Privacy Policy

1. Introduction

This platform (“baseSite,” “we,” “us,” or “our”) is operated by Boston Systems Consulting LLC (“BSC”). We provide an online marketplace platform that enables independent businesses (“Merchants”) to create and operate their own storefronts and sell products to consumers and other businesses (“Buyers,” and together with Merchants, “Users,” or “you”).

This Privacy Policy explains how we collect, use, disclose, and otherwise process Personal Information about Users in connection with our website, mobile applications, and related services (collectively, the “Services”). “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.

This Privacy Policy does not apply to information that Merchants collect from Buyers through Merchant storefronts, after a Buyer leaves our Services to interact with a Merchant directly, or to information that Merchants otherwise process in their capacity as independent businesses. See Section 11 (Merchant Storefronts; Relationship with Merchants) below for more detail.

2. Scope and Application

This Privacy Policy applies to Personal Information we process in connection with the Services. Examples include Personal Information relating to your creation of a User account, browsing the Services, communicating with us, or using platform-level features.

In some circumstances, we process Personal Information on behalf of a Merchant as a service provider. Our processing of that Personal Information is governed by our agreement with the Merchant and the Merchant’s own privacy policy, not this Privacy Policy. We have addressed this dual role in greater detail in Section 11.

The Services are offered in and directed to users in the United States only. We do not knowingly offer or direct the Services to individuals outside the United States. We do not market the Services to children.

3. Information We Collect

We collect Personal Information in three principal ways: (a) information you provide directly to us; (b) information we collect automatically when you use the Services; and (c) information we receive from third parties. The categories described below reflect the categories of Personal Information we have collected in the preceding 12 months and that we expect to collect going forward.

3.1 Information You Provide Directly

Account and Profile Information

When you create a User account, we collect identifiers and contact information such as your name, email address, telephone number, username, and password. Buyers may also provide a shipping address and, optionally, additional profile information. Merchants additionally provide information about their business, as described in the next subsection.

Merchant Onboarding Information

When a Merchant opens and maintains a storefront, we collect business information necessary to establish, verify, and maintain the Merchant relationship. This may include:

• Legal business name, doing-business-as name, business mailing and physical address, business email address and telephone number, business website, and business type (e.g., LLC, corporation, sole proprietorship).
• Employer identification number (EIN), tax identification number (TIN), or similar identifier used for tax reporting purposes.
• Information about beneficial owners and authorized representatives, including name, date of birth, residential address, and government-issued identification information, to the extent required for Know Your Business (KYB) verification, anti-money-laundering compliance, and similar regulatory purposes.
• Information about the products the Merchant intends to sell and the Merchant’s prior business and selling history.
• Tax information required for IRS reporting and similar tax compliance obligations.

Transaction and Order Information

When a Buyer places an order through a Merchant storefront, we collect information about the transaction, including the products purchased, quantity, price, order date and time, order status, refunds, returns, the identity of the Buyer and Merchant, and any messages or notes associated with the order. We do not collect, receive, or store bank account numbers, routing numbers, card numbers, or other payment account credentials. See Section 6 below regarding payment processing through Plaid.

Shipping and Fulfillment Information

For each order, we collect and process the shipping address provided by the Buyer, the Buyer’s name, contact information for shipment notifications, package weight and dimensions, carrier and service level selected, tracking numbers, delivery status events, and proof-of-delivery information made available by carriers. See Section 7 for further detail.

Communications and Support

When you contact us — for example, through our help center, by email, by telephone, or via chat — we collect the content of your communication and any information you provide in connection with it (such as screenshots, attachments, or order numbers). Messages between Buyers and Merchants sent through our messaging features are processed through our Services and may be retained by us, as described in Section 9.

User-Generated Content

If you post reviews, ratings, photographs, questions and answers, comments, listings, store profiles, or similar content through the Services, we collect that content together with the metadata necessary to display and attribute it.

