Privacy Policy
Collective Power Inc ("CPI", "we", "us") runs a group-buying platform at collectivepowerinc.com where independent retailers pool purchases to get volume pricing from sellers (manufacturers, distributors and wholesalers). This policy explains what personal information we collect, why, who we share it with, and the choices you have. It covers our website, the retailer app, the seller portal and the emails we send.
- We collect what we need to run accounts, verify that a business is a real, legal US business, and process group purchases.
- We do not sell your personal information and we do not use it for advertising.
- Retailers appear to each other only under an anonymous alias. Real identities are seen by CPI staff, and by a seller only for orders that have been paid.
- If you sign in with Google, we receive your name and email address from Google and nothing else.
- You can ask us to access, correct or delete your information at support@collectivepowerinc.com.
1. Who this applies to
CPI is a business-to-business service. Most of the information we hold is about businesses, but some of it identifies the people who run them (an owner's name, a business phone number or an email address). This policy applies to those people: retailer and seller account holders and their team members, people invited to join, visitors to our site, and CPI staff.
2. Information we collect
Information you give us
- Account details: name, email address, phone number, password (stored only as a hash), and for retailers an anonymous alias.
- Business details: business name, other names the business trades under (DBA), type of business, address, website, state of registration, state file number, and employer identification number (EIN).
- Verification documents: for example a certificate of good standing, DBA filing, business license, seller's permit or resale certificate, and letters authorizing the sale of a brand. These can contain a business owner's personal information.
- Optional trade information: bank and trade references and credit application details, if you choose to provide them.
- Pool and order activity: pools you create or join, quantities you commit, funding requests, orders, shipment tracking, delivery confirmations, disputes, and messages you post in pool chat.
- Seller catalog data: product listings, prices, brand information and files you upload.
- Feedback and support: anything you send us, including product requests and supplier suggestions.
Information from Google, if you choose "Sign in with Google"
We request only your basic profile: your name, email address and Google account identifier. We do not request access to your Gmail, Drive, Calendar, contacts or any other Google data.
Information collected automatically
- Sign-in and security records, such as the time of sign-in, session information and the result of two-step verification.
- Basic technical data such as IP address, browser type and pages requested, held in the logs kept by our hosting providers.
- Cookies or similar browser storage needed to keep you signed in and remember simple preferences. We do not use advertising, analytics or cross-site tracking cookies. Some of our pages load code libraries from public content delivery networks (jsDelivr and Cloudflare), which receive your IP address when your browser fetches them.
Information from other sources
- Public business and government sources: we check businesses against public records, including state business registries, the federal SAM.gov registry, and the US Treasury OFAC sanctions list, as part of verification and legal compliance.
- Business directories: to find sellers and retailers who might want to join, we build a staff-only prospect directory from public sources such as SAM.gov, OpenStreetMap and Overture Maps. It holds business names, addresses, phone numbers and websites. It is not visible to other members.
- Other members: a retailer can ask us to invite a supplier, which means we hold that supplier's contact details until they respond.
3. How we use information
- To create and run your account and keep it secure, including two-step verification for sellers and staff.
- To verify that a business is a legal US business in good standing, and to re-check this each year.
- To screen against sanctions lists and otherwise meet our legal obligations.
- To run group-buying pools, collect and hold payments, place orders with sellers, arrange shipment tracking and resolve disputes.
- To send service emails: verification, invitations, order and shipment updates, security notices and replies to you. Sale alerts can be switched off in your notification preferences.
- To invite businesses we think may want to join. These emails say who we are, how we found the business and how to opt out.
- To prevent fraud and abuse, and to enforce our agreements.
- To improve the service and fix problems.
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not make decisions that have legal effects on you by automated means alone. Verification decisions are made by CPI staff.
4. How information is shown to others
- Other retailers see your alias, never your name or business identity. Pool chat messages are shown under your alias.
- Sellers see totals and aliases while a pool is open. For a paid order the seller receives what is needed to ship: the retailer's business name, business address and a shipment reference. Sellers do not receive a retailer's phone number, email address or owner's name.
- Retailers see a seller's company name and profile. Sellers do not have aliases.
- Members of your own seller company see the company's account according to their role (owner, admin or staff).
- CPI staff see what their role needs. Access to verification data and personal staff records is limited and logged.
