Privacy Policy

1. Who we are

ShopHop, Inc. ("ShopHop," "we," "us") is a Delaware corporation headquartered at 222 W Merchandise Mart Plaza, Suite 1212, Chicago, IL 60654. We operate the ShopHop marketplace at shophop.live. This Policy explains what we collect, how we use it, and your rights.

2. Information we collect

• Account info: name, email, password hash, phone, profile photo, role (Hopper or Host).
• Identity verification: government ID and selfie data processed by our verification partner. We don't store the raw images after verification.
• Listing & booking data: spaces you list or book, messages with the other party, reviews.
• Payment data: processed by Stripe. We receive transaction metadata (amount, status, last 4 of card) but not full card numbers.
• Banking (Hosts): linked through Plaid for payouts. We never see your full account number.
• Device & usage: IP, browser, device type, pages visited, referrer, and session activity for security and analytics.
• Cookies: see our Cookie Policy.

3. How we use information

• To operate the marketplace, match Hoppers with Hosts, and process bookings and payouts.
• To verify identity and prevent fraud.
• To send transactional emails (booking confirmations, receipts, reminders, account notices).
• To improve the Service, debug issues, and measure performance.
• To comply with legal obligations and enforce our Terms.

We do not sell your personal information. We do not send marketing emails without your opt-in.

4. Who we share with

• The other party to your booking — Hosts see your name, profile, and message; Hoppers see Host listing details and (after booking) any access credentials.
• Service providers: Stripe (payments), Plaid (bank linking), Supabase (database & auth), Cloudflare (CDN), our email infrastructure, identity verification, and analytics — each bound by data-protection agreements.
• Legal & safety: when required by law, subpoena, or to protect rights, property, or safety.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to the protections of this Policy.

5. Data retention

We keep account, booking, and payment records for as long as your account is active and for up to 7 years afterward to comply with tax and legal obligations. Marketing and analytics data is retained for shorter periods (typically 24 months) unless you request earlier deletion.

6. Your rights

U.S. residents (incl. California — CCPA/CPRA): you may request to know, access, correct, delete, or port your personal information, and opt out of any "sale" or "sharing" (we do not sell or share). You may designate an authorized agent. We do not discriminate against you for exercising your rights.

EU/UK residents (GDPR): you have rights of access, rectification, erasure, restriction, portability, and objection. The lawful bases we rely on are: contract performance (operating the marketplace), legitimate interests (security, fraud prevention, improvement), legal obligation (tax, compliance), and consent (cookies, marketing).

To exercise any of these rights, email privacy@shophop.live. We respond within 30 days.

7. International transfers

ShopHop is based in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses or equivalent safeguards for transfers from the EEA/UK.

8. Security

We use industry-standard safeguards: TLS in transit, encryption at rest, row-level security in our database, hashed credentials, and regular audits. No system is 100% secure — please use a strong, unique password and enable two-factor authentication.

9. Children

ShopHop is not directed to anyone under 18 and we don't knowingly collect data from minors. If we learn we have, we'll delete it.

10. Changes to this Policy

We may update this Policy periodically. Material changes will be announced by email or in-app notice at least 14 days before they take effect.

11. Contact

Privacy questions, requests, or complaints: privacy@shophop.live. EU/UK users may also contact their local Data Protection Authority.