Survey and Research Participation

If you participate in surveys, research studies, promotions, or beta programs we may offer, we collect the responses and information you provide.

3.2 Information We Collect Automatically

When you access or use the Services, we and our service providers automatically collect certain information about your device and your interactions with the Services.

Device and Connection Information

Internet protocol (IP) address, device identifiers, device type, operating system, browser type and version, language preferences, time zone, mobile network information, and approximate location derived from IP address.

Usage Information

Pages and storefronts viewed, items viewed and added to cart, search queries entered, links clicked, scroll and engagement patterns, session duration, referring and exit pages, dates and times of access, and similar information about how you navigate and interact with the Services.

Cookies, Pixels, and Similar Technologies

We and our service providers use cookies, software development kits, pixels, beacons, local storage, and similar technologies to collect information automatically. See Section 12 for further detail and your choices.

3.3 Information From Third Parties

We receive Personal Information about you from third parties in the following circumstances:

• Identity and business verification providers. To verify Merchant identity, business legitimacy, and beneficial ownership, we receive information from identity verification, KYB, and fraud prevention vendors, as well as from public records and identity verification agencies.
• Plaid. When you link a bank account through Plaid, Plaid provides us with a limited tokenized identifier so that we can initiate ACH or other bank transfers. We do not receive your bank account number, routing number, online banking credentials, or full account balance from Plaid. See Section 6.
• Shipping carriers. We receive tracking, delivery status, and exception information from shipping carriers in connection with orders. See Section 7.
• Fraud prevention and security providers. We receive risk signals, device reputation information, and similar fraud-prevention and security information from third-party vendors.
• Advertising, analytics, and marketing partners. We receive analytics, audience, and attribution information about how Users interact with the Services and with advertising relating to the Services.
• Single sign-on and social media providers. If you choose to create an account or sign in using a third-party authentication service (such as Google or Apple), we receive the information that service makes available to us, subject to your settings with that service.

4. How We Use Personal Information

We use the Personal Information described above for the following business and commercial purposes:

• Providing and operating the Services - Creating and maintaining accounts; enabling Merchants to operate storefronts; processing orders and returns; facilitating communications between Buyers and Merchants; providing customer support; and enabling features such as wishlists, favorites, and saved items.
• Payments and money movement - Initiating and reconciling ACH and other bank transfers through Plaid; handling refunds and chargebacks; and reconciling settlements.
• Shipping and fulfillment - Providing shipping addresses to Merchants, generating shipping labels, providing tracking information to Buyers and Merchants, and responding to delivery issues.
• Merchant verification and risk management - Conducting KYB, sanctions screening, beneficial ownership verification, anti-money-laundering monitoring, and ongoing risk assessment of Merchant activity.
• Fraud prevention and platform integrity - Detecting, investigating, and preventing fraud, unauthorized access, abuse, security incidents, and violations of our Terms of Service or applicable law.
• Personalization and recommendations - Customizing your experience on the Services, including by surfacing storefronts, products, and content that may interest you.
• Analytics and product development - Understanding how Users interact with the Services; measuring the performance of features; and developing new features, products, and services.
• Marketing and communications - Sending you transactional communications (such as order confirmations and account notices) and, where permitted, marketing communications about the Services and about Merchants and products that may interest you. You can manage marketing preferences as described in Section 14.
• Legal, regulatory, and compliance purposes - Complying with applicable laws and regulations (including tax reporting, sanctions, and anti-money-laundering obligations); responding to lawful requests from public authorities; and establishing, exercising, or defending legal claims.
• Corporate transactions - Evaluating and conducting mergers, acquisitions, financings, reorganizations, asset sales, or similar transactions.
• With your consent or at your direction for purposes described to you at the point of collection or otherwise disclosed to you.

