Privacy Policy

1. Who We Are and How to Contact Us

Data Controller:
Privateer Trading Co. LLC
[Address — Collin County, Texas, USA]
Email: [PRIVACY EMAIL]
Website: privateertrading.net

EU Representative (Article 27 GDPR):
[EU REPRESENTATIVE NAME AND ADDRESS — PLACEHOLDER]
Email: [EU REPRESENTATIVE EMAIL]

UK Representative (UK GDPR Article 27):
[UK REPRESENTATIVE NAME AND ADDRESS — PLACEHOLDER]
Email: [UK REPRESENTATIVE EMAIL]

Data Protection Officer:
[DPO NAME — PLACEHOLDER]
Email: [DPO EMAIL]

If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us at [PRIVACY EMAIL]. EU and UK residents may also contact our regional representatives directly using the details above.

2. Scope of This Privacy Policy

This Privacy Policy applies to all personal data collected and processed by Privateer Trading Co. LLC (“Privateer,” “we,” “us,” or “our”) through:

• The Privateer Trading Co. website at privateertrading.net and all associated pages
• Our mobile applications (if any)
• The AI Concierge feature
• The Crafting Table custom order system
• The Scout Sourcing Program
• Any communications between you and Privateer by email, telephone, or other means

This Policy applies to all users of the Platform, including visitors, registered customers, and business customers, regardless of where they are located.

For EU and UK residents, this Policy constitutes the transparency notice required under Articles 13 and 14 of the General Data Protection Regulation (GDPR) and UK GDPR respectively.

3. The Personal Data We Collect

We collect personal data in the following categories:

3.1 Identity Data

• Full name
• Username or similar identifier

3.2 Contact Data

• Email address
• Postal address (delivery and billing)
• Telephone number

3.3 Financial Data

• Payment method details (processed and stored by Stripe — Privateer does not store raw card data)
• Transaction history
• Payment authorization records

3.4 Order and Transaction Data

• Products purchased or browsed
• Order history and status
• Custom order specifications (Crafting Table)
• Scout Sourcing Program requests
• Shipping and delivery information

3.5 Technical Data

• IP address
• Browser type and version
• Device type and operating system
• Time zone setting and location
• Cookies and similar tracking technologies (see Section 11)
• Pages visited and features used on the Platform

3.6 Profile Data

• Account username and password (encrypted)
• Purchase preferences and history
• Product reviews and ratings submitted
• Saved items and wish lists

3.7 Communications Data

• Emails and messages sent to or received from Privateer
• AI Concierge interaction logs
• Customer service correspondence

3.8 Consent Data

• Records of consent given for cookies and marketing communications
• Consent timestamps and version records
• Records of consent withdrawal

3.9 Special Categories of Data

We do not intentionally collect any special categories of personal data (such as health data, racial or ethnic origin, political opinions, religious beliefs, or biometric data). Please do not provide us with such information.

4. How and Why We Use Your Personal Data (Lawful Bases)

Under GDPR, we must have a lawful basis for every processing activity. The tables below set out each activity, the data we use, and the legal basis we rely on.

4.1 Processing Necessary to Perform Our Contract With You (Article 6(1)(b))

We process the following data because it is necessary to fulfill your orders and provide the Platform services you have requested:

4.2 Processing Necessary to Comply With a Legal Obligation (Article 6(1)(c))

4.3 Processing Based on Our Legitimate Interests (Article 6(1)(f))

We rely on legitimate interests for the following activities, having conducted Legitimate Interests Assessments (LIAs) in each case and determined that our interests are not overridden by your rights and freedoms:

You have the right to object to processing based on legitimate interests at any time. See Section 9.

4.4 Processing Based on Your Consent (Article 6(1)(a))

We rely on your consent for:

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

5. Automated Decision-Making and the AI Concierge

5.1 The AI Concierge

Our Platform includes an AI Concierge powered by the Anthropic Claude API. The AI Concierge processes your inputs to generate personalized product recommendations and responses.

Nature of processing: The AI Concierge constitutes automated processing of personal data. It may generate personalized responses based on your inputs within a session. It does not make decisions that produce legal or similarly significant effects on you within the meaning of Article 22 GDPR.

