Draft. Not reviewed by an attorney, and not in force.

These documents are working drafts published for review. They still contain unfilled placeholders, and several clauses predate a change to how money moves on the platform, so they do not describe the product as it works today. Nothing here is a binding agreement, and no one should rely on it.

Privacy policy

◆◆ NEW (28 Sep 2026). Three changes this policy does not yet cover. (1) The early-access list at /early-access collects a prospect's full name, company name, business email, trading side and product categories before any account exists, plus an optional, unticked consent to launch news (recorded with the wording's version, a hash of its text, the time and the IP address), and which launch email brought them, if one did (the ref link, stored as source). Consent is not yet confirmed by email (no double opt-in). It needs a section on pre-account data, a marketing-email use with unsubscribe, and a retention period. Nothing is stored until a database is connected and saving is switched on, and the form says so. (2) Refund evidence can now include email threads and platform or text messages, which carry third parties' contact details. The seller's attestation authorizes us to review the attached communications and records solely for the refund decision; this Policy should state that limit. (3) The fee's name. The Seller's 2.8% is now called the introduction fee; the dated notes below use that name. [confirm with counsel]

◆◆ PRICE CHANGED (27 Sep 2026). The Buyer's Desk subscription (called Premium on screen) is now $999/month. It was $500 when the dated notes below were written; their figures have been updated to $999 so the drafts match the site.

The Gateway [BRAND NAME - pending final selection]

Effective date: [DATE]

◆◆ This draft predates the 15 September 2026 model change

Marked 17 September 2026. Not attorney-reviewed. Not publishable as written.

Drafted 27 August 2026. This document survives the 15 September change better than the other four - its structure, its CCPA posture and its cookie position are all sound - but three things in it are now inaccurate, and one of them is the kind of inaccuracy a regulator reads closely.

The data enumerations are stale. §2.2 lists "payout records" and §3 lists "charge listing and platform fees, and administer payouts". There are no payouts and no listing fees. There is a new set of things we hold that is not listed anywhere: buyer type and payment-terms declarations, the seller liability consent, subscription and sponsored-placement billing records, and - the one to look at hardest - whatever passes through the vendor-packet checklist (a W-9, which for a sole proprietor carries an SSN, and a certificate of liability insurance).
The identity-reveal trigger moved. §4.1 says the introduction happens "after webhook-confirmed payment". It now happens when the seller's 2.8% introduction fee charge clears. The Buyer will not have paid anyone at that point - on Net 90 terms it will be three months before they do.
We now run advertising, of a kind. §3 says flatly "we do not run advertising on the Platform." Sponsored listing placements exist as of 15 September. They are member-paid, first-party, on-topic placements of our own members' own listings, sold flat-priced with no auction and capped at 5 per category - which is a long way from behavioural advertising, and the §4.4 statement that we do not sell personal information or share it for cross-context behavioural advertising remains true. But "we do not run advertising" as an unqualified sentence is no longer accurate, and it is the kind of overstatement that costs more than it buys. [confirm with counsel] on the exact wording, and on whether a first-party sponsored placement touches CCPA "advertising" or "share" definitions at all (we believe not - no personal information leaves us, no third-party pixel is involved, and targeting is by category, not by person).

Everything else holds: §2.1 onboarding data, §2.3, §4.2 processors, §4.3, §5 cookies, §7 security, §8 rights, §9, §10, §11 and §12.

One consequence of the money change reduces our exposure: we no longer sit in the payment chain for goods, so we no longer receive or store any record of the Buyer paying the Seller. That is less data, not more - say so.

Read legal/ATTORNEY-BRIEF.md before this document.

1. Scope

This Privacy Policy describes how [ENTITY NAME, a [STATE] limited liability company] (the "Company," "we," "us") collects, uses, discloses, and protects information in connection with the business-to-business marketplace operated under the name The Gateway [BRAND NAME - pending final selection] (the "Platform").

The Platform is a closed marketplace for approved wholesale and retail businesses in the United States. It is not directed to consumers, to children, or to individuals acting outside a business capacity. Most of the information we handle is business information about companies; personal information arises mainly because businesses act through individual people - an owner, an authorized representative, an accounts-payable contact.