We may de-identify or aggregate Personal Information so that it no longer reasonably identifies you and use such de-identified or aggregated information for any lawful purpose. Where we de-identify Personal Information, we maintain and use the information in de-identified form and do not attempt to reidentify it, except as permitted by applicable law to determine whether our de-identification processes are effective.

5. How We Share Personal Information

We share Personal Information in the following circumstances:

5.1 With Merchants

When a Buyer places an order with a Merchant, we share with that Merchant the Personal Information necessary to fulfill the order, including the Buyer’s name, shipping address, contact information (to the extent the Buyer has elected to share it), order contents, and any order-specific notes or messages. We share with Merchants information about traffic to and engagement with their storefronts. Each Merchant is an independent business that determines its own purposes and means for processing the Personal Information of its customers, and the Merchant’s use of such Personal Information is governed by the Merchant’s own privacy policy and applicable law.

5.2 With Other Users

Profile information, storefront information, listings, reviews, ratings, public messages, and other information you choose to make public on the Services may be visible to other Users.

5.3 With Service Providers

We share Personal Information with service providers and contractors that perform services on our behalf, subject to contractual restrictions consistent with applicable privacy law. These service providers include:

• Plaid Inc., for bank account verification and tokenization (see Section 6).
• Shipping carriers, label generation services, and shipping software providers (see Section 7).
• Cloud hosting, storage, and infrastructure providers.
• Customer support, ticketing, and communications platforms.
• Identity verification, KYB, sanctions screening, security, and fraud prevention providers.
• Analytics, attribution, and product-improvement providers.
• Email, SMS, push notification, and other transactional messaging providers.
• Marketing, advertising, and audience measurement providers (subject to your choices described in Section 12).
• Tax compliance, accounting, and financial reporting providers.
• Professional advisors, including lawyers, accountants, auditors, and consultants.

5.4 For Legal, Compliance, and Safety Reasons

We share Personal Information when we believe in good faith that disclosure is necessary to: (a) comply with applicable law, regulation, legal process, or governmental request; (b) enforce our Terms of Service, including investigation of potential violations; (c) detect, prevent, or otherwise address fraud, security, or technical issues; or (d) protect against harm to the rights, property, or safety of baseSite, our Users, or the public.

5.5 Corporate Transactions and Business Transfers

We may transfer Personal Information as an asset in connection with a merger, acquisition, financing, reorganization, bankruptcy, receivership, assignment for the benefit of creditors, sale of assets or business lines, dissolution, wind-down, or similar transaction, including transactions in which Personal Information is transferred as a standalone asset. In connection with any such transaction, we will require the transferee to either (a) use the Personal Information consistent with the material commitments made in the version of this Privacy Policy in effect at the time the Personal Information was collected, or (b) provide affected individuals with prior notice of any materially different use and, where required by applicable law, an opportunity to opt out.

For Merchant onboarding information that constitutes sensitive Personal Information (including government-issued identifiers and beneficial ownership information), we will require that such information be deleted rather than transferred, except to the extent transfer is necessary for the transferee to continue the underlying business relationship with the Merchant on terms consistent with this Privacy Policy.

5.6 With Your Consent or at Your Direction

We share Personal Information with third parties when you ask us to or otherwise consent to such sharing.

5.7 Aggregated or De-Identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you for any lawful purpose.

6. Payment Processing

Money movement on the Services is handled by Plaid Inc. (“Plaid”) and Stripe, Inc. (“Stripe”). When you link a bank account or initiate a payment or payout through the Services, you interact with these third parties directly through embedded or referred experiences, and the bank account credentials, account numbers, routing numbers, card numbers, and similar payment account data you provide are transmitted directly to and stored by these third parties. We do not receive or store your bank account credentials, account numbers, routing numbers, card numbers, or similar payment account data.

