Sell Ripple Privacy Policy

In short

This website sets no cookies of its own and runs no analytics. If you pick a language, your browser remembers that one choice locally, and it never reaches us.
For Sell Ripple accounts we keep what we need to sign you in and run the tools: name, email address, role, a hashed password and sign-in records.
Payments are handled by Creem, our merchant of record. We never see your full card number.
Monitor keeps review ratings, text and dates to track changes. Neither Monitor nor Research stores reviewer names, avatars, locations or profile links.
The app and its data are hosted in the United States, and we run Sell Ripple from mainland China (section 10).
We don’t sell personal data and don’t use it for advertising.
To get a copy of your data, correct it or delete it, email [email protected].

This summary is for convenience. The full policy below applies.

1. Who we are

Sell Ripple is operated by an individual based in Shanghai, China (in this policy, “Sell Ripple”, “we”, “us” and “our”). The operator is responsible for (the “controller” of) the personal data described in this policy. Where the law requires, we will provide the operator’s legal identity on request. You can contact us about privacy at [email protected].

2. What this policy covers

This policy covers sellripple.com (this website) and the Sell Ripple Monitor and Sell Ripple Research tools at app.sellripple.com (the “Services”). It does not cover Wayfair’s websites, or the websites of Creem or our other providers, which have their own privacy policies. Sell Ripple is independent of Wayfair and receives no data from Wayfair directly.

This policy is published in English and Simplified Chinese, and the two versions are intended to say the same thing. If they differ, the Chinese version prevails for users in mainland China and the English version prevails for everyone else.

3. This website: no cookies of our own

We built this website to collect as little as possible.

No cookies of our own, no analytics. This website sets no cookies and runs no analytics, advertising or tracking scripts. Our network provider, Cloudflare, may set strictly necessary security cookies (such as __cf_bm or cf_clearance) when it checks for automated traffic; they aren’t used for tracking or advertising.

Your language choice. When you choose English or Chinese in the language switch, the site saves that choice in your browser’s local storage as sellripple.lang (value en or zh), so it can open pages in the language you picked next time. That is the only thing the website stores. It stays on your device, is never sent to us, and you can clear it at any time in your browser settings. If your browser blocks storage, the site still works; it just won’t remember your choice.

Fonts. The fonts on this website are served from our own site, so loading a page doesn’t send your IP address to any font provider.

Hosting. Pages reach you through Cloudflare. Like any website, Cloudflare and our server receive your IP address and basic request details (such as the page requested, the time and your browser type) in order to deliver pages and protect the site. Section 9 lists our providers and section 11 how long these logs are kept.

Links into the app. The “Get started” and “Log in” links take you to app.sellripple.com, where section 4 applies. They carry the language of the page you’re on, so the app’s sign-up and sign-in pages open in that language. If you paste a Wayfair product link into the box on our home page, or pick a plan, the link or plan travels to the sign-up page in the page address. If you then create an account, we save them with your account so we can help you get set up. The website itself sends nothing to us.

4. Sell Ripple accounts

You can create an account for free at app.sellripple.com. For each account we keep:

name and email address;
password, stored only in hashed form and never in plain text;
your role in your team (for example admin, operator or viewer) and whether the account is active;
sign-in records, such as when each session started and expires, and the IP address and browser it came from;
which plans your team subscribes to and whether each subscription is active;
the language you use the app in;
records of your consents: which version of our Terms of Service (with the Refunds & Cancellation Policy) and Privacy Policy you agreed to, in which language and when; when you agreed to the transfer of your personal data outside mainland China; and when and how (at sign-up, on a confirmation screen, in your account settings or through an unsubscribe link) you switched follow-up emails on or off;
your team’s name, and the invitations you send or receive (the invitee’s email address, who sent it and when);
the product link or plan you arrived with, if any (section 3);
Research setup requests: the category link, name and notes you send us;
for the admin who pays, the email address and customer ID that Creem uses for the subscription;
audit records of billing, team and Research-request actions, and of our staff opening your team’s record in our read-only admin pages to help with a support request;
short-lived counters tied to IP addresses, used to limit repeated sign-in and sign-up attempts.

