Privacy Policy

Last updated: [DATE]

This policy describes how this Service actually collects, uses, and shares information today. It has not been reviewed by an attorney — have it reviewed before relying on it, since this application handles a real business's customer, order, and payment data.

1. What this policy covers

This policy describes how this wholesale ordering platform (the "Service"), operated by Silk Road Fibers [confirm legal entity name], collects, uses, and stores information about the retailers, staff, and administrators who use it.

2. Information we collect

We collect and store:

  • Account information: name, email address, a hashed password (never stored in plain text), and role (retailer, staff, or admin) — for both admin-invited accounts and accounts created through public self-service signup.
  • Business and shipping information: company name, contact name, phone number, and a single shipping/billing address per retailer account.
  • Order data: products, quantities, pricing, order and invoice history, and any need-by date given for a backordered item.
  • Payment information:we do not collect or store raw card or bank account numbers. Payment methods are tokenized directly by our payment processor, Square — we store only Square's own reference token, the card/account's last 4 digits, and a display label.
  • Customer and product records synced from QuickBooks Online: customer names, product, pricing, and inventory details, and invoice references, kept consistent between this Service and QuickBooks Online.
  • For staff/admin users who connect QuickBooks: OAuth access and refresh tokens, encrypted at rest, stored to maintain that connection.

3. How we use this information

Information is used solely to operate the Service: authenticating users, processing and fulfilling wholesale orders, collecting payment, generating shipping labels, sending order- and account-related emails, and keeping product, inventory, customer, and invoice data synchronized with QuickBooks Online. We do not sell or rent this information to third parties, and we do not use it for advertising.

4. Third parties we share information with

Information is shared with a small number of named service providers, each for a specific purpose:

  • QuickBooks Online (Intuit):customer, product, and invoice data, to keep this Service's records consistent with the business's accounting. Subject to Intuit's own privacy policy.
  • Square:payment method tokenization and charge processing. We never see or store a raw card or bank account number ourselves. Subject to Square's own privacy policy.
  • ShippingEasy:the order and shipping address for an order once it's ready to ship, so a shipping label and tracking can be generated. Subject to ShippingEasy's own privacy policy.
  • Resend: our transactional email provider — order confirmations and status updates, account invitations, and password reset emails are sent through it. It is not used for marketing email.

We do not share information with any other third party, and we do not use analytics or advertising trackers.

5. Cookies

The Service uses a single httpOnly session cookie to keep you signed in. It is not used for tracking or advertising, is never shared with a third party, and no other cookie is set by this Service.

6. Data security

Passwords are stored as salted hashes, never in plain text. QuickBooks OAuth tokens are encrypted at rest. A temporary password issued by an admin (or a self-service password reset link) is single-use and expires or is invalidated once it's used. We never store a raw card or bank account number — see Section 2.

7. Data retention and your rights

We retain account, order, and sync data for as long as your account is active or as needed to comply with our own recordkeeping, tax, and accounting obligations. You may request access to, correction of, or deletion of your account information by contacting us — see our Contact page. Deletion may be limited where we're required to keep order or invoice records for accounting or legal purposes.

8. Children's privacy

The Service is a business-to-business wholesale ordering platform intended for use by adult retailers, staff, and administrators, and is not directed at or knowingly used by children.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact

Questions about this policy: see our Contact page.