This Policy is incorporated into the Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

2. Information we collect

2.1 Information you provide at application and onboarding

To evaluate and maintain a Platform account, we collect:

Legal business name, any trade names, and business type (wholesaler or retailer).
Business address (no P.O. boxes) and ship-to address(es).
Federal Employer Identification Number (EIN).
State-issued resale certificate, including the document itself and its identifying details.
Name, title, email address, and phone number of the individual(s) authorized to act for the business.
Payment card details, which are collected and stored by Stripe, our payment processor. We do not store full card numbers on our own systems; we retain only a tokenized reference and card metadata (brand, last four digits, expiration) sufficient to display and manage the card on file.
- ◆◆ SCOPE NARROWS (15 Sep 2026) - a card is now genuinely needed only from Sellers, because the Seller's card is the instrument the 2.8% fee is charged to. We charge Buyers nothing, ever. Collecting a chargeable card from Buyers is now data we cannot justify by purpose; see Buyer Agreement §2.3. [confirm with counsel]
Buying preferences, such as categories of interest and expected monthly purchase volume, used to make notifications relevant.
◆◆ MISSING (15 Sep 2026) - §2.1 does not list several things we now collect at signup or shortly after, and each needs its own line: the buyer type a Buyer declares (retailer / distributor / liquidator) and the payment terms it declares, both of which are disclosed to a matched Seller; the liability consent a Seller signs; and the contents of the vendor packet exchanged at the vendor-number stage - company information, a certificate of liability insurance, and a W-9. The W-9 is the item to think hardest about: for a sole proprietor it carries a Social Security Number, which is sensitive personal information under CCPA/CPRA and several state laws, and its presence would change our retention, security and rights obligations materially. The safest engineering answer is that the Platform facilitates the checklist without ever storing the packet - the parties exchange documents directly, and we record only completion status. If that is what we build, this Policy should say so expressly. If we do store any of it, this Policy needs a sensitive-information section it does not currently have. [confirm with counsel]

2.2 Information generated by your use of the Platform

Listings you create, Counteroffers you submit, Orders, invoices, payout records, and fee charges.
- ◆◆ STALE (15 Sep 2026) - strike "payout records"; there are no payouts. "Fee charges" now means the Seller's 2.8% introduction fee, the $999/month Buyer's Desk subscription, and sponsored-placement charges - all Seller-side. Add the wanted orders Buyers post and the matches the Platform proposes, which are member data generated by use and are not listed anywhere in §2.2. And note affirmatively what we no longer hold: no record of payment for goods, because the Buyer pays the Seller off-platform and we are not in that chain.
Watchlists, saved searches, and notification settings.
Messages sent through the post-payment Freight Thread and communications with Platform administrators, including dispute filings and their required evidence (photographs, delivery documents, bills of lading).
- ◆◆ RENAME (15 Sep 2026) - "post-payment Freight Thread" is now wrong twice over: there is no payment to us, and the thread opens when the Seller's fee charge clears. Call it the post-introduction freight thread, or name the trigger.
Log and device data: IP address, browser type, pages viewed, timestamps, and similar records generated automatically when you use any web service. We use this data for security, debugging, and operating the service - not for advertising.

2.3 Information from third parties

We may receive confirmation events from Stripe about payments, chargebacks, and disputes, and we may receive information from verification services or public records if the Company adopts third-party business verification [owner decision pending under Terms of Service Section 3.3].

We do not purchase marketing lists and we do not collect information about you from data brokers.

3. How we use information

We use the information described above to:

Evaluate applications and approve, condition, or refuse accounts and Listings.
Operate the marketplace: publish Listings, process Counteroffers and Orders, compute totals server-side, charge listing and platform fees, and administer payouts.
- ◆◆ STALE (15 Sep 2026) - there are no listing fees and no payouts. This becomes: publish Listings and wanted orders, propose matches, process Counteroffers and Orders, compute prices server-side, and charge, hold, release and refund the Seller's 2.8% introduction fee and the Seller's subscription and placement charges.
Maintain seller anonymity mechanics before Settlement and disclose counterparty identities after Settlement (see Section 4.1).
- ◆◆ TRIGGER CHANGED (15 Sep 2026) - before and after the introduction, which is the clearing of the Seller's 2.8% fee charge. Not Settlement, which no longer exists.
Send transactional and operational notifications: offer received, offer accepted or declined, offer expiring, payment confirmation, freight coordination, dispute status, and account or policy notices. Saved-search and "just listed" alerts are sent according to your notification settings and can be turned off.
Administer the Refunds and Disputes Policy, including reviewing evidence and adjudicating claims.
Detect, investigate, and prevent fraud, credential falsification, fee circumvention, anonymity circumvention, and other violations of the Platform Agreements.
Comply with law, including tax, accounting, and lawful requests from authorities.