5. Who we share information with
We share information only with service providers who work for us, and where the law requires it:
| Who | Why |
|---|---|
| Supabase | Database, sign-in and file storage. Data is held on servers in the United States (Amazon Web Services, N. Virginia). |
| Netlify | Hosting of the website and app. |
| Sign-in, only if you choose "Sign in with Google". | |
| Stripe | Payment processing and payouts to sellers [once payments are live]. Stripe collects your payment details itself; we do not store card or bank numbers. |
| Our email provider | Sending the emails described above. |
| Shipping carriers and logistics partners | Delivery and tracking. |
| Anthropic (Claude AI) | Reads verification documents you upload to check them against our rules, and helps sort seller catalog files. Only the file being checked is sent. A CPI staff member makes every verification decision. |
| jsDelivr and Cloudflare | Content delivery networks that serve code libraries to your browser. |
| Professional advisers | Legal, accounting and similar advice, under confidentiality. |
We may also disclose information to comply with law or legal process, to protect the rights, safety or property of CPI or others, or in a merger, sale or reorganization (in which case we will tell you if your information is handed to a new owner).
6. Google user data
CPI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We request only your name, email address and basic profile.
- We use it only to create and sign you in to your CPI account and to contact you about it.
- We do not sell it, use it for advertising, or transfer it to others except to the providers listed above as needed to run the service.
- No person at CPI reads it except as needed to provide support, for security, or to comply with law.
You can remove CPI's access at any time from your Google Account's security settings, and you can ask us to delete your CPI account.
7. How long we keep information
- Account and business records: while your account is open and for two years after it is closed, so that we can handle questions, disputes and returning customers.
- Verification records, order, payment and dispute records, and sanctions screening results: for seven years after the last transaction, to meet tax, accounting and compliance duties.
- Directory prospects: until the business joins, opts out, or we retire the entry as no longer current.
- Technical logs: up to 90 days, unless needed longer to investigate a security issue.
- Staff records: kept after a person leaves, for at least four years, and longer where the law requires.
When we no longer need information we delete it or remove what identifies you.
8. Security
Access to data is restricted by database-level rules, so that members can read only what they are entitled to. Sellers and CPI staff must use two-step verification. Passwords are stored as hashes, data is encrypted in transit, and staff access to sensitive records is logged. No system is perfectly secure, and we cannot guarantee that information will never be accessed without permission. If we learn of a breach that affects you we will notify you as the law requires.
9. Your choices and rights
Wherever in the United States you live, you can use the rights below. We handle every request the same way. You can review and update most of your details on your Profile or business page. For anything else, email support@collectivepowerinc.com. We may need to confirm who you are first.
- Access: ask what personal information we hold about you, how we use it and who we share it with, and get a copy.
- Correction: have errors fixed. Some details of a verified business can be changed only through our identity-change review.
- Deletion: ask us to delete your account and information. We may have to keep some records, for example transactions and compliance records, for the periods above.
- Opting out of invitations: reply "no thanks" to an invitation email and we will not contact that business again.
- Email preferences: service messages are needed to run your account; optional notices such as sale alerts can be turned off in your preferences.
- Google: remove CPI's access from your Google Account settings.
How we respond
- We reply within 45 days. If we need more time we will tell you why.
- We will not treat you differently for using these rights.
- If we decline a request, we will explain why. You can ask us to reconsider by replying to our message, and we will have a different person review it.
- You can send a request yourself or through an authorized agent. We may ask for proof of the agent's authority.
Selling and sharing
We do not sell personal information, and we do not share it for targeted or cross-context advertising, as those terms are defined in US state privacy laws, including California's. We do not use it for profiling that has legal or similarly significant effects. Because we do none of these things there is nothing to opt out of, and we do not need a "Do Not Sell" link.
State privacy laws
Many states, including California, Virginia, Colorado, Connecticut, Texas and Oregon, have privacy laws that give residents rights over their personal information. Some of them may not apply to a business of our size, or to business contact information. We give the rights above to everyone in the United States whether or not a particular law applies, and we will add anything a state requires.
10. Children
CPI is for businesses and is not directed to children. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.
11. Where information is processed
We operate in the United States. Our database and files are held in the United States, and our service providers process information in the United States. CPI is for US businesses only. If you access it from elsewhere, you understand that your information will be handled in the United States.
12. Changes to this policy
We will post any changes here and change the "last updated" date. If a change is significant we will also tell account holders by email or in the app.
13. Contact us
Collective Power Inc
8 The Green #27411
Dover, DE 19901
United States
Email: support@collectivepowerinc.com