SKU-Q Privacy Policy & Global Data Protection Notice
Effective Date: October 28, 2026 |
Version: PRIVACY-2026-v1.2 |
Data Controller: SEOlith LLC (d/b/a SKU-Q, https://skuq.tech)
SKU-Q is engineered on a Privacy-by-Design architecture hosted 100% on the Cloudflare Global Edge Network (`Cloudflare Pages`, `Cloudflare Workers`, and `Cloudflare D1 SQLite`). This Privacy Policy explains what information we collect when you join a 30-day SKU demand queue, share a wishlist, subscribe to a Stripe-powered Buyer or Seller membership, or interact with our browser extension and Progressive Web App (PWA).
1. Categories of Personal Data We Collect & Legal Basis (GDPR Art. 6)
| Data Category | Examples & D1 Table Mapping | Purpose of Processing | GDPR Art. 6 Legal Basis |
|---|---|---|---|
| 1. Account & Persona Identity Data | Name, email address, selected role (`buyer`, `premium_member`, `free_seller`, `seller`, `employee`, `admin`) in users & waitlist_applications. |
Authenticating users, managing waitlist approvals, and enforcing Role-Based Access Control (RBAC). | Art. 6(1)(b) Contract Performance |
| 2. 30-Day SKU Queue & Wishlist Data | Queued SKU codes, target wholesale price tier, 30/60/90-day expiration timestamps, and scoped wishlist share tokens (`SQ-LIST-XXXXXX`) in sku_queues & shared_wishlists. |
Aggregating anonymous buyer volume so verified sellers can unlock Tier 1 (10+), Tier 2 (25+), and Tier 3 (50+) wholesale discounts. | Art. 6(1)(b) Contract Performance |
| 3. SMS & Email Flash-Deal Alert Routing | Opt-in mobile phone number and alert email address in memberships & privacy_consents. |
Dispatching time-sensitive SMS and Email Flash Deal notifications when a verified seller unlocks your queued SKU price. | Art. 6(1)(a) Explicit Opt-In Consent |
| 4. Stripe Subscription & Escrow Billing Metadata | Stripe Customer ID (`cus_...`), Subscription ID (`sub_...`), Price ID (`price_1SkuQ...`), last-4 card digits, and SOX 404 cryptographic audit hashes in stripe_checkout_orders & sox_financial_audit_log. Full card numbers never touch SKU-Q servers. |
Processing recurring Buyer (`SKU-Q Plus`, `VIP Concierge`) and Seller (`Verified Pro Seller`, `Enterprise OEM`) subscriptions and refundable batch escrow stakes. | Art. 6(1)(b) Contract & Art. 6(1)(c) Legal/SOX Obligation |
| 5. Anti-Phishing, CAPTCHA & Edge Security Logs | Submitted store URLs (`url_vetting_logs`), anonymized SHA-256 IP hashes (`captcha_verifications`), and 22 CFR export screening logs (`export_compliance_logs`). | Blocking malicious phishing links, thwarting automated bot/spam attacks, and enforcing US export/sanctions compliance. | Art. 6(1)(f) Legitimate Security Interest & Art. 6(1)(c) Statutory Compliance |
2. Automatic 30-Day Queue Expiration & Data Minimization
Unlike traditional e-commerce platforms that retain behavioral tracking profiles indefinitely, SKU-Q enforces time-bounded intent windows:
- Free Buyer Queues: Automatically expire and dequeue after 30 days (`auto_expired_30d`) unless renewed by the buyer.
- SKU-Q Plus & VIP Concierge Queues: Support extended 60-day and 90-day intent windows with optional auto-renewal.
- 1-Click Revocation ("Undo"): Any shared wishlist token (`SQ-LIST-XXXXXX`) can be revoked immediately (`is_revoked = 1`), terminating external read access across all Cloudflare edge nodes in milliseconds.
3. Stripe Payment Processing & PCI-DSS Level 1 Security
All paid memberships (SKU-Q Plus at $4.99/mo, VIP Concierge at $14.99/mo, Verified Pro Seller at $49/mo, and Enterprise OEM Seller at $199/mo) and refundable seller escrow deposits are processed through Stripe, Inc. (`PCI-DSS Level 1 Service Provider`). SKU-Q only stores tokenized Stripe references (`stripe_session_id`, `stripe_subscription_id`, `stripe_price_id`, and card brand/last4) inside our Cloudflare D1 ledger (`stripe_checkout_orders`) and immutable SOX Section 404 audit log (`sox_financial_audit_log`).
4. Your Statutory Privacy Rights (EU/UK GDPR & California CCPA/CPRA)
Regardless of your geographic location, SKU-Q extends full statutory data subject rights directly inside our self-service Compliance Center tab on skuq.tech:
- Right of Access & Data Portability (GDPR Art. 15 & 20 / CCPA): Export a machine-readable JSON package of your profile, queued SKUs, consent state, and subscription history in 1 click (`POST /api/compliance/dsar`).
- Right to Erasure / "Right to be Forgotten" (GDPR Art. 17 / CCPA Deletion): Trigger immediate cryptographic PII anonymization across `users`, `memberships`, and `shared_wishlists` while preserving non-identifiable SOX financial audit hashes required by law.
- Granular Telemetry & Marketing Opt-Out (CCPA "Do Not Sell or Share"): SKU-Q never sells personal data to third-party data brokers. You may toggle Google Analytics 4 (`analytics_ga4`) and SMS/Email Flash Deal alerts (`marketing_sms_email`) on or off at any time.
5. Subprocessors & International Edge Transfers
- Cloudflare, Inc. — Global Edge CDN, Workers Serverless Compute, D1 SQLite Database, and Turnstile/WAF Bot Protection (USA / Global Edge with EU Standard Contractual Clauses).
- Stripe, Inc. — PCI-DSS Level 1 Subscription Billing, Checkout Sessions, and Seller Escrow Settlement.
- Google LLC (Google Analytics 4) — Anonymized traffic attribution (`G-SKUQTECH01`), active only when analytics consent is enabled.
6. Data Protection Officer (DPO) & Privacy Contact
For privacy inquiries, GDPR/CCPA Data Subject Access Requests (DSAR), or security disclosures, contact SEOlith LLC:
- Privacy & Compliance Desk: compliance@skuq.tech
- Trust & Security SOC: security@skuq.tech
- General Support: support@skuq.tech