What the AI Concierge does not do:

• It does not make automated decisions about your eligibility to purchase, access pricing, or use the Platform
• It does not create a persistent profile of you across sessions without your knowledge
• It does not have access to your financial data or payment information

Interaction logging: AI Concierge interactions may be logged for quality assurance and safety purposes, on the basis of our legitimate interests (Section 4.3). Logged interactions are retained for [RETENTION PERIOD — PLACEHOLDER] and are not used for automated profiling.

Third-party processing: AI Concierge queries are processed by Anthropic, Inc. (USA). Please review Section 7 and Section 8 for information about this transfer and Anthropic's data handling practices.

Your right to human review: If you have concerns about any AI Concierge output, you may contact us at [PRIVACY EMAIL] to request human review. We will respond within a reasonable time.

5.2 No Solely Automated Decisions With Legal Effect

Privateer does not make any decisions about you that are based solely on automated processing and that produce legal or similarly significant effects within the meaning of Article 22 GDPR.

6. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes set out in this Policy, or as required by law. The following retention periods apply:

When retention periods expire, personal data is securely deleted or anonymized. Anonymized data (from which you cannot be identified) may be retained indefinitely for business analytics purposes.

7. Who We Share Your Data With

We share personal data with the following categories of recipients:

7.1 Service Providers (Data Processors)

These parties process personal data on our behalf under written Data Processing Agreements and may only use your data as instructed by Privateer:

7.2 Professional Advisors

We may share data with lawyers, accountants, auditors, and insurers where necessary for our legitimate business operations, subject to professional confidentiality obligations.

7.3 Law Enforcement and Regulatory Authorities

We may disclose personal data to law enforcement, regulatory authorities, or courts where required by applicable law, or where necessary to protect the rights, property, or safety of Privateer, our customers, or others.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of Privateer's assets, personal data may be transferred to the acquiring entity. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

7.5 With Your Consent

We may share your data with third parties where you have given explicit consent.

We do not sell your personal data to third parties. We do not share your personal data with third parties for their own marketing purposes.

8. International Transfers of Personal Data

Privateer Trading Co. LLC is based in the United States. When we transfer personal data from the European Economic Area (EEA) or the United Kingdom to the United States or other third countries, we ensure appropriate safeguards are in place as required by GDPR Chapter V and UK GDPR.

The transfer mechanisms we rely on are set out in the processor table in Section 7.1. These include:

• Standard Contractual Clauses (SCCs): EU Commission-approved contract terms that bind the recipient to GDPR-equivalent protections
• EU-US Data Privacy Framework (DPF): Where the US recipient is certified under the DPF, which has been recognized as providing adequate protection by the European Commission
• UK International Data Transfer Agreement (IDTA): For transfers from the UK where SCCs are not applicable

For transfers where the mechanism is marked as requiring confirmation (notably Anthropic), we are in the process of completing our due diligence and will update this Policy when confirmed. In the interim, we implement additional contractual protections and limit the personal data included in AI Concierge queries.

You may request a copy of the safeguards applicable to any transfer by contacting us at [PRIVACY EMAIL].

9. Your Rights Under GDPR and UK GDPR

If you are located in the European Economic Area or the United Kingdom, you have the following rights under GDPR and UK GDPR. These rights are not absolute and are subject to certain exemptions under applicable law.

9.1 Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about how it is processed.

9.2 Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected and incomplete data completed without undue delay.

9.3 Right to Erasure — “Right to Be Forgotten” (Article 17)

You have the right to request deletion of your personal data where:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent and there is no other lawful basis
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Erasure is required to comply with a legal obligation

This right does not apply where we are required to retain data by law (e.g., financial records).

9.4 Right to Restriction of Processing (Article 18)

You have the right to request that we restrict processing of your data in certain circumstances, including while a dispute about accuracy or legitimate interests is resolved.

9.5 Right to Data Portability (Article 20)

Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV) and to transmit it to another controller.

9.6 Right to Object (Article 21)

You have the right to object at any time to processing of your personal data based on legitimate interests (Article 6(1)(f)). We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for the establishment, exercise, or defence of legal claims.

You have an unconditional right to object to processing of your personal data for direct marketing purposes at any time.

9.7 Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to solely automated decisions that produce legal or similarly significant effects. As noted in Section 5.2, Privateer does not currently make such decisions.

9.8 Right to Withdraw Consent (Article 7(3))

Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of prior processing. See Section 4.4 for how to withdraw.