Your name, email address and a password are needed to create an account; without them we can’t provide the Services.

Cookies in the app. The app at app.sellripple.com (not this website) sets one strictly necessary cookie, __Secure-better-auth.session_token, to keep you signed in. It expires about 7 days after you last use the app, and it isn’t used for tracking or advertising. If you arrive through a link on this website, the app also sets sr-lang, which only keeps its sign-up and sign-in pages in the language of the page you came from, until you close your browser. During sign-up, the app also keeps your email address and the page to return to in your browser’s session storage until you close the tab, only so it can resend the verification email and bring you back afterwards.

Your Content. We also keep what your team adds to the Services, such as product links, your own SKU codes, store names, category choices and the status of alerts. This is mainly business information rather than personal data.

Accounts without a subscription. Creating an account doesn’t start any tracking. If you agreed, either with the optional box at sign-up or later in your account settings, we may email you to ask what you need or whether we can help. Each of these emails includes an unsubscribe link and our contact details. You can stop them at any time with that link, in your account settings, by replying or by emailing [email protected], and we stop within 10 business days. If you haven’t agreed, we don’t send these emails.

5. Payments through Creem

Payments are processed by Creem, which acts as our merchant of record and is the seller of record for your order. You enter card or other payment details on Creem’s checkout, not on our pages. We do not receive your full card number.

Creem (Armitage Labs OÜ, Estonia) handles checkout and payment data as a separate controller, under its own Privacy Notice. It shares with us the limited information we need to run your subscription: the payer’s name, email address and country, the plan, the amount, the dates, whether the subscription is active, and Creem’s checkout, order, customer and subscription IDs. We keep it for accounting and support (section 11). Creem also processes buyers’ name, email address and IP address on our behalf to provide transaction statistics in its dashboard.

6. Emails with us

When you email us, we keep that correspondence, including your email address and anything you tell us, such as your store name, the tool you are interested in and roughly how many products you have.

7. Public marketplace data and reviews

To provide the Services, we record information that Wayfair displays publicly to shoppers on wayfair.com: product and category pages, listed prices, stock status, brand names, ratings, review totals and review content.

Reviews in Sell Ripple Monitor. Monitor keeps each review’s star rating, text, date and Wayfair review ID to track changes. It never stores reviewer names, avatars, locations or profile links. Review text is kept as published, so it may occasionally include something a reviewer chose to write about themselves.

Reviews in Sell Ripple Research. Research keeps each tracked listing’s daily review count, average rating and 1–5★ breakdown. It doesn’t store review text, or reviewer names, avatars, locations or profile links.

If you wrote a review and would like it removed from our records, contact us at [email protected].

We use this data to give customers a dated history for business research. We do not use it to identify, contact or profile individual shoppers or reviewers.

8. How we use personal data

We use personal data only for the purposes below. Where the EU or UK GDPR applies, the legal basis for each is shown in brackets.

To provide the Services: creating and managing accounts, signing you in and running the tools your team subscribes to (performance of our contract with you; or, where you use the Services as a member of your organization’s team, our legitimate interest in providing the Services your organization subscribed to).
To reply to you and support you (our legitimate interest in answering enquiries, or steps you ask us to take before a contract).
To email account holders who haven’t subscribed and who agreed to it (at sign-up or in their account settings), to ask what they need (your consent, which you can withdraw at any time).
To manage subscriptions and keep financial records (performance of the contract, and our legitimate interest in meeting our tax, accounting and other legal obligations).
To keep the Services and accounts safe and working, for example by limiting repeated sign-in and sign-up attempts and reviewing technical logs (our legitimate interest in protecting the Services).
To record public marketplace data as a dated history for business research, keeping review data to the minimum described in section 7 (our legitimate interest in providing the Services).
To keep a record of what you agreed to and when (our legitimate interest in being able to show it, and a legal obligation where the law requires it).
To follow the law and respond to lawful requests (a legal obligation where EU or UK law requires it; otherwise our legitimate interest in complying with the law).