6.1 Plaid

We use Plaid to enable you to securely link your bank account and to verify account ownership. When you connect a bank account through Plaid, you provide your banking credentials directly to Plaid through the Plaid Link interface. Plaid then provides us with a tokenized identifier that allows us to initiate transfers from your linked account. Plaid’s collection, use, and disclosure of your Personal Information is governed by Plaid’s privacy policy, available at https://plaid.com/legal/. By using Plaid through the Services, you acknowledge and agree to Plaid’s end user privacy policy and any other terms that Plaid requires you to accept.

6.2 Stripe

We use Stripe, Inc. (“Stripe”) to process credit card, debit card, and other card-based payments made through the Services. When you provide payment card information in connection with a transaction, you provide that information directly to Stripe through Stripe’s embedded payment interface, and the card number, CVV, expiration date, and similar payment card credentials are transmitted to and stored by Stripe. Stripe returns to us a tokenized payment method identifier and limited transaction metadata (such as the last four digits of the card, card brand, transaction status, and authorization or decline reason) that we use to process orders, issue refunds, and reconcile payments. Stripe’s collection, use, and disclosure of your Personal Information is governed by Stripe’s privacy policy, available at https://stripe.com/privacy. By using Stripe through the Services, you acknowledge and agree to Stripe’s privacy policy and any other terms that Stripe requires you to accept.

6.3 What We Receive

From Plaid and Stripe, we receive limited information necessary to operate the Services, such as a tokenized funding source identifier, status of transfers (e.g., pending, completed, returned, failed), transaction confirmations and reference numbers, and exception or return reason codes. We do not receive or store bank account numbers, routing numbers, online banking credentials, or card numbers.

7. Shipping and Fulfillment

To enable shipment of products purchased through the Services, we collect shipping information from Buyers and share it with Merchants, shipping carriers (such as UPS, FedEx, USPS, and DHL), label generation and shipping management services, and similar providers. We use shipping information to generate labels, communicate tracking information, address delivery issues, and meet our obligations under applicable law (including tax and sanctions screening, where applicable).

Shipping carriers may collect additional information directly from you in connection with delivery (for example, electronic signature for delivery confirmation), and that information is governed by the carrier’s own privacy policy.

8. Cookies and Similar Technologies

We and our service providers use cookies, software development kits, pixels, beacons, local storage, session replay tools, and similar technologies (collectively, “Cookies”) on the Services. We use Cookies for the following purposes:

• Strictly necessary. To operate the Services, authenticate Users, maintain sessions, support security, and remember your selections.
• Functional. To remember preferences and settings.
• Analytics. To understand how the Services are used, measure performance, and improve features.
• Advertising and personalization. To deliver and measure advertising, including advertising you may see on other websites and platforms, and to personalize the content you see on the Services.

Most browsers allow you to manage cookie settings, and mobile operating systems allow you to manage advertising identifiers. You may also use industry opt-out tools provided by the Digital Advertising Alliance (optout.aboutads.info) and the Network Advertising Initiative (optout.networkadvertising.org). Disabling certain Cookies may affect the functionality of the Services.

We honor the Global Privacy Control (“GPC”) browser signal as an opt-out of “sale” or “sharing” of Personal Information under applicable state privacy laws. See Section 12 for additional information about your rights and how to exercise them.

9. Data Retention

We retain Personal Information for as long as necessary to fulfill the purposes for which it was collected, including to provide the Services, comply with our legal, regulatory, tax, accounting, and reporting obligations, resolve disputes, enforce our agreements, and protect our and others’ rights. The actual retention period for a particular category of Personal Information depends on factors such as the nature and sensitivity of the information, the purposes for which we process it, the potential risk of harm from unauthorized use or disclosure, applicable legal and regulatory requirements, and whether we can achieve our purposes through other means.

For example, we generally retain account and transaction records for the duration of your relationship with us and for a period of years thereafter consistent with our legal obligations (including those under tax, anti-money-laundering, and consumer protection laws). We retain communications and customer support records for a period of years sufficient to resolve disputes and improve our Services. We retain de-identified or aggregated information indefinitely.

