Privacy Policy

1. Definitions

In this Privacy Policy, "Third-Party Market Data Providers" refers to external retail aggregators, merchant APIs, and pricing intelligence services that PricePress integrates with to retrieve live retail pricing data on your behalf. "External Retail Aggregators" refers to any third-party service that indexes, collects, or provides access to retail product listings and pricing information.

2. Information We Collect

We collect information you provide directly when you create an account, subscribe to our service, or use our platform:

• Account Information: Name, email address, company name, and password.
• Claim Data: Item descriptions, brand names, model numbers, quantities, age, condition, and room assignments uploaded into the Service to generate pricing estimates.
• Policyholder Claim Information: Where entered by the User, claim-related details such as policyholder name, loss address, date of loss, and policy limits may be stored for the purpose of generating professional claim documents (PDFs, exports) and supporting the User's claims workflow. This information is stored within the User's secure workspace and is never transmitted to Third-Party Market Data Providers or External Retail Aggregators. Only anonymized data (zip code) may be used for location-specific pricing.
• Photographic Evidence: Images uploaded as evidence for claim line items, stored securely in private cloud storage buckets.
• Usage Data: We use Vercel Web Analytics to collect basic, anonymized page view data to improve the user experience. Vercel Analytics is cookieless — no tracking cookies are set on your browser, and no personally identifiable information is collected through analytics.

3. Lawful Basis for Processing

Under the Data Protection (Jersey) Law 2018, we process your personal data on the following lawful bases:

• Contract Performance (Art. 8(1)(b)): We process your account information, claim data, photographic evidence, and policyholder location data as necessary to provide the Service you have subscribed to — including account creation, pricing queries, document generation, team management, and subscription administration.
• Legitimate Interest (Art. 8(1)(f)): We process anonymized usage analytics, aggregated pricing data, and operational logs (rate limiting, API usage, audit trails) to maintain platform security, prevent abuse, improve pricing accuracy, and ensure service reliability. These interests do not override your fundamental rights as the data processed is either anonymized or strictly operational.
• Legal Obligation (Art. 8(1)(c)): We may retain certain records (audit logs, billing records) where required by applicable law or to respond to lawful requests from authorities.
• Consent (Art. 8(1)(a)): Where you voluntarily submit your information to our waitlist, you consent to us contacting you regarding Service availability. You may withdraw this consent at any time by contacting us.

4. How We Use Your Information

We use collected data to provide, maintain, and improve the Service. Specifically:

• Pricing Queries: Your uploaded item descriptions are processed through our Proprietary Retail Routing engine, which sends anonymized, stripped-down text queries to Third-Party Market Data Providers to retrieve current retail pricing. We do not transmit your personal information, company name, claim numbers, or policyholder details to these providers.
• Communications: We use your email address to send transactional alerts, password resets, team invitation notifications, and subscription notices.
• Service Improvement: Aggregated, de-identified pricing data may be used to improve our pricing accuracy and caching systems.

5. Third-Party Service Providers

We do not sell your personal data. We share information only with trusted sub-processors necessary to operate the Service:

• Infrastructure Provider (Supabase): Provides our secure database, authentication, and file storage infrastructure. All data is protected by Row Level Security policies.
• Payment Processor (Dodo Payments): Acts as our Merchant of Record and securely processes all payment and billing information. We do not store credit card details on our servers.
• Third-Party Market Data Providers: Receive anonymized, stripped-down product queries (item description, brand, and model number only) to retrieve live retail pricing data. These providers do not receive your personal information, claim details, or policyholder data.
• External Retail Aggregators: Where applicable, additional pricing sources may be queried to ensure comprehensive market coverage and pricing accuracy. The same data minimization principles apply.
• Queue and Caching Infrastructure (Upstash): Provides message queuing for asynchronous pricing jobs and caching infrastructure for rate limiting and temporary operational data. No personal or claim-identifying information is stored — only anonymized operational keys and counters.
• AI Processing Services: Anonymized product descriptions may be processed by AI services for search optimization, relevance filtering, and description standardization. No personal or claim-identifying information is transmitted.

6. Cookies and Tracking Technologies

PricePress does not use cookies for tracking, advertising, or analytics purposes. We do not set first-party or third-party tracking cookies on your browser. Our analytics provider (Vercel Web Analytics) operates without cookies and collects only anonymized, aggregate page view data. No personally identifiable information is collected or transmitted through our analytics.

