Privacy Policy

This Privacy Policy explains how Country Consignment Inc., doing business as ConsignEngine (ConsignEngine, we, us, or our), handles personal information through consignengine.com, the ConsignEngine application, support, and related business operations. Our postal address is Box 703, Killam, AB T0B 2L0, Canada.

ConsignEngine is a business service for independent consignment stores in Canada and the United States. This policy applies to business account users, store staff, website visitors, support contacts, and people whose information a subscribing store enters into the Service.

Questions, requests, and complaints may be sent to our Privacy Officer at privacy@consignengine.com. Support requests may be sent to support@consignengine.com, security concerns to security@consignengine.com, and legal notices to legal@consignengine.com.

A subscribing store decides why and how it uses personal information about its staff, consignors, retail customers, inventory, and transactions. For that Customer Data, the store is generally the organization or business responsible for the information, and ConsignEngine processes it to provide the Service.

ConsignEngine separately decides how to use account, website, security, support, legal, and subscription-billing information needed to operate its own business. Privacy roles and rights can vary by jurisdiction and context.

If your request concerns information that a store entered about you, contact that store first when practical. We will refer or assist with the request as appropriate to our role and applicable law.

Account and organization information may include names, business email addresses, roles, organization and store details, preferences, invitations, account events, and authentication identifiers. We do not ask users to share account passwords with us.

Customer Data may include staff, consignor, and retail-customer contact information; consignor agreements and preferences; inventory descriptions, categories, prices, status, and private item photos; sales, refunds, payments by recorded method, gift cards, tills, commissions, payouts, reports, imports, notes, and audit records.

Subscription and billing information may include billing contact and address, tax identifiers, selected plan, currency, subscription and invoice status, Stripe customer and subscription references, payment outcome, and webhook evidence. Stripe collects payment-card details through its hosted services; ConsignEngine is not designed to receive or store full payment-card numbers or card security codes.

Website, device, and security information may include IP address, browser and device information, timestamps, requested routes, authentication and security events, session and preference storage, abuse-prevention results, deployment identifiers, and redacted application logs. We may also handle communications, support cases, privacy or security requests, legal acceptances, closure requests, and related evidence.

If a visitor affirmatively allows optional analytics measurement, Google Analytics may receive a source-controlled route label, page-view and basic automatically collected session events, event time, IP and network information, browser and device signals, and first-party analytics identifiers. If a visitor separately allows optional advertising measurement, approved ConsignEngine marketing and trial-success pages may provide Meta with the sanitized page URL, page-view or completed-trial event, event time, IP and network information, browser and device signals, and Meta cookie or advertising identifiers. We do not include query strings, referrers, page titles, form contents, names, email addresses, store or organization names, organization or user identifiers, Customer Data, billing information, or financial records in these events.

We collect information directly from business users when they create or use an account, configure a store, enter or import records, contact us, accept legal documents, or complete billing. We receive Customer Data from subscribing stores and their authorized users.

We receive limited information automatically from browsers, devices, security controls, and service providers when people visit or use the Service. We may receive subscription, invoice, payment-status, and tax information from Stripe; delivery and suppression information from Resend; and authentication, hosting, or abuse-prevention information from our other providers.

A visitor may choose Analytics only, Advertising only, Allow both, or Necessary only. Google Analytics and Meta Pixel load by default on approved public marketing pages to measure site performance and advertising. Choosing Necessary only opts out of both providers for future ConsignEngine events. Global Privacy Control also opts out of both providers.

We may receive information from an authorized store representative, service provider, professional adviser, regulator, or other person where lawful and relevant to operating, securing, supporting, or marketing the Service.

We use personal information to create and administer accounts and workspaces; authenticate users; apply roles and tenant boundaries; provide inventory, sale, payout, reporting, export, and configurable store workflows; process subscriptions; send transactional communications; provide support; and maintain business and legal records.

