Privacy Policy

Last updated: September 2026

This policy explains what MarginMoose (“we,” “us”) collects when you use marginmoose.com, why, and who we share it with. It’s written to reflect exactly what the product actually does today, not a generic template.

What we collect

• Account info: the email and password you sign up with, handled by Supabase Auth.
• Uploaded sales data — aggregates only: when you upload a CSV or forward an order-export email, we read exactly eight fields (SKU, order date, quantity, sale price, platform fee, payment fee, shipping cost, ad cost) plus, if present, a refund amount. Customer name, email, address, and phone number are never read out of the file in the first place — not filtered out afterward, simply never extracted.
• Cost and category data: product costs, names, and categories you enter yourself.
• Settings: currency, target margin, profit goal, custom alert rules, and an optional Slack/Discord webhook URL you provide.
• Billing: subscriptions are handled by Stripe — we never see or store your card number.

How we use it

Every profit and margin figure is computed by plain, deterministic code — never estimated. When you use AI insights or Ask MarginMoose, a compact summary of your already-computed numbers (never raw order rows, never anything resembling customer data) is sent to Anthropic’s API to generate plain-language commentary. We use your data to send you account emails, optional loss-alert and weekly-digest notifications, and — if you’ve configured one — to post the same kind of notification to a webhook URL you supply.

Who we share it with

We use a small number of subprocessors to run the service, each under their own privacy policy and terms for the data they process on our behalf: Supabase (database, authentication, storage), Stripe (payments), Anthropic (AI insight generation, aggregate data only), Resend (transactional email), and Postmark (parsing forwarded import emails, for accounts that enable that feature). We do not sell your data, and we do not use your uploaded data to train any AI model.

Data retention & deletion

We keep your data for as long as your account is active. You can permanently delete your account and everything in it at any time from Settings → Danger zone — this cancels any active subscription and removes your products, sales, costs, and settings immediately. There’s no undo, so it asks you to type your account email to confirm first.

Cookies

We use only the session cookies Supabase Auth needs to keep you signed in. No third-party advertising or tracking cookies.

Security

Everything runs over HTTPS. Data is encrypted at rest (a Supabase default). Every table is protected by Row Level Security scoped to your account, so another user’s data is never readable from yours — enforced at the database level, not just in application code.

Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data. Deletion is self-serve (see above); for access, correction, or export requests, contact us.

Changes to this policy

If this policy changes materially, we’ll update the date at the top of this page.

Contact

Questions about this policy or your data? Reach us at [support email address].

This page is a starting draft and has not been reviewed by a lawyer. If you’re relying on it for real customers — especially sellers in the EU (GDPR) or California (CCPA) — have it reviewed by a qualified attorney first.