Privacy Policy

Overview

CordMarket LLC ("CordMarket," "we," "us," or "our") runs a firewood and wood products marketplace that connects buyers and sellers across the United States. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our website, mobile applications, and related services.

By using CordMarket, you agree to this Privacy Policy. If you do not agree, please do not use our services.

Information We Collect

We collect information in three ways: directly from you, automatically as you use our site, and from third-party services we work with.

Information You Give Us

• Account registration: your name, email address, phone number, password, and profile photo
• Seller listings: business name, address, service area, wood types, pricing, inventory details, and photos
• Buyer orders: delivery address, order details, and delivery instructions
• Payment information: billing details processed securely through Stripe. We never store your full card number on our servers.
• Identity verification: government-issued ID submitted by sellers during onboarding
• Messages: conversations through our in-app messaging system, support requests, and feedback
• Reviews and ratings: content you submit about sellers or transactions
• Email signup: your email address if you join our waitlist or newsletter

Information We Collect Automatically

• Device and browser data: IP address, browser type, operating system, device identifiers, and screen resolution
• Usage data: pages visited, search queries, listings viewed, time on site, clicks, and navigation paths
• Location data: approximate location based on your IP address, or precise location if you allow it for search features
• Cookies: see the Cookies section below for details
• Transaction data: order history, amounts, delivery confirmations, and any dispute records

Information From Third Parties

• Stripe: payment confirmation, payout status, and fraud signals
• Google Maps: location search and map display
• Email platforms: open rates, clicks, and unsubscribe status from Mailchimp or ConvertKit
• Social login: if you sign in with Google or Apple, we receive your name, email, and profile photo from that provider

How We Use Your Information

Running the Marketplace

• Creating and managing buyer and seller accounts
• Displaying listings, handling searches, and connecting buyers with sellers
• Processing payments and sending seller payouts through Stripe Connect
• Tracking orders, confirming deliveries, and resolving disputes
• Verifying seller identity and showing verified badges
• Powering in-app messaging between buyers and sellers

Improving Our Service

• Studying usage patterns to improve search, listings, and overall experience
• Building new features like wood identification and subscription deliveries
• Running internal research and product testing

Safety and Trust

• Detecting and preventing fraud, abuse, and unauthorized activity
• Checking the accuracy of listings and seller credentials
• Enforcing our Terms of Service
• Complying with laws and responding to legal requests

Staying in Touch

• Sending order confirmations, delivery updates, and payout receipts
• Responding to customer support requests
• Sending platform news and feature updates
• Sending promotional emails to users who opt in. You can unsubscribe at any time.

Sharing Your Information

We share your information only as described here. We do not sell, rent, or trade your personal data.

Between Buyers and Sellers

When a transaction happens, buyers and sellers receive basic information about each other to complete the order. This includes first name, delivery address, order details, and contact information. Seller business name, location, ratings, and reviews are visible to the public on our platform.

Service Providers

We work with trusted vendors who help us run the platform. Each operates under a data processing agreement with us:

• Stripe handles payment processing and seller payouts
• Google powers maps, location services, and analytics
• Supabase manages our database and user authentication
• Vercel hosts our website and infrastructure
• Mailchimp and ConvertKit handle email marketing for users who have opted in
• Anthropic powers our AI wood identification feature

Legal Requirements

We may share your information when required by law, court order, or government authority, or when we believe it is necessary to protect the safety of our users or the public.

Business Transfers

If CordMarket is sold or merged with another company, your information may be transferred as part of that deal. We will notify you by email before your information becomes subject to a different privacy policy.

With Your Consent

We will share your information with others outside these cases only when you have given us explicit permission to do so.

Cookies and Tracking

We use cookies and similar tools to keep our site working, remember your preferences, and understand how people use CordMarket.

What We Use

• Essential cookies are required for basic site functions like logging in and keeping your session active. These cannot be turned off.
• Analytics cookies help us see which pages are popular and where users run into trouble. We use Google Analytics for this.
• Preference cookies remember your settings like location and search filters.
• Marketing cookies are only used if you opt in to marketing. They help us see whether our campaigns are working.

Your Options

You can control cookies through your browser settings. To opt out of Google Analytics specifically, visit tools.google.com/dlpage/gaoptout. Turning off some cookies may limit parts of the site.

Data Retention

We keep your information for as long as your account is active or as long as we need it to provide our services. Here is a breakdown:

• Account data is kept while your account is open and for up to 3 years after you close it, to meet tax and legal requirements.
• Transaction records are kept for 7 years in line with financial recordkeeping rules.
• Identity verification documents from sellers are kept for 5 years after the seller relationship ends.
• Support and messaging records are kept for 3 years.
• Analytics data is kept indefinitely in anonymized form.
• Email marketing data is kept until you unsubscribe, after which we only retain a record of your opt-out.

When a retention period ends, we securely delete or anonymize your data.

Your Privacy Rights

You have rights over your personal information. We honor all of the following regardless of where you live.

Rights for All Users

• Access: request a copy of the information we hold about you
• Correction: ask us to fix inaccurate or incomplete data
• Deletion: ask us to delete your information, subject to legal requirements
• Portability: receive your data in a readable, transferable format
• Unsubscribe: opt out of marketing emails at any time using the unsubscribe link or by contacting us

California Residents

If you live in California, the CCPA and CPRA give you additional rights:

• The right to know what personal information we collect, use, and share
• The right to delete personal information we have collected from you
• The right to opt out of the sale of personal information. We do not sell your data.
• The right to limit how we use sensitive personal information
• The right to not be treated differently for exercising these rights

To submit a California privacy request, email privacy@cordmarket.com with the subject line "California Privacy Request." We will respond within 45 days.

How to Submit a Request

Email privacy@cordmarket.com with your request. We will confirm your identity and respond within 30 days. For complex requests, we may need up to 90 days and will let you know if that is the case.

Security

We take security seriously and use standard measures to protect your information.

• All data is sent over HTTPS encryption
• Passwords are hashed and never stored as plain text
• Payments go through Stripe, which holds PCI-DSS Level 1 certification
• Access to personal data inside our company is restricted to people who need it
• We run regular security reviews

No system is completely foolproof. If you find a security issue, please report it to security@cordmarket.com.

If a breach occurs that affects your data, we will notify you and relevant authorities as required by law.

Third-Party Services

CordMarket connects to several third-party services to function. Each has its own privacy policy that covers how they handle your data on their end.

• Stripe for payments: stripe.com/privacy
• Google Maps and Analytics: policies.google.com/privacy
• Supabase for data: supabase.com/privacy
• Vercel for hosting: vercel.com/legal/privacy-policy
• Mailchimp for email: mailchimp.com/legal/privacy

Our site may also link to outside websites. We are not responsible for what those sites do with your information. We recommend reading their privacy policies before sharing anything with them.

Children's Privacy

CordMarket is not for anyone under 18. We do not knowingly collect information from minors. If you are under 18, please do not use our site or submit any personal information.

If we discover we have collected information from someone under 18 without parental consent, we will delete it promptly. If you think this has happened, contact us at privacy@cordmarket.com.

Policy Changes

We may update this policy as our business changes. When we make significant updates, we will:

• Change the "Last updated" date at the top of this page
• Email registered users at least 30 days before changes take effect
• Post a notice on our homepage for at least 30 days

If you keep using CordMarket after an updated policy takes effect, that means you accept the changes. If you do not agree, you can close your account and request deletion of your data.

Contact Us

Questions, concerns, or requests about this policy are always welcome. We respond to every privacy inquiry.