Privacy Policy

1. Data we collect

• Account: name, email address, password (stored only as a scrypt hash) and store name.
• Team: email addresses of the members you invite and their role.
• Catalog: products, variants, prices, inventory and photos you add.
• Channel connections: access tokens issued by the marketplaces (eBay, Etsy, Depop, Shopify, WooCommerce…) after your consent, encrypted with AES-256-GCM, plus your shop or seller account identifier.
• Orders imported from your channels: order number, items, amounts, status, buyer name and the buyer's marketplace identifier. We do not store buyers' postal addresses or payment details.
• Technical data: server logs (IP address, date, requested page) kept for security and troubleshooting.

2. How we use it

• To provide the service: publish and update your listings, sync inventory across your channels, prevent overselling and bring your orders together.
• To manage your account and team, including sending invitation emails.
• To keep the service secure and fix errors.

We do not sell your data or your buyers' data, we do not use it for advertising, and we use no advertising trackers.

3. Who we share it with

• The marketplaces you connect: we send them what your listings need (title, description, price, inventory, photos) and read your orders, within the permissions you granted.
• No other third parties, except where required by law. OmniList runs on our own servers, and emails are sent from our own mail server.

4. Marketplace data

Data obtained through marketplace APIs (eBay, Etsy and others) is used only to operate your OmniList account. When eBay notifies us that an account was closed or deleted (Marketplace Account Deletion), we erase that buyer's name and identifier from your orders; if it is your seller account, we delete the connection and its tokens.

You can revoke OmniList's access at any time from the settings of the marketplace concerned.

5. Cookies

We use only two cookies, both required for the service: the session cookie (to keep you signed in) and the language cookie (French or English). No analytics or advertising cookies.

6. Retention

Account data is kept while your account is active. When you ask for deletion, we erase your account and your store data within 30 days, except what the law requires us to keep. Database backups are kept for at most 14 days.

7. Security

All traffic uses HTTPS. Passwords are hashed, marketplace tokens are encrypted, and photos are only available to signed-in members of your store, or to marketplaces through signed, time-limited links.

8. Your rights

You can ask to access, correct, delete or export your data by writing to privacy@1handbiz.com. We reply within 30 days. California residents have the rights provided by the CCPA: we do not sell or share personal information as defined by that law.

If you bought from a seller who uses OmniList, you can also contact that seller or the marketplace where you made the purchase.

9. Children

OmniList is a tool for business sellers and is not intended for anyone under 16.

10. Changes and contact

We may update this policy; the date at the top of the page shows the latest version. Questions: privacy@1handbiz.com.