10. Security

We maintain administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, use, alteration, and disclosure, taking into account the nature of the Personal Information and the risks to Users. No method of transmission or storage is completely secure, however, and we cannot guarantee the absolute security of Personal Information. You are responsible for maintaining the security of your account credentials and notifying us promptly if you suspect any unauthorized access to or use of your account.

11. Merchant Storefronts; Relationship with Merchants

baseSite provides the underlying platform and infrastructure on which Merchants operate independent storefronts and conduct sales. Each Merchant is an independent business that controls its own storefront, products, prices, marketing, customer relationships, and customer data.

In general:

• baseSite is responsible for the Personal Information we collect at the platform level — for example, in connection with the creation and maintenance of User accounts, sitewide search and browse behavior, platform-level analytics, and Merchant onboarding and verification.
• Merchants are independently responsible for Personal Information they collect about their own customers through the Merchant’s storefront, including in connection with the Merchant’s own marketing, fulfillment, and post-sale customer relationships. Each Merchant is responsible for its own compliance with applicable privacy law and for providing its own privacy notice to its customers where required.
• baseSite may act as a processor or service provider to a Merchant with respect to certain Personal Information processed on the Merchant’s behalf, in which case our processing is governed by our agreement with the Merchant, including any applicable data processing terms.

If you have questions about how a particular Merchant processes your Personal Information, or if you wish to exercise privacy rights with respect to that processing, please contact the Merchant directly. We will reasonably cooperate with Merchants in connection with such requests as required by applicable law.

12. Your Privacy Rights and Choices

12.1 General Choices

You can access and update certain Personal Information through your account settings. You can manage email marketing preferences by following the unsubscribe instructions in any marketing email or by adjusting your account preferences. Even if you opt out of marketing communications, we will continue to send you transactional and service-related communications.

12.2 State Privacy Rights

Depending on the state in which you reside and other factors, you may have rights under state privacy laws with respect to your Personal Information. The availability of the following rights and the procedures for exercising them depend on applicable law, and certain exceptions and limitations apply.

• Right to know whether we process your Personal Information.
• Right to access and obtain a copy of your Personal Information in a portable format.
• Right to correct inaccurate Personal Information.
• Right to delete Personal Information we have collected about you.
• Right to opt out of sale or sharing of your Personal Information for cross-context behavioral advertising.
• Right to limit use of sensitive Personal Information.
• Right to opt out of profiling in certain circumstances.
• Right to non-discrimination for exercising your privacy rights.
• Right to appeal a denial of a privacy rights request.

12.3 Sale and Sharing of Personal Information

Certain state privacy laws define “sale” and “sharing” of Personal Information broadly. Some of our common advertising and analytics activities, including the use of Cookies that share device or usage information with advertising partners, may constitute a sale or sharing under those laws.

You may opt out of sale or sharing by: (a) submitting a request through “Do Not Sell or Share My Personal Information;” (b) using the GPC browser signal; or (c) contacting us as described in Section 18. We do not sell or share the Personal Information of consumers we actually know to be under 16 years of age.

12.4 Sensitive Personal Information

We may collect Personal Information that constitutes “sensitive personal information” under applicable state privacy laws, including government identification information (such as SSN, EIN, or driver’s license number) collected for Merchant onboarding, identity verification, and tax reporting. We use sensitive Personal Information only for the purposes permitted by applicable law and do not use it for purposes of inferring characteristics about you. We do not sell sensitive Personal Information. As a result, the right to limit use of sensitive Personal Information under state law generally does not apply, though you may still contact us with any questions or requests.

12.5 California-Specific Disclosures

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), provides you with the rights described above and requires us to make additional disclosures. The following table identifies the categories of Personal Information we intend to collect, disclose for a business purpose, sell, or share (each as defined under the CCPA). As of the effective date of this policy, no data has been sold or shared in the preceding 12 months.