We do not use Platform data for third-party advertising, and we do not run advertising on the Platform.

◆◆ NO LONGER ACCURATE AS WRITTEN (15 Sep 2026) - and this is the flag that matters in this document. The first half stays and is unambiguous: we do not use Platform data for third-party advertising, and we never will. The second half does not survive. As of 15 September the Platform sells sponsored listing placements: a member pays to have its own listing placed higher within a category it is already in. They are first-party, member-paid, always on-topic, flat-priced with no auction, and capped at 5 per category; they are labelled typographically rather than by colour, and never use the orange commerce accent.

Why this still does not make us an ad business, and why counsel should confirm it in writing: no personal information leaves us; there is no third-party ad network, no pixel, no tag, no cookie beyond the two essential ones in §5; targeting is by category, not by person, profile or inferred interest; and the placement is paid for by the party whose own goods are shown. On that basis the §4.4 statement - no sale of personal information, no sharing for cross-context behavioural advertising - remains true and should be kept exactly as it is. What needs rewording is only the blanket "we do not run advertising."

Suggested replacement for counsel to consider: "We do not use Platform data for third-party advertising and we do not permit third-party advertising on the Platform. Members may pay for sponsored placement of their own listings within a category; sponsored placements are labelled, are limited in number, are not targeted using personal information, and involve no disclosure of your information to any advertiser or advertising network." [confirm with counsel]

4. How we disclose information

4.1 To your counterparty

Seller identities are hidden on public Listings. After Settlement of an Order - that is, after webhook-confirmed payment - the Buyer and Seller are introduced to each other in the Freight Thread and each receives the information reasonably necessary to complete the transaction: business name, contact name, phone, email, and pickup or delivery addresses. This disclosure is inherent to how the Platform works, and by transacting you direct us to make it.

◆◆ TRIGGER CHANGED (15 Sep 2026) - rewrite this paragraph. The introduction no longer follows payment, because there is no payment to us. It follows the clearing of the Seller's 2.8% introduction fee charge. The Buyer has paid nobody at that point and, on Net 90 or Net 105 terms, will not for months.

This is the most consequential sentence in the Policy, because the introduction is the entire product and it is irreversible: once two counterparties know each other, they cannot be made to un-know it. Three things follow, and counsel should address each. (a) The "by transacting you direct us" consent theory has to be re-based - the disclosure is now triggered by the Seller's payment of a fee, and it discloses the Buyer's identity too, so the Buyer's direction has to attach to something the Buyer actually does. (b) What is disclosed has grown: the Buyer's declared type and payment terms now go to the Seller as part of the introduction, which is commercial-credit information about the Buyer. (c) What happens if the fee charge later reverses by chargeback - the disclosure cannot be undone, and the Policy should not pretend otherwise. [confirm with counsel]

4.2 To service providers (processors)

We share information with a small set of service providers that process it on our behalf, under contracts limiting their use of it to providing services to us:

Stripe - payment processing, card storage, payout facilitation, and fraud screening.
Supabase - database and application infrastructure hosting Platform data.
Resend - transactional email delivery.
Vercel - application hosting and content delivery.

We may add or replace providers of the same kinds (hosting, payments, email, analytics limited to service operation, verification) and will update this Policy when the categories change materially.

4.3 Other disclosures

We may disclose information: to Platform administrators, who can see real seller identities at all times as described in the Terms of Service; to professional advisors (lawyers, accountants, auditors) under duties of confidentiality; in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy; to comply with law, subpoena, or court order; to enforce the Platform Agreements or protect the rights, safety, or property of the Company, Members, or others, including sharing with law enforcement where we suspect counterfeit or stolen goods; and with your direction or consent.

4.4 What we do not do

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We have not done either in the preceding 12 months. We do not disclose Member data to other Members except as described in Section 4.1 or with your direction.

◆◆ STILL TRUE - VERIFY AND KEEP (15 Sep 2026). Sponsored placements do not change this. No personal information is sold, no personal information is disclosed to any advertiser or ad network, and targeting is by category rather than by person. Keep the sentence verbatim; the change belongs in §3, not here. Two verifications before publication, though: the Platform now discloses a Buyer's declared type and payment terms to a matched Seller, so the last sentence's exception ("except as described in Section 4.1") must be checked to cover it; and the vendor-packet exchange (W-9, certificate of insurance) is a member-to-member disclosure that must be described accurately in §4.1 if it passes through us at all. [confirm with counsel]

5. Cookies

The Platform uses only the cookies necessary to operate a closed, authenticated service:

Authentication and session cookies, which keep you signed in and secure your session.
Security cookies, such as CSRF-protection tokens.

