# Privacy Policy

**GhostResellers LLC**
Last updated: August 12, 2026

GhostResellers LLC operates Posting, an internal tool at
`tools.ghostresellers.com` used to prepare and publish resale listings. This
policy describes what that tool collects, where it sends it, and how long it is
kept.

Posting is not a consumer service. It has no public sign-up, and access is
limited to authorized GhostResellers LLC personnel.

## What we collect

**Account information.** An email address and name for each authorized user.
Passwords are stored only as a bcrypt hash — never in readable form. Signed-in
sessions are maintained with a single authentication cookie. We use no
analytics, advertising, or third-party tracking cookies.

**Item information you enter.** Photographs of items being resold, along with
any notes, prices, condition details, and listing text created in the tool.

**eBay account data.** When an eBay account is connected, we store the access
and refresh tokens that authorize the connection, plus identifiers for listings
and offers the tool creates. We do not collect or store the personal
information of eBay buyers.

## How that information is used

Item photographs and notes are used to identify items, research comparable sale
prices, recommend a price, and generate listing copy. eBay credentials are used
solely to create and publish listings on the connected seller account, at the
direction of an authorized user.

We do not sell, rent, or share this information with anyone for marketing, and
we do not use it to build profiles of any individual.

## Service providers

Posting relies on the following providers, each receiving only what its function
requires:

- **Anthropic** — item photographs and notes are sent to Anthropic's API to
  produce item identifications, price research, and listing copy.
- **Vercel** — application hosting and photograph storage.
- **Neon** — the database holding account, item, and listing records.
- **eBay** — listing content is sent to eBay when a listing is published.

## Retention and deletion

Records are kept while they remain useful to the business and are deleted on
request. Deleting an item removes its record and its stored photographs.

Disconnecting an eBay account deletes the stored tokens for that account. We
subscribe to eBay's marketplace account deletion and closure notifications, and
on receiving one we delete the data we hold associated with that eBay account.

## Security

Traffic is served over HTTPS. Credentials and API keys are held as server-side
environment variables and are never exposed to the browser. Access requires
authentication.

No system is perfectly secure, and we make no guarantee of absolute security.

## Changes

Material changes to this policy will be reflected in the "last updated" date
above.

## Contact

Questions about this policy, or requests to access or delete data, can be sent
to **chris@ghostresellers.com**.