We also use information to secure the Service, prevent abuse and fraud, diagnose errors, recover from failures, preserve audit evidence, enforce agreements, respond to requests and disputes, comply with law, and improve the reliability and usability of the shared product.

When analytics is allowed, we use sanitized route-level page views to understand product usage and improve the Service. When advertising is allowed, we use limited website and completed-trial events to measure and attribute campaigns, create or refine advertising audiences, reduce irrelevant advertising, and optimize ConsignEngine advertising. Optional measurement is not required to use the website, create an account, start a trial, or use the product.

We limit use to purposes a reasonable person would consider appropriate in the circumstances, purposes the relevant store directs, purposes described when information is collected, and purposes otherwise permitted or required by law.

We rely on consent, contractual necessity, legitimate business purposes recognized by applicable law, legal obligations, and other lawful authority appropriate to the information and context. A store must have authority and give any required notices before entering information or directing a receipt, report, invitation, or other communication.

Google Analytics and Meta Pixel load by default on approved public marketing pages to measure site performance and advertising. Choosing Necessary only or sending Global Privacy Control opts out of both providers for future ConsignEngine events. The trial-success CompleteRegistration event requires advertising consent. Opting out does not limit the website, signup, trial, or product.

You may opt out or change your choice at any time through the Privacy choices control in the public footer or authenticated workspace navigation. Opting out immediately hard-disables both providers for future ConsignEngine browser events and removes known first-party Google Analytics or Meta identifiers where feasible, but it cannot recall information already transmitted. Other withdrawals may be subject to legal and contractual restrictions and reasonable notice.

We may disclose information to the subscribing store and its authorized users according to roles and settings; to service providers that help us operate the Service; at the store's direction, including through a receipt, report, export, or configured workflow; and to professional advisers, auditors, insurers, financing parties, or transaction counterparties under appropriate confidentiality restrictions.

By default on approved public marketing pages, we disclose sanitized route-level page views to Google Analytics to understand product use and improve the Service, and limited website and completed-trial events to Meta for campaign measurement, attribution, audience creation, and advertising optimization. Choosing Necessary only or sending Global Privacy Control opts out. We do not disclose Customer Data, form contents, account identity fields, store or organization identifiers, or billing information through either integration.

We may also disclose information when reasonably necessary to prevent harm, investigate abuse, protect rights, establish or defend legal claims, complete a corporate transaction, or comply with law, a court, a regulator, or a lawful governmental request.

We do not disclose one store's Customer Data to another store. Platform support or operator access is limited by role and purpose and does not authorize routine store impersonation or unrelated use of Customer Data.

Supabase provides the isolated ConsignEngine database, authentication, and private object storage. The primary SaaS project is hosted in the Canada Central region (ca-central-1), although provider support, security, and related processing may occur elsewhere under Supabase's service terms.

Vercel provides website and application hosting, server functions, edge delivery, deployment, and runtime logs. Stripe provides hosted Checkout, subscription billing, invoices, webhooks, and the customer portal. Resend provides transactional authentication and application email from its us-east-1 region. Cloudflare Turnstile provides signup and abuse prevention through Cloudflare's network.

GitHub provides private source-code and release operations. It is not intended to be a repository for Customer Data. Google LLC provides optional Google Analytics route-level measurement only after consent and handles information under its own terms and privacy policy at https://policies.google.com/privacy. Meta Platforms, Inc. provides the Meta Pixel, which loads on public marketing pages without requiring consent to fire PageView for advertising measurement, attribution, audience creation, and optimization; the CompleteRegistration event requires advertising consent. Meta handles information under its own terms and privacy policy at https://www.facebook.com/privacy/policy/.

