Privacy Policy

VerseDB Retail ("we", "our", or "us") is a United States–based software platform for comic book retailers, available at retail.versedb.com and operated as part of the VerseDB platform. We help comic shops manage customer records, pull lists, inventory, and day-to-day shop operations.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to shop owners and staff who use VerseDB Retail, and it describes how we handle the customer records that shops store in our system.

If you do not agree with this policy, please do not use our services.

Shop Owner and Staff Accounts

VerseDB Retail shares a sign-in identity with the VerseDB platform. When you create an account or sign in through VerseDB single sign-on, we receive and store your name, email address, and authentication credentials. This identity is shared between VerseDB Retail and VerseDB by design — the same account works on both.

We also store retail-specific account information separately, including your subscription plan, billing status, and shop preferences.

Shop Information

When you set up a shop, we collect business information including the shop name, address, phone number, website, operating hours, and ownership verification materials (such as DNS records or documents you submit to prove you operate the shop).

Customer Records Entered by Shops

Shops use VerseDB Retail to maintain records of their own customers — typically names, email addresses, phone numbers, pull list subscriptions, and notes. This information is entered by the shop, belongs to the shop, and is only visible to that shop's owner and authorized staff. See Section 3 for how responsibility for this data is divided.

Inventory Data

We store the inventory information shops enter or import, including item titles, conditions, gradings, quantities, and prices, along with the spreadsheet files uploaded during imports.

Billing Information

Subscription payments are processed by Stripe, our payment processor. Your full card details are collected directly by Stripe and never touch our servers. We store only what we need to manage your subscription: your Stripe customer reference, card type and last four digits, and subscription status.

Automatically Collected Information

When you use the service, we automatically collect log data (IP address, browser type, pages visited), device information, and usage data, along with cookies and session identifiers described in Section 7.

For the customer records a shop enters into VerseDB Retail, the shop acts as the data controller: the shop decides what customer information to collect, has the direct relationship with its customers, and is responsible for obtaining any consent required to store and use that information. Consent to pull list text messages is the exception: VerseDB collects it directly from the customer and is responsible for it, as described in Section 4. Consent to a shop's own marketing texts is given to that shop, in the shop's name, and VerseDB records and processes it for that shop.

We act as a data processor for those records. We store and process them solely to provide the service to the shop — we do not use shop customer records for our own marketing, we do not sell them, and we do not contact a shop's customers except to send the pull list notices those customers agreed to receive and the messages the shop sends them through the service. VerseDB sends pull list notices as sender of record once the shop marks the comics ready.

If you are a customer of a comic shop that uses VerseDB Retail and you have questions about how your information is handled, or you would like it corrected or deleted, please contact the shop directly. We will assist shops in fulfilling such requests. If you cannot reach the shop, you may contact us at [email protected] and we will help route your request.

We use the information we collect to:

• Provide, maintain, and improve the service
• Authenticate your account through VerseDB single sign-on
• Process subscription payments and manage billing through Stripe
• Send transactional email — receipts, invitations, trial and billing notices, password resets — through Amazon SES, our email delivery provider
• Send notifications to shop customers about their pull list — by email, and by text message where the customer has agreed to receive texts. VerseDB is the sender of record for text messages about pull lists and sends them from its own phone numbers; the shop's name appears in the message.
• Send a shop's marketing texts (news and offers) to customers who ticked that shop's marketing text checkbox. The shop is the sender of these texts: they come from the shop's own verified toll-free number and start with the shop's name. VerseDB processes them for that shop only and never uses them for its own marketing.
• Send the newsletters a shop's customers have subscribed to, by email only. Newsletter emails contain a small tracking image and links that pass through Amazon SES, so the shop can see whether each email was opened and which links were clicked. Pickup notices, sign-in links and account emails are not tracked.
• Verify shop ownership claims
• Respond to support requests
• Detect, prevent, and address technical issues, abuse, or fraud
• Comply with legal obligations

We do not message a shop's customers for any other purpose. We will only send you marketing communications with your consent, and you can opt out at any time.

Text messages to shop customers

A shop's customer receives text messages only after agreeing to them, either in person at the shop or in the shop's customer portal. The messages tell the customer that comics they reserved are ready for pickup at that shop. Message frequency is about one message per week, and only in weeks when the customer has comics waiting; a confirmation message is sent once when the customer signs up. Message and data rates may apply. Customers can reply HELP for help and STOP to cancel at any time, or turn text messages off in the customer portal.

