The short version: Trovette is software that consignment stores use to run their business. Stores control their consignors’ and customers’ data, and we process it only to provide the Service. We don’t sell personal information, we don’t use ad trackers, and when a store uninstalls, we delete its data in line with Shopify’s requirements.
1. Who we are and scope
Westfax Property Management, LLC (“Trovette,” “we,” “us,” or “our”) provides Trovette, a multi-tenant, business-to-business software service that helps consignment, resale and vintage stores manage consignors, items, sales, balances and payouts (the “Service”). The Service currently integrates with Shopify and Shopify POS, and may integrate with other commerce platforms (such as Square) in the future. We are based in Colorado, USA.
This Privacy Policy explains how we handle personal information in connection with:
- our public website at trovette.com (the “Site”);
- merchants who install or subscribe to the Service (“Merchants”) and their authorized staff users (“Staff”); and
- consignors and other individuals whose information Merchants manage in the Service, including consignors who use a Merchant’s consignor portal (“Consignors”), and the Merchant’s end customers.
The Service is intended for businesses. Our use of Merchant data is also governed by our Terms of Service, including the Data Processing Terms in it, which control if they conflict with this policy for data we process on a Merchant’s behalf.
2. Our role: controller vs. processor
Merchant-controlled data. When a Merchant uses the Service, the Merchant decides what information about its Consignors, customers and Staff to collect and how to use it. For that data the Merchant is the “controller” (or “business” under California law) and Westfax Property Management, LLC acts as a “processor” (or “service provider”/“contractor”), processing it only on the Merchant’s instructions to provide the Service. If you are a Consignor or a store’s customer, the store you deal with is responsible for its own privacy practices; please contact that store first to exercise your rights. We will assist the store and may forward your request to it.
Trovette-controlled data. We act as a controller for limited information we use for our own business purposes: Merchant account and billing relationship information, Site visitor and contact-form or support email information, and security and service logs.
3. Information we collect
From Shopify when a Merchant installs the app
Through Shopify’s OAuth authorization, and only within the permissions (scopes) the Merchant approves, we receive: store details (shop domain, store name, contact email, currency, time zone, locations); an access token to call Shopify on the Merchant’s behalf; product, variant and inventory information for items managed in Trovette; and order and refund information needed to record sales of consigned items and calculate consignor balances. Order data from Shopify may contain customer information (such as name, email, phone and addresses). We use it only to process sales of consigned items and minimize what we keep where practical.
Merchant and Staff information
Names, email addresses, roles and permissions of Staff who sign in, plus store settings and configuration (item fields, split rules, label templates, portal settings).
Consignor information (entered by Merchants, imported, or submitted through a portal)
- Identity and contact details: name, email address, phone number, mailing address, account number or notes.
- Payout details: preferred payout method and handles or identifiers the Merchant chooses to record (for example a PayPal email or Zelle handle), payout history, balances, splits and agreement terms.
- Item information: descriptions, prices, status, sales history and photos of items.
We do not ask Merchants to store full bank account numbers, card numbers or government ID numbers in the Service, and Merchants should not enter them.
Item photos and uploaded files
Photos uploaded by Staff or Consignors and files uploaded to import data (for example spreadsheets exported from other consignment software). Imported files may contain any of the categories above.
Sign-in information
Staff sign in through Shopify. Consignors sign in to portals with a one-time “magic link” sent to their email. We store a hashed token, its expiry, and limited request metadata (such as a hashed email/IP key) to prevent abuse.
Communications
Messages you send us at hello@trovette.com or through the Site, and transactional emails we send on a Merchant’s behalf (for example portal sign-in links).
Technical and usage data
Server and security logs generated when you use the Site or Service, such as IP address, browser user agent, pages or API endpoints requested, timestamps and error details. We do not currently use third-party analytics or advertising trackers on the Site or in the Service.
4. How we use information
- Provide the Service: track consignment items, list and sync products to Shopify, record sales and refunds, calculate splits, balances and payouts, run reports, print labels, and operate consignor portals.
- Data migration: import, map and validate data that Merchants bring from other systems, at their request.
- Authentication and security: sign users in, enforce tenant isolation and permissions, detect and prevent fraud, abuse and security incidents.
- Communications: send sign-in links, service and account notices, and respond to support requests.
- Billing: manage trials and subscriptions (billing through Shopify is coming soon).
- Maintain and improve the Service: troubleshoot, monitor reliability and performance, and develop features, using aggregated or de-identified information where possible.
- Legal: comply with law, enforce our Terms, and protect the rights, property and safety of Westfax Property Management, LLC, our users and others.
We do not sell personal information, “share” it for cross-context behavioral advertising, or use Merchant-controlled data to build profiles for advertising. We do not use Merchant data to train generalized AI models offered to others.
Legal bases (EEA/UK). Where we are a controller we rely on: performance of a contract (providing the Service to Merchants); our legitimate interests (securing, supporting and improving the Service, and communicating with business contacts); compliance with legal obligations; and consent where required. For Merchant-controlled data, the Merchant is responsible for having a valid legal basis.
6. Service providers (subprocessors)
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting, serverless compute, and file storage (Vercel Blob) for item photos and uploads | United States |
| Neon (Databricks, Inc.) | Managed PostgreSQL database | United States |
| Shopify Inc. | Commerce platform integration, app authorization and subscription billing | Canada / United States |
| Resend (Plus Five Five, Inc.) | Transactional email delivery, such as sign-in links (planned) | United States |
| ImprovMX | Forwarding of email sent to our trovette.com addresses | European Union / United States |
We may update this list as our infrastructure changes. Material changes affecting Merchant data will be announced as described in “Changes to this policy.” Merchants may ask for advance notice of new subprocessors by emailing hello@trovette.com.