We do not use session replay, chat tracking, or CRM enrichment. Google Analytics receives only source-controlled route templates: dynamic record identifiers are replaced and unknown or sensitive routes are excluded entirely. Billing, operator, portal, authentication, password, email-confirmation, callback, export, and API contexts are excluded. Query strings, referrers, page titles, form contents, account fields, store details, and Customer Data are not sent. Meta Pixel loads on approved ConsignEngine public marketing and signup pages and the sanitized trial-success page, and is unloaded on authenticated dashboard, operator, billing, store, password, email-confirmation, or callback routes.

AI photo analysis is unavailable at launch. We do not send inventory photos to an AI provider unless a future feature is separately reviewed, disclosed, enabled by an authorized store owner, and supported by updated terms and privacy information.

Although the primary Supabase SaaS project is in Canada, other providers may process, route, store, or support information in the United States, Canada, and other locations described in their service terms. Resend transactional email is processed from us-east-1, and Internet edge, security, billing, support, analytics, advertising measurement, and delivery services may involve additional jurisdictions. Google and Meta may process optional measurement information in the United States and other locations described in their terms.

Information processed outside your province, state, or country may be subject to the laws and lawful-access processes of that location. We use provider review, contractual terms, access controls, tenant boundaries, data minimization, consent controls, and other safeguards appropriate to the Service and our legal obligations.

ConsignEngine uses cookies and similar browser storage that are necessary for authentication, session continuity, security, preferences, abuse prevention, and basic application operation. Cloudflare Turnstile may process device and network signals to distinguish legitimate use from abuse.

We store the version, choice, and time of an opt-out decision in the visitor's browser. Google Analytics and Meta Pixel load by default on approved public marketing pages; the Google tag, Google requests, Meta fbevents.js, Meta requests, and identifiers such as _ga, _fbp, or _fbc may be present on those pages. Choosing Necessary only or sending Global Privacy Control blocks both providers. We do not provide no-script measurement beacons or use Google's advanced consent mode.

A visitor can reopen Privacy choices and opt out or change their choice at any time. The change applies immediately to future ConsignEngine events. Browser or provider controls may also affect Google and Meta cookies or advertising, and a Global Privacy Control signal keeps analytics and advertising measurement off.

ConsignEngine does not sell personal information for money. Google Analytics and Meta Pixel are active by default on public marketing pages, and the limited disclosure to both providers supports site measurement, advertising measurement, audience creation, and targeted advertising for ConsignEngine. Some United States privacy laws may classify that activity as sharing or targeted advertising even when no money changes hands.

We provide an opt-out mechanism worldwide. Choosing Necessary only or sending Global Privacy Control stops future Google Analytics and Meta events. We do not discriminate against a person or limit the Service because of that choice or the exercise of an applicable privacy right.

We may send authentication, security, invitation, billing, support, legal-update, receipt, and report communications needed for the Service. ConsignEngine does not send marketing email at launch.

A subscribing store controls the recipients of store receipts and consignor reports and is responsible for having authority to send them. Transactional delivery records and suppression information may be used to prevent duplicates, troubleshoot delivery, respect provider restrictions, and protect recipients.

We retain information only while reasonably needed for the purposes described in this policy, the store's instructions, reliable and secure operation, disputes, fraud prevention, and legal obligations. Retention may be longer or shorter where law, a legal hold, an incident, a dispute, provider limitations, or technical safeguards require it.

Our current operational targets are: temporary export packages, 7 days; routine application and runtime logs, 30 days; email delivery logs, 90 days; support, privacy, and security cases and material security or audit evidence, 24 months; and subscription billing, tax, contract, closure-certificate, and legal-acceptance evidence, 7 years after the relevant transaction or relationship, subject to applicable requirements.

For active Customer Data, we retain information during the subscription and target a 30-day final-export window after paid access ends. After that window, we target deletion or de-identification of eligible active tenant data within a further 60 days only when the verified purge and provider processes support it. The current Service does not promise immediate or automatic destructive tenant deletion.

We may retain narrowly required financial, contract, security, fraud, dispute, or legal-hold records after account closure. Provider backups and recovery copies may retain information until their verified schedules expire, and deletion requests may not immediately remove information from immutable or disaster-recovery copies.

