Privacy Policy

Account information: the name, email address, and role of each Cassabell staff member or business partner we issue an account to. Business data: the products, inventory, orders, suppliers, customers, and documents Cassabell records in the platform. Marketplace data: listings and orders from Cassabell's own Etsy and Shopify shops (see section 3). Technical data: standard server logs and security events used to operate and protect the service.

We use this information solely to run Cassabell's jewelry business: managing our catalog and inventory, processing orders and shipments, syncing our own marketplace shops, and securing the platform. We do not sell personal data, we do not use it for advertising, and we do not make it available to other businesses.

OrderTu connects only to Cassabell's own Etsy and Shopify shops. Each connection is authorized by us through the marketplace's own secure authorization (OAuth) flow, and access tokens are stored encrypted. OrderTu accesses only our own shops' data: the listings we publish from OrderTu and our own orders so we can fulfill them. Buyer details included in marketplace orders are used solely to fulfill those orders — never for marketing, profiling, or resale, and never shared outside Cassabell and the carriers who deliver the order. Etsy data is handled in accordance with the Etsy API Terms of Use, including its caching policy, and all checkout and payment remains on the marketplace. When a shop is disconnected, its access tokens are deleted and syncing stops.

We share data only with the service providers required to run OrderTu (such as hosting, database, and shipping-carrier providers), under agreements that restrict their use of the data, and where required by law. We never sell data or share it with third parties for their own purposes.

We keep business records for as long as they are needed to run the business and to meet accounting and tax obligations. If you have bought from one of our shops, or hold an OrderTu account, you can request erasure of your personal details at any time via our contact page. We respond within 30 days. Anonymized order records may be retained for accounting, with personal details removed. Marketplace access tokens are deleted immediately when a shop is disconnected.

Data is encrypted in transit and at rest. Access inside the platform is role-based, sensitive actions are audit-logged, and marketplace credentials are stored encrypted and never exposed to other users.

We may update this policy from time to time. If a change is material we will provide notice on this page before it takes effect.