8. Shopify data requests and deletion
We implement Shopify’s mandatory privacy webhooks. Each request is verified with Shopify’s HMAC signature before we act on it:
- customers/data_request — when a store’s customer asks the Merchant for their data, we identify the information we hold about that customer for that store so the Merchant can respond.
- customers/redact — when a Merchant or Shopify requests deletion of a customer’s data, we remove that customer’s personal details (such as name, email, phone and addresses) from the order records we store for that store, while keeping the non-identifying sale amounts needed for consignor balance accuracy.
- shop/redact — Shopify sends this request 48 hours after a Merchant uninstalls the app. On receipt we permanently delete that store’s data from our production database, including consignors, items, sales, payouts, ledger history, imports, settings and Staff records no longer associated with any store, and we delete that store’s uploaded item photos from file storage.
When the app is uninstalled, access to the Merchant’s Shopify store is revoked immediately and the store is marked inactive; Merchants should export any records they want to keep before uninstalling.
9. Data retention
- Merchant data: kept while the Merchant’s account is active, and deleted after uninstall as described above (normally upon Shopify’s shop/redact request, sent 48 hours after uninstall). A Merchant may also ask us to delete its data sooner by emailing hello@trovette.com.
- Consignor data: kept for as long as the Merchant keeps it in the Service, or until the Merchant deletes it or its store data is deleted.
- Sign-in tokens and rate-limit records: short-lived; sign-in links expire within minutes and invitation links within a few days, and rate-limit records are purged after about 24 hours.
- Logs: retained for a limited period (generally up to 30 days in our hosting provider’s logs) unless needed to investigate a security incident.
- Backups: deleted data may persist in encrypted database backups maintained by our database provider until those backups expire on their regular rotation (generally within 30 days). Backups are not used for any other purpose.
- Correspondence and business records: kept as long as needed for support, accounting, tax and legal obligations.
10. Security
We use administrative, technical and organizational measures designed to protect personal information, including: encryption in transit (TLS/HTTPS) for all traffic; encryption at rest provided by our hosting and database providers; logical separation of every store’s data with tenant-scoped access controls; HMAC verification of Shopify webhooks; signed, expiring sign-in links and rate limiting; role-based permissions for Staff; least-privilege access to production systems; and secrets stored in managed environment configuration rather than code.
No method of transmission or storage is completely secure. If we become aware of a security incident affecting personal information, we will notify affected Merchants without undue delay and in any event as required by law, and provide information reasonably needed for them to meet their own obligations.
11. Your privacy rights
Depending on where you live, you may have the right to: know or access the personal information we hold about you; correct it; delete it; receive a portable copy; object to or restrict certain processing; withdraw consent; and not be discriminated against for exercising these rights.
- Consignors and store customers: contact the store you dealt with, since it controls your data. If you contact us, we will forward your request to the store and help it respond.
- Merchants, Staff and Site visitors: email hello@trovette.com. We will verify your request (for example, by confirming control of the email address or store) and respond within the time required by law (generally 30 days in the EEA/UK and 45 days in California).
You may use an authorized agent where permitted by law; we may ask for proof of authorization. If we deny your request, you may appeal by replying to our decision; if you remain dissatisfied, you may contact your state attorney general or data protection authority.
12. California and other U.S. state disclosures
This section supplements this policy for residents of California (under the CCPA as amended by the CPRA) and of other U.S. states with comprehensive privacy laws, including Colorado.
Categories collected in the last 12 months: identifiers (name, email, phone, address, IP address, account identifiers); customer records and commercial information (consigned items, sales, balances, payout methods and history); internet or network activity (logs); and professional information (Staff roles). We collect these from Merchants, Staff, Consignors, Shopify and your devices, for the business purposes described in “How we use information.” We disclose them to the service providers listed above for those purposes.
No sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the past 12 months. We do not knowingly sell or share personal information of consumers under 16.
Sensitive personal information. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit under the CCPA.
For Merchant-controlled data we act as a service provider/contractor and process it only to provide the Service, under the restrictions in our Data Processing Terms.
13. EEA, UK and Swiss users
If the GDPR, UK GDPR or Swiss data protection law applies, you have the rights described above and may lodge a complaint with your local supervisory authority. For Merchant-controlled data, contact the Merchant. We have not appointed an EU or UK representative at this time; contact us at hello@trovette.com.
14. International data transfers
We are based in the United States, and our primary hosting, database and storage providers process data in the United States. If you access the Service from outside the U.S., your information will be transferred to, stored and processed in the U.S. and other countries where our providers operate, whose laws may differ from those in your country. Where required, we rely on appropriate safeguards for such transfers, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) or our providers’ certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.
15. Children’s privacy
The Service is a business tool and is not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where a higher age applies). Merchants must not use the Service to collect information from children in violation of applicable law. If you believe a child has provided us personal information, contact hello@trovette.com and we will delete it.
16. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version here and change the “Last updated” date. If changes are material, we will provide additional notice, such as by email to the Merchant’s account contact or a notice in the Service, at least 30 days before they take effect where practical. Continued use of the Service after the effective date means you accept the updated policy.
17. Contact us
Questions, requests or complaints about this policy or our privacy practices:
Westfax Property Management, LLC
15751 W Eureka Ave, Morrison, CO 80465, USA
Email: hello@trovette.com