The local optional-measurement consent record remains in the visitor's browser until it is replaced, withdrawn, cleared, or the notice version changes. Google and Meta control retention of information already received under their own terms and configured settings. Withdrawal stops future ConsignEngine events but does not recall past transmissions.

The Service supports active-store exports, and a verified organization owner may request an assisted organization export. An account-closure request starts a reviewed, non-destructive process so that identity, authority, exports, billing, legal holds, shared users, and required records can be assessed.

A request to delete information is subject to applicable law, our role, identity and authority verification, the store's instructions where it controls the information, required retention, legal holds, security needs, provider capabilities, and backup aging. We will explain the outcome and available complaint steps required by applicable law.

Until a verified destructive purge and provider-deletion process is available, we will not represent a closure request as immediate verified deletion. Contact privacy@consignengine.com to request access, correction, export, closure, or deletion assistance.

We use administrative, technical, and organizational safeguards designed for the nature of the Service and information, including tenant boundaries, role-based access, server-only privileged operations, audit evidence, credential separation, controlled exports, and backup and recovery planning.

No Internet service is completely secure, and we do not promise that an incident, loss, or unauthorized access can never occur. This policy does not claim a security certification that ConsignEngine has not obtained.

If you believe a ConsignEngine account or information is at risk, contact security@consignengine.com. Do not send passwords, payment credentials, gift-card codes, or unnecessary personal information in the report.

We will assess suspected privacy or security incidents, take reasonable containment and investigation steps, preserve appropriate evidence, and notify affected customers, people, regulators, or others when required by applicable law or contract.

Notification timing and content depend on the facts, the information reasonably available, applicable Canadian federal or provincial requirements, applicable United States state requirements, law-enforcement restrictions, and our role in relation to the affected information.

Depending on applicable law and our role, you may have rights to request access, information, correction, export or portability, deletion, withdrawal of consent, objection or restriction, or review of a denied request. Applicable U.S. law may also provide rights concerning sale, sharing, targeted advertising, certain profiling, or treatment after exercising a right.

Use Privacy choices in the public footer or authenticated workspace navigation to opt out of Google Analytics and Meta advertising measurement immediately. ConsignEngine also treats Global Privacy Control as an opt-out. Submit other requests to privacy@consignengine.com. We may verify your identity, account, store relationship, authority, and any authorized-agent documentation.

We will respond within the period required by the law that applies and may extend, limit, or deny a request where that law permits, with an explanation and complaint or appeal information where required. If a subscribing store controls the information, contact that store first when practical. We may refer the request to the store and provide reasonable assistance.

ConsignEngine is a business service for store owners and authorized staff. It is not directed to children, and a person who has not reached the age of majority where they live may not create or administer a ConsignEngine account.

A subscribing store is responsible for determining whether it may lawfully enter information about a minor consignor or retail customer and for providing required notices and obtaining required authority. Contact privacy@consignengine.com if you believe a child created an account or information was submitted without appropriate authority.

We may update this policy to reflect product, provider, legal, security, advertising, or operational changes. We will publish the new version and effective date and aim to give at least 30 days' notice of a material change when practical.

If applicable law requires consent for a new purpose, we will seek it before using information for that purpose. A material change to optional analytics or advertising measurement also changes the consent-notice version so the visitor is asked again. Historical published versions and their fingerprints are retained in the source-controlled legal-document history.

Contact the Privacy Officer of Country Consignment Inc., doing business as ConsignEngine, at privacy@consignengine.com or Box 703, Killam, AB T0B 2L0, Canada. General support is available at support@consignengine.com, security reports at security@consignengine.com, and legal notices at legal@consignengine.com.

We will investigate privacy complaints and explain our response and any internal review available. You may also complain to the privacy regulator with jurisdiction over your concern. Asking you to contact us first does not limit a right to contact a regulator.