We do not sell personal data, do not share it for cross-context behavioral advertising, and do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Apart from those follow-up emails (section 4), which you can stop at any time, we don’t send you marketing email unless you ask us to.

We share personal data only with:

Creem, our merchant of record, to take payments, manage subscriptions, handle tax and issue invoices (section 5);
service providers that host or process data for us, under their service agreements:
- Cloudflare, Inc. (United States; global network): DNS, content delivery and security for our websites, and forwarding email sent to [email protected];
- RackNerd (United States): the server that hosts the app, its database and backups;
- Resend (Plus Five Five, Inc., United States): sending account emails such as verification, password reset and invitations;
a communication service we use, which handles data under its own terms and privacy policy: Google LLC (United States), for Gmail, where our support inbox and service notices are received;
professional advisers, such as lawyers and accountants, where needed;
authorities, where the law requires it, or to protect the rights and safety of our users, others or us;
a successor, if the Sell Ripple business is transferred, subject to the protections in this policy;
your own team: everyone on your team can see the names, email addresses and roles of its members, and invitation emails show the name and email address of the person who sent them.

10. Where data is stored

The app, its database and backups run on a server in the United States, hosted by RackNerd, behind Cloudflare’s global network. Account emails are sent through Resend (United States), our support inbox is Gmail (United States), and payments are handled by Creem (Estonia, EU). We run Sell Ripple from mainland China and access the data from there.

If you are in the EEA or UK, you give your personal data directly to us. Cloudflare and Resend process it for us under data-processing terms that include the EU Standard Contractual Clauses and the UK Addendum. If you are in mainland China, see section 15.

11. How long we keep it

We keep personal data only as long as we need it:

Team records (Your Content, the Monitor history recorded for your team’s products, including prices, stock status and reviews, alerts, Research setup requests, invitations and the team’s member list): while the team has access to a Service, and for 180 days after its last access ends, so you can pick up where you left off if you subscribe again. Then we delete them. You can ask us to delete them sooner. A team that never subscribed is deleted together with its last member’s account. A reviewer can ask us to remove their review at any time (section 7).
Accounts (name, email address, hashed password, role, and the records of your consents): while the account is open. You can ask us to close it (section 12). We delete accounts whose email address isn’t verified within 30 days, and accounts that have no subscription and no sign-in for 12 months.
Sign-in sessions (including IP address and browser): a session expires about 7 days after it was last used, and we delete it within 30 days after that.
Server logs and security records that include IP addresses: deleted within 30 days.
Audit records of billing, team and Research-request actions, and of our staff opening a team’s record: 2 years.
Backups: kept for about 14 days, so data we delete is gone from backups within about 14 days after that.
Subscription and billing records from Creem: 7 years, for tax and accounting and because our agreement with Creem requires it.
Correspondence (emails with us): 24 months after our last contact.
Research category records (rank positions, prices, stock status, brands and review totals of the top 300 products in each tracked category): kept as a dated history for as long as Research operates, because that history is what Research provides.
The language setting in your browser: until you clear it.

12. Your rights and choices

Wherever you are, you can ask us to:

give you a copy of the personal data we hold about you;
correct it if it is wrong;
delete it, where we don’t need to keep it;
stop or restrict using it, or object to how we use it;
give you your data in a portable format.

Email [email protected], preferably from your account’s email address. The Services don’t have self-service tools for downloading or deleting personal data, so we handle these requests by email. We may need to confirm your identity. We acknowledge requests within 7 days and complete them within 15 business days, and never later than one month. If we can’t do what you ask, we will tell you why, and you can complain to a data protection authority.