We do not use advertising cookies, third-party tracking pixels, cross-site tracking, or social-media plugins. Because we use no non-essential cookies, there is no cookie-consent banner to manage; blocking the essential cookies in your browser will prevent sign-in.

6. Retention

We retain information for as long as needed for the purposes above, and afterwards as required for legal, tax, accounting, audit, and dispute-defense purposes. As general guidelines: account and onboarding records are kept for the life of the account plus [7 years]; transaction, invoice, fee, and payout records for [7 years]; dispute files for [7 years]; Freight Thread messages for [3 years]; and routine server logs for [13 months].

◆◆ STALE ENUMERATION (15 Sep 2026) - strike "payout"; add subscription and sponsored-placement billing records, wanted orders and match records, and - if we store any of it - vendor-packet documents, which should carry the shortest retention of anything in this list rather than the default seven years. Register item G1 needs re-asking on the new data map. [confirm with counsel] [Confirm retention periods with owner and counsel.] We may retain information longer where a claim, investigation, or legal hold requires it, and we may keep de-identified or aggregated data indefinitely.

7. Security

We use commercially reasonable administrative, technical, and physical safeguards appropriate to a B2B marketplace: encryption in transit, access controls limiting administrative access, tokenized card storage through Stripe, webhook-verified payment state, and logging of administrative actions.

◆◆ MINOR (15 Sep 2026) - "webhook-verified payment state" now describes only the fee charge, not any payment for goods. Keep the control, narrow the sentence. If the vendor packet is ever stored (see §2.1), this section needs a sensitive-information control to match. [confirm with counsel] No system is perfectly secure; you are responsible for safeguarding your credentials, and we will notify affected Members of a security incident as required by applicable law.

8. Your choices and rights

8.1 Account information

You may review and update your business information, contacts, ship-to addresses, buying preferences, and notification settings in your account, or by contacting us at [PRIVACY EMAIL]. Keeping your EIN, resale certificate, and card on file accurate and current is a condition of continued approval under the Terms of Service.

8.2 California residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended, may give you rights with respect to personal information we hold about you, including the rights to know, access, correct, and delete personal information, and the right not to be discriminated against for exercising those rights. Two notes specific to this Platform:

Much of what we hold is business-to-business information collected from you acting as a representative of a business; the scope of CCPA rights over such information depends on the law in force at the time of your request.
We do not sell or share personal information as those terms are defined by the CCPA, so there is no sale or sharing to opt out of, and we do not use or disclose sensitive personal information for purposes requiring a right to limit.

To exercise a right, contact [PRIVACY EMAIL] with your name, business, and relationship to the Platform. We will verify your identity (typically against your account credentials and on-file contact details) and respond within the time the law allows. You may use an authorized agent; we will require proof of authorization. Note that we may be unable to delete records we are legally required to keep - for example, transaction, tax, and dispute records.

8.3 Other U.S. state privacy laws

Residents of other states with comprehensive privacy laws may have similar rights, subject to those laws' B2B scope and exemptions. Requests may be sent to [PRIVACY EMAIL] and will be honored where the law applies.

9. Not for consumers or children

The Platform serves businesses only. It is not directed to, and we do not knowingly collect personal information from, anyone under 18. If you believe a minor has provided information to us, contact [PRIVACY EMAIL] and we will delete it.

10. United States operation

The Platform is operated from the United States and is intended for U.S. businesses. Information is stored and processed in the United States (including by the processors listed in Section 4.2). If you access the Platform from elsewhere, you do so on your own initiative and consent to processing in the United States. [Owner decision pending: whether non-U.S. businesses will be admitted; if so, this Policy will need cross-border provisions reviewed by counsel.]

11. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new effective date and, for material changes, notify Members by email or Platform notice before the change takes effect. Continued use of the Platform after the effective date is acceptance of the updated Policy.

12. Contact

Questions, requests, and complaints about privacy may be directed to:

[ENTITY NAME] Attn: Privacy [NOTICE ADDRESS] [PRIVACY EMAIL]

Draft prepared for review by counsel - not yet reviewed by an attorney. [DATE]