Note: We do not collect or store bank account numbers, routing numbers, or card numbers. See Section 6.

We have not sold or shared Personal Information of California residents in the preceding 12 months. We do not sell or share the Personal Information of California residents we actually know to be under 16 years of age.

Sources of Personal Information. We collect Personal Information from the categories of sources described in Section 3, including directly from you, automatically through your use of the Services, and from third parties such as Plaid, identity and KYB verification providers, shipping carriers, fraud prevention providers, advertising and analytics partners, and single sign-on or social media providers.

Business and commercial purposes. We collect, use, disclose, and (where applicable) share Personal Information for the business and commercial purposes described in Sections 4 and 5.

Retention. We retain Personal Information for the periods and according to the criteria described in Section 9.

12.6 Disclosures Under Other State Privacy Laws

Residents of certain other states have privacy rights that are substantially similar to those described above, subject to the requirements and limitations of the applicable state law. We process Personal Information of residents of these states consistent with applicable law and respond to verifiable consumer rights requests as described in Section 12.8.

12.7 Nevada-Specific Disclosure

Under Nevada law, certain Nevada residents may opt out of the sale of certain Personal Information about them. We do not currently sell Personal Information about Nevada residents as “sale” is defined under Nevada law. Nevada residents may direct any requests or questions to us as described in Section 18.

12.8 How to Exercise Your Rights

You may submit a privacy rights request by: (a) emailing us at privacy@bostonsys.com or (b) writing to us at the address in Section 18. For requests to opt out of “sale” or “sharing,” you may also transmit the GPC browser signal.

Verification. To protect your Personal Information, we will take reasonable steps to verify your identity before responding to a substantive privacy rights request. Verification may require you to provide additional information that we can match against information we already maintain about you, and may, depending on the sensitivity of the request, require additional steps such as a signed declaration.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We will require the agent to demonstrate authorization (such as a written and signed permission or a power of attorney) and may require you to verify your identity directly with us.

Appeals. If we deny your privacy rights request, you may appeal that decision by contacting us at privacy@bostonsys.com within a reasonable time of our denial. We will respond to your appeal within the time period required by applicable law.

13. Automated Decision-Making and Profiling

We use automated processes for certain platform functions, including fraud detection and prevention, risk scoring of Merchants and transactions, sanctions and KYB screening, and personalization. We do not use solely automated processing to make decisions that produce legal or similarly significant effects concerning consumer Buyers. Where required by applicable law, you may have the right to opt out of, or to seek human review of, automated decisions; please contact us as described in Section 18.

14. Marketing and Communications

We may send you marketing emails about the Services and about Merchants and products that may interest you. You may opt out of marketing emails by clicking the “unsubscribe” link in any such email or by adjusting your account preferences. If you have provided us with a telephone number, we may send you SMS messages with your consent and you may opt out by replying “STOP” or as otherwise instructed in the message. Standard messaging and data rates may apply. We may continue to send you transactional and service-related communications regardless of your marketing preferences.

15. Third-Party Websites and Services

The Services may contain links to third-party websites, products, or services, including Merchant storefronts that operate on our platform but are independently operated, and the websites of Plaid, shipping carriers, and other service providers. We are not responsible for the privacy practices of those third parties, and the information they collect is governed by their own privacy policies.

16. Children

The Services are not directed to children, and we do not knowingly collect Personal Information from children under the age of 16. If you believe that a child has provided us with Personal Information, please contact us as described in Section 18 and we will take appropriate steps to investigate and address the matter.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Last Updated” date at the top of this Privacy Policy reflects the date of the most recent revision. Your continued use of the Services after the effective date of any update constitutes your acceptance of the updated Privacy Policy.

18. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or if you wish to exercise your privacy rights, please contact us at:

Boston Systems Consulting LLC

Attn: Privacy

350 Bedford St Bridgewater MA 02324

Email: privacy@bostonsys.com