Closing your account. Email us from the account’s address and we will close it within 15 business days of confirming it’s you. If you are the last admin of a team with an active subscription, please cancel the subscription first.

If your account belongs to your organization’s team, some requests, such as removing your account, may be handled together with your team’s administrator. We will not treat you differently for exercising your rights.

If the EU or UK GDPR applies, you have the rights in section 12, subject to the conditions the law sets, and the legal bases for our processing are listed in section 8. Where we rely on legitimate interests, you can object. Where we rely on consent, you can withdraw it at any time. You can also complain to your local data protection authority, although we’d appreciate the chance to address your concern first.

14. California residents (CCPA)

If California privacy law applies to you, these are the categories of personal information we collect: identifiers (such as name and email address); professional information (such as your company and your role in the Services); commercial information (such as subscription and payment records); internet or network activity (such as sign-in records and technical logs); and account log-in credentials (stored hashed and used only to sign you in). We collect them from you, your organization, Creem and your browser, and use them for the purposes in section 8.

We do not sell or share personal information, as California law defines those terms, and we do not use or disclose sensitive personal information for purposes other than those the law permits. You have the right to know, access, correct and delete your personal information, and not to be discriminated against for exercising these rights. You, or an authorized agent, can make a request by emailing [email protected]; we will verify the request before acting on it.

15. Other regions

If the law where you live gives you further rights, we will honor them.

Mainland China (Personal Information Protection Law). To provide the Services, your account information (name, email address, team role and hashed password), sign-in records (IP address and browser), the business content you add and your emails with us are transferred outside mainland China and stored in the United States. The recipients outside mainland China are listed in the table below. You can exercise your rights to access, copy, correct and delete your information, withdraw consent and close your account, against us or these recipients, by emailing [email protected]; we will coordinate with the recipients. We ask for your separate consent to this transfer when you sign up. You can withdraw it, but because our servers are outside mainland China we would then no longer be able to provide the Services, and we would delete your information as described in section 11. You can also complain to the relevant authorities, such as the Cyberspace Administration of China.

Recipients outside mainland China
Recipient and contact	Purpose and handling	Personal data
RackNerd United States Privacy policy	Hosts our server, database and backups; stores the data	All account and business data
Cloudflare, Inc. United States (global network) Privacy policy	Website delivery and security, and forwarding email sent to our support address; transmits and briefly processes the data	IP addresses, request details, emails to us
Resend (Plus Five Five, Inc.) United States Privacy policy	Sends account emails	Name, email address, team name
Google LLC (Gmail) United States Privacy policy	Receives our support email and service notices; stores them	Email addresses and email content; in service notices, team names, the name of the person who requested Research setup, subscription IDs and amounts
Creem (Armitage Labs OÜ) Estonia Privacy Notice	Payments, tax and invoices (the payer only); handles the data as a separate controller	The payer’s name, email address and country, and order details

Singapore. You can contact our data protection officer at [email protected]. We respond to access requests within 30 days, or tell you in writing when we will.

United Kingdom. You can complain to us first at [email protected]; we acknowledge complaints within 30 days.

16. Security

We use reasonable technical and organizational measures to protect personal data, and we limit access to the people who need it. Passwords are stored only in hashed form. No way of storing or sending data is completely safe, so we can’t promise absolute protection. If a security incident affects your personal data, we will act immediately to contain it and, without undue delay, tell you by email what happened, which data was involved, the likely consequences, what we have done, what you can do to protect yourself, and how to reach us. We will also notify the data protection authorities where the law requires it (for example, within 72 hours under the GDPR).

17. Children

The Services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

18. Changes to this policy

We may update this policy. When we do, we will change the effective date above. If the changes are significant, we will email account holders at least 30 days before they take effect, unless the change is required by law or for security.

19. Contact

Questions or requests: email [email protected]. For requests about your personal data, please put “Privacy request” in the subject line.

Privacy Policy