we collect and share;
  • Request deletion of your personal information (subject to legal retention requirements);
  • Correct inaccurate personal information;
  • Opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising);
  • Limit the use of sensitive personal information.

To exercise these rights, contact us at [privacy@gumgumroad.com]. We will respond within forty-five (45) days.

6.3 EU / UK Residents (GDPR / UK GDPR). If you access the Platform from the EU or UK, you have additional rights including data portability, restriction of processing, and objection. The Platform is not currently marketed to EU/UK residents, but if you use it we will honor these rights on request.

7. Security

We use industry-standard security measures including TLS encryption in transit, AWS-managed encryption at rest, hashed password storage in AWS Cognito, and PCI DSS compliance through Stripe (we never see or store card numbers). Despite these measures, no system is perfectly secure, and we cannot guarantee absolute security.

8. Children

The Platform is not directed to children under 18, and we do not knowingly collect personal information from anyone under 18. If we learn we have collected such information, we will delete it.

9. International Data Transfers

The Platform is hosted in the United States. If you use the Platform from outside the United States, your information will be transferred to and stored in the United States, which may have data-protection laws different from those in your country.

10. Third-Party Links

The Platform may contain links to third-party websites. We are not responsible for the privacy practices of those sites.

11. Cookies and Tracking

We use cookies and similar technologies for authentication, analytics, and Platform functionality. You can control cookies through your browser settings, but disabling cookies may impair your use of the Platform.

12. Do Not Track

Some browsers send a "Do Not Track" signal. We currently do not respond to these signals because there is no consensus on their meaning. When such consensus emerges we will honor it.

13. Changes to This Policy

We may update this Policy periodically. Material changes will be communicated by email or Platform notification at least thirty (30) days before taking effect.

14. Contact

Questions or requests: [privacy@gumgumroad.com]

Data Protection Officer: [Name to be assigned when required by GDPR nexus]

Mailing Address: [gumgumroad, Inc.] [Street Address] [City, State ZIP]

Other legal documents