Privacy Policy

We collect information you provide directly to us when you: • Create an account (name, email address, profile photo via social login providers such as Google, Apple, Facebook, or X) • Verify your phone number (phone number, verification records) • List or purchase items (product details, pricing, photos, transaction history) • Communicate with us or other users (messages, dispute filings, support requests) • Complete a purchase (shipping address, payment details processed by our payment provider — we do not store full card numbers) We also automatically collect certain information when you use our platform, including: • IP address, browser type, operating system, and device identifiers • Pages visited, time spent, referral URLs, and click patterns • Cookies and similar tracking technologies (see our Cookie Policy)

We use the information we collect to: • Operate, maintain, and improve our platform • Process transactions and send related information (receipts, shipping updates, dispute notifications) • Verify your identity and prevent fraud • Send administrative messages, security alerts, and support responses • Analyze usage patterns to improve user experience • Comply with legal obligations and enforce our Terms of Service We do not sell your personal information to third parties.

We share your information only in these limited circumstances: With other users: When you make a purchase, your shipping name and address are shared with the seller to fulfill the order. Sellers see only the information needed to ship your item. With service providers who process data on our behalf: • Shopify — payment processing (card, Apple Pay, Google Pay transactions) • EasyPost — shipping label generation and package tracking (USPS, UPS, FedEx, DHL) • Resend — transactional email delivery (order confirmations, shipping updates, notifications) • Cloudflare — hosting, CDN, and image storage (product photos via Cloudflare R2) • Better Auth — authentication and session management (social login via Google, Apple, Facebook, X) • Google Analytics — anonymous usage analytics and platform improvement With law enforcement: When required by law, court order, or governmental authority, or to protect the rights, property, or safety of GRA GRAMP, our users, or the public. All third-party service providers are contractually obligated to protect your data and use it only for the purposes we specify.

We use cookies and similar technologies to: • Maintain your login session and preferences • Understand how you use our platform (analytics) • Prevent fraud and enhance security For detailed information about the cookies we use and how to manage them, please see our Cookie Policy. You can control cookies through your browser settings. Disabling certain cookies may affect platform functionality.

If you are a California resident, you have the right to: • Know what personal information we collect, use, and share • Request deletion of your personal information • Opt out of the sale of your personal information (we do not sell personal information) • Non-discrimination for exercising your privacy rights To exercise these rights, contact us at privacy@gragramp.com. We will verify your identity and respond within 45 days.

If you are located in the European Economic Area or United Kingdom, you have the right to: • Access the personal data we hold about you • Rectify inaccurate or incomplete data • Request erasure of your data ("right to be forgotten") • Restrict or object to processing of your data • Data portability (receive your data in a structured, machine-readable format) • Withdraw consent at any time where processing is based on consent To exercise these rights, contact us at privacy@gragramp.com. We will respond within 30 days.

We implement industry-standard security measures including: • TLS/SSL encryption for all data in transit • Encrypted storage for sensitive information • Access controls limiting data access to authorized personnel • Regular security reviews No method of transmission over the Internet is 100% secure. We encourage you to use a strong, unique password for your account.

We retain your personal data for as long as your account is active or as needed to provide services. Transaction records are retained for 7 years for legal and tax compliance. You may request deletion of your account at any time by contacting privacy@gragramp.com. Some data may be retained as required by law even after account deletion.

GRA GRAMP is operated in the United States. If you access our platform from outside the US, your data may be transferred to and processed in the United States or other countries where our service providers operate. By using our platform, you consent to the transfer of your data to jurisdictions that may have different data protection laws than your country of residence.

Our platform is not directed to children under 13. We do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA). If you believe a child under 13 has provided us with personal information, please contact us immediately at privacy@gragramp.com and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a prominent notice on our platform. Your continued use of our services after changes take effect constitutes acceptance of the updated policy. We encourage you to review this page periodically.

For privacy-related questions, data requests, or concerns: Email: privacy@gragramp.com General support: support@gragramp.com Website: gragramp.com/contact We aim to respond to all privacy inquiries within 30 days.