Privacy
Last updated July 13, 2026.
What we collect
Contact details you submit through the offer, sell, question, and newsletter forms. For sellers who connect a store, we read aggregate revenue, traffic, and ad-spend data through read-only access. We never collect customer names, emails, addresses, or individual transaction details from a connected store.
Read-only access and what is actually stored
Keys and tokens (Shopify token, Stripe restricted key, Google and Meta OAuth access) are used transiently to build a report and are never stored. What we do keep: aggregate monthly summaries (settlements, clicks, sessions, spend) attached to a listing so buyers can see verified curves. Sellers see these summaries before anything goes public and can ask for their deletion at any time. Access is revocable on your side at any time (Shopify admin, Stripe dashboard, Google account permissions, Meta business settings).
Google API Services: Limited Use disclosure
TrustExits's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to build the verification report the connecting user requested, is never sold, never used for advertising, and never read by humans except with your consent, for security, or to comply with law.
Processors
Escrow.com (escrow payments), Stripe (card payments for listing upgrades), Railway (hosting), Neon (database), Airtable (lead records), Resend (transactional email), Vercel Blob (private document storage when enabled), Microsoft (Clarity usage analytics). Each processes data only to deliver its part of the service.
Retention
Lead and offer records: up to 24 months after the last activity. Aggregate listing summaries: for the life of the listing, deleted on delisting or on request. Deal-room records (messages, offers, signatures, and the log of sensitive-data reveals such as the store URL): 24 months after closing or cancellation, kept for dispute evidence. Server logs: 30 days, with personal identifiers redacted.
Your rights (GDPR / CCPA)
Wherever you are, you can request access, correction, deletion, or a portable copy of your personal data, and object to a given processing. We do not sell personal information. Our legal bases are the performance of the service you requested and our legitimate interest in running a fraud-resistant marketplace. Write to hello@trustexits.com and we answer within 30 days.
Cookies and analytics
First-party functional cookies: a signed session tracking which platforms you connected (1 hour), short-lived OAuth state cookies (10 minutes), and a private deal-room session for deal participants (30 days). We also use Microsoft Clarity to understand how visitors use the site (heatmaps and session replays of clicks and scrolls). Clarity may set cookies and collects usage signals processed by Microsoft under its own privacy terms; we use it for product improvement only, never for advertising. You can block it with your browser's tracker protection or any content blocker without affecting the site. No advertising cookies, and we never sell usage data.
Contact
Luminadeus LLC, 2201 Menaul Blvd NE Ste A, Albuquerque, NM 87107, USA. hello@trustexits.com.