Essential cookies may be set by our authentication provider (Supabase) solely to maintain your logged-in session. These are strictly necessary for the Service to function and do not track your activity across other websites.

7. Data Security

We implement strict, industry-standard security measures to protect your personal information and claim data:

• Row Level Security (RLS) policies ensure users can only access data belonging to their own company.
• All API endpoints enforce authentication and company-scoped authorization.
• Rate limiting is applied to authentication routes and all export, billing, and sensitive operations.
• Photographic evidence is stored in private storage buckets with time-limited signed URLs.

However, no method of transmission over the Internet or electronic storage is 100% secure.

8. Data Retention and Deletion

We retain your data for the minimum period necessary to fulfil the purposes for which it was collected. Specific retention periods are as follows:

• Account data (name, email, company name): Retained for the duration of your active account plus 30 days following account cancellation or a verified deletion request.
• Claim data and line items: Retained for the duration of your active account plus 30 days following deletion request.
• Uploaded images: Retained for the duration of your active account plus 30 days following deletion request.
• Audit logs: Retained for 2 years from the date of the logged event for regulatory compliance and dispute resolution.
• API usage and billing logs: Retained for 12 months for billing verification and quota enforcement.
• Pricing cache: Anonymized cached pricing data is retained for 90 days on a rolling basis for performance optimisation.
• Waitlist submissions: Retained until an account is created or 12 months from submission, whichever is earlier.

Following account cancellation or a verified deletion request, your personal data and associated claim data will be purged within 30 days, except where retention is required by applicable law or for legitimate billing dispute resolution. You may request a complete deletion of your workspace and all associated data (claims, line items, pricing history, and uploaded images) by contacting our support team at support@thepricepress.com.

9. Your Data Subject Rights

Under the Data Protection (Jersey) Law 2018, you have the following rights in respect of your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected.
• Right to Restriction: You may request that we restrict processing of your personal data in certain circumstances.
• Right to Data Portability: You may request a machine-readable copy of the personal data you have provided to us.
• Right to Object: You may object to processing of your personal data based on our legitimate interests.

To exercise any of these rights, contact us at support@thepricepress.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Jersey Office of the Information Commissioner (JOIC) at jerseyoic.org.

10. United States Privacy Rights

If you are a resident of a US state with applicable privacy legislation, you may have additional rights under state law:

• Colorado Privacy Act (CPA): Colorado residents have the right to access, correct, delete, and obtain a portable copy of their personal data. You also have the right to opt out of the sale of personal data, targeted advertising, and certain profiling. PricePress does not sell personal data, does not engage in targeted advertising, and does not profile users for automated decision-making purposes.
• California Consumer Privacy Act (CCPA/CPRA): California residents have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. PricePress does not sell personal information as defined by the CCPA.

To exercise any US state privacy rights, contact us at support@thepricepress.com. We will respond within 45 days as required by applicable state law.

11. International Data Transfers

To provide the Service, your data is processed by sub-processors based outside Jersey and the EEA, including:

• Supabase (United States): Database, authentication, and file storage infrastructure.
• Vercel (United States): Application hosting and web analytics.
• Upstash (United States): Message queuing and caching infrastructure for asynchronous pricing operations and rate limiting. No personal or claim-identifying data is stored.
• OpenAI (United States): AI processing of anonymized product descriptions for search optimization and relevance filtering. No personal or claim-identifying data is transmitted.

These transfers are made subject to appropriate safeguards, including Standard Contractual Clauses approved by the relevant supervisory authorities. By using the Service, you acknowledge that your data may be transferred to and processed in countries outside Jersey or the EEA.

12. Data Processing for Pricing

When you use our automated pricing features, item descriptions are routed through our Proprietary Retail Routing engine to query multiple Third-Party Market Data Providers and External Retail Aggregators. This process:

• Transmits only the minimum data necessary for price retrieval (product description, brand, model number, and in some cases, a zip code for localized pricing).
• Does not transmit claim numbers, policyholder names, policy numbers, or any personally identifiable information to data providers.
• Caches pricing results to reduce redundant external queries and improve response times.
• Logs usage metrics for billing and quota enforcement purposes.