9.9 How to Exercise Your Rights

Online: Submit a Data Subject Request at: privateertrading.net/privacy/data-request

By email: [PRIVACY EMAIL]

We will respond within 30 days of receiving your request. For complex or multiple requests, we may extend this by a further two months and will notify you within the initial 30-day period.

We may need to verify your identity before processing your request. We will not charge a fee for requests unless they are manifestly unfounded or excessive.

10. Your Rights Under US Privacy Laws

10.1 Texas Data Privacy and Security Act (TDPSA)

If you are a Texas resident, you have rights under the Texas Data Privacy and Security Act (effective July 1, 2024), including the right to:

• Know whether we process your personal data
• Access your personal data
• Correct inaccuracies in your personal data
• Delete your personal data
• Obtain a portable copy of your personal data
• Opt out of the processing of your personal data for targeted advertising, sale, or profiling

To exercise these rights, submit a request at: privateertrading.net/privacy/data-request

We will respond within 45 days. We do not sell personal data or process it for targeted advertising.

10.2 California Residents

At Privateer's current scale, we do not meet the thresholds triggering obligations under the California Consumer Privacy Act (CCPA/CPRA). We will update this Policy if our processing activities change such that CCPA applies.

10.3 Other US State Privacy Laws

As additional US state privacy laws come into effect, we will assess applicability and update this Policy accordingly. Residents of all US states may contact us at [PRIVACY EMAIL] with privacy-related inquiries.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on the Platform. A full description of the cookies we use, their purposes, and retention periods is available in our Cookie Policy.

11.1 Categories of Cookies

Strictly Necessary Cookies — These cookies are essential for the Platform to function. They include authentication cookies (Supabase), payment processing cookies (Stripe), and security cookies (Cloudflare). These cookies cannot be disabled.

Functional Cookies — These cookies remember your preferences (such as language, currency selection, and cookie consent choices) to provide a personalized experience. They are activated only with your consent.

Analytics Cookies — These cookies help us understand how visitors interact with the Platform, enabling us to improve our services. They are activated only with your consent.

Marketing Cookies — These cookies track your activity to deliver relevant advertising. We do not currently use marketing cookies. If this changes, we will update this Policy and request fresh consent.

11.2 Managing Your Cookie Preferences

You can manage your cookie preferences at any time by clicking Cookie Preferences in the footer of the Platform. You can accept all, reject all non-essential cookies, or set granular preferences by category.

12. Children's Privacy

The Platform is not directed at children under the age of 16 (or such higher age as required by applicable law in the relevant jurisdiction). We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at [PRIVACY EMAIL] and we will delete the data promptly.

13. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption of data in transit (TLS/HTTPS across all Platform connections)
• Encryption of data at rest in our database (Supabase)
• Row-Level Security (RLS) policies restricting data access to authorized users
• Payment data handled exclusively by PCI DSS Level 1 certified processor (Stripe) — Privateer does not store raw card data
• Access controls limiting staff access to personal data on a need-to-know basis
• Incident response procedures including 72-hour supervisory authority notification

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to maintaining industry-standard protections.

Data breach notification: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (if you have an account with us) or by a prominent notice on the Platform at least 30 days before the changes take effect.

The “Last Updated” date at the top of this Policy reflects the date of the most recent revision. We encourage you to review this Policy periodically.

Your continued use of the Platform after the effective date of any updated Policy constitutes acceptance of the changes. If you do not agree to the updated Policy, you must discontinue use of the Platform and may request deletion of your account.

15. How to Make a Complaint

15.1 Contact Us First

If you have a concern about how we handle your personal data, we ask that you contact us first at [PRIVACY EMAIL] so that we have the opportunity to address it.

15.2 EU Supervisory Authorities

If you are located in the EU and are not satisfied with our response, you have the right to lodge a complaint with the data protection supervisory authority in your country of habitual residence, place of work, or place of the alleged breach.

A list of EU supervisory authorities is available at: edpb.europa.eu

15.3 UK Supervisory Authority

If you are located in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk

15.4 EU Online Dispute Resolution

EU consumers may also use the European Commission's Online Dispute Resolution platform: ec.europa.eu/consumers/odr

15.5 Texas Residents

If you are a Texas resident and wish to appeal our response to a privacy rights request, you may submit an appeal by contacting us at [PRIVACY EMAIL] with the subject line “TDPSA Appeal.” We will respond within 60 days. If your appeal is denied, you may contact the Texas Attorney General at texasattorneygeneral.gov.