A shop's marketing texts

A shop that has verified its own toll-free number can text news and offers to customers who ask for them. Only the customer can sign up, by ticking the shop's marketing text checkbox in the shop's customer portal or on one of the shop's signup forms; a shop cannot sign a customer up at the counter or from an imported list. This consent is separate from pull list texts, and neither one implies the other. A confirmation message is sent once from the shop's number when the customer signs up. Message frequency is up to 4 messages a month. Message and data rates may apply. Replying HELP to the shop's number returns the shop's contact details, and replying STOP stops that shop's marketing texts; it does not affect pull list texts or texts from any other shop. Each shop's program is described on its own text terms page.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. See our text message program terms.

We rely on a small number of service providers to operate VerseDB Retail:

• Stripe — payment processing. Card details are handled entirely by Stripe under its own privacy policy; they never touch our servers.
• Amazon SES — email delivery for transactional messages, pull list customer notifications and shop newsletters, and the open and click tracking on newsletters.
• Twilio — text message delivery for the pull list pickup notices VerseDB sends, and for a shop's marketing texts from the shop's own number. Twilio carries each message to the customer's phone number and relays any reply. It does not receive opt-in data or consent records.
• Google Maps Platform — address search when shop staff or a customer enter a shipping address. The address text typed is sent to Google to suggest matching addresses, and Google handles it under its own privacy policy. An address can always be entered by hand instead.
• Infrastructure providers — hosting and database services used to run the platform.

These providers process data only on our instructions and only as needed to provide their services to us.

We do not sell your personal information, and we do not sell or rent the customer records shops store with us. We share information only in these circumstances:

• Service providers: The vendors listed in Section 5, to the extent needed to provide the service
• VerseDB platform: Your account identity is shared with VerseDB (it is the same account). Shop profiles and, where a shop enables it, inventory availability may be displayed publicly on VerseDB.com as part of the service
• Legal requirements: When required by law, subpoena, or legal process, or to protect the rights, safety, or property of VerseDB Retail, our users, or others
• Business transfers: In connection with a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your data
• With your consent: When you explicitly agree to a specific disclosure

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

We use cookies that are essential to running the service: a session cookie that keeps you signed in, a security token that protects forms against forgery, and a cookie that remembers preferences such as light or dark mode. These are first-party cookies — we do not use third-party advertising or cross-site tracking cookies.

You can block cookies through your browser settings, but the service will not function without the session and security cookies.

We take reasonable technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS) for all connections
• Hashed and salted password storage; optional two-factor authentication on accounts
• Strict tenant isolation — each shop's data is scoped so that one shop cannot access another shop's customers, pull lists, or inventory
• Role-based access controls for shop staff
• Card data handled exclusively by Stripe, a PCI DSS Level 1 certified processor

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify affected users as required by applicable law.

We keep your shop's data — customer records, pull lists, inventory, and settings — for as long as your subscription is active, so your shop's history is there when you need it. If your subscription lapses, your data remains stored so you can pick up where you left off if you return.

You can request deletion of your shop's data at any time by contacting us at [email protected] or using the account deletion option in settings. Deleting your retail account removes your shop data, customer records, and retail profile; your shared VerseDB identity is managed separately through VerseDB.com. We may retain limited records where required by law — for example, billing records needed for tax purposes.

Depending on where you live (including under regulations such as the GDPR and the California Consumer Privacy Act), you may have the right to:

• Access: Request a copy of the personal information we hold about you
• Export: Receive your data in a portable format — shops can export customer and inventory data from within the app at any time
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Objection and restriction: Object to or ask us to limit certain processing
• Opt out: Unsubscribe from marketing communications at any time

To exercise any of these rights, email [email protected]. We will respond within the timeframe required by applicable law. We do not discriminate against anyone for exercising their privacy rights.

Remember that for customer records held by a shop, the shop is the controller — requests about those records should go to the shop first (see Section 3).

VerseDB Retail is a business tool intended for shop owners and staff who are at least 18 years old. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us at [email protected] and we will delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or with a notice in the service before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of the service after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, please contact us at: