Privacy Policy
Effective Date: March 01, 2026
Last Updated: March 01, 2026
Barta, LLC ("Barta," "we," "us," or "our") operates the Barta marketplace platform at barta.shop and its subdomains (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the Service as a buyer, seller, or visitor.
By accessing or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.
Table of Contents
- Information We Collect
- How We Use Your Information
- Legal Bases for Processing (GDPR)
- How We Share Your Information
- Third-Party Service Providers
- Cookies and Similar Technologies
- Advertising Attribution and Campaign Measurement
- Data Retention
- Your Privacy Rights
- Additional Rights for California Residents (CCPA/CPRA)
- Children's Privacy
- International Data Transfers
- Data Security
- Marketing Communications
- Changes to This Policy
- Contact Us
1. Information We Collect
1.1 Information You Provide Directly
Account Information:
When you create an account, we collect your name, email address, date of birth, and password.
Profile Information:
Display name, profile picture, bio, and platform interests you choose to share.
Seller Information:
If you register as a seller, we collect your shop name, shop description, location (city, state, country), avatar and banner images, SKUs, product listings, and pricing information.
Payment Information:
When you connect a Stripe account for selling, Stripe collects your bank account details, tax identification number, and identity verification documents directly. Barta does not store your full bank account or tax ID numbers. These are held by Stripe.
Communications:
Messages you send to other users through our messaging system, and any communications you send to our support team.
Imported Data:
If you use our CSV import feature (e.g., importing listings from Etsy), we process the file contents to create listings on your behalf.
1.2 Information Collected Automatically
Device and Browser Information:
IP address, browser type and version, operating system, device type, and screen resolution.
Usage Data:
Pages visited, features used, time spent on pages, click patterns, and referring URLs.
Authentication Data:
Session tokens, login timestamps, and authentication method used.
Performance Data:
Page load times and error logs to maintain and improve the Service.
1.3 Information from Third Parties
Stripe:
We receive confirmation of your payment account status (e.g., whether your Stripe account is fully onboarded and charges-enabled). We do not receive your full bank details from Stripe.
Invite Links:
If you join Barta via an invitation link, we associate your account with the inviting user for referral tracking.
2. How We Use Your Information
We use the information we collect to:
- Provide and operate the Service. Create and maintain your account, process listings, facilitate transactions between buyers and sellers, and enable messaging.
- Process payments. Connect your Stripe account, facilitate payouts to sellers, and process buyer purchases.
- Communicate with you. Send transactional emails (order confirmations, shipping updates, message notifications) and, with your consent, marketing emails (newsletters, promotions, new features).
- Improve and personalize the Service. Analyze usage patterns, diagnose technical issues, develop new features, and personalize your experience.
- Ensure safety and security. Detect and prevent fraud, abuse, and unauthorized access; enforce our Terms of Service; and comply with legal obligations.
- Fulfill seller onboarding. Guide sellers through shop setup, Stripe Connect integration, listing creation, and shop publication.
- Provide customer support. Respond to your inquiries, troubleshoot issues, and process your data rights requests.
3. Legal Bases for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:
| Purpose | Legal Basis |
|---|---|
| Account creation and service delivery | Performance of a contract (Art. 6(1)(b)) |
| Payment processing via Stripe | Performance of a contract (Art. 6(1)(b)) |
| Transactional emails | Performance of a contract (Art. 6(1)(b)) |
| Marketing emails | Consent (Art. 6(1)(a)) |
| Fraud prevention and security | Legitimate interest (Art. 6(1)(f)) |
| Analytics and service improvement | Legitimate interest (Art. 6(1)(f)) |
| Advertising attribution and campaign measurement | Legitimate interest (Art. 6(1)(f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interest, we have assessed that our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interest at any time by contacting us.
4. How We Share Your Information
We do not sell your personal information.
We share information only in the following circumstances:
Between Buyers and Sellers
When a transaction occurs, we share necessary information between the buyer and seller to fulfill the order (e.g., shipping address, buyer name). Seller shop profiles, including shop name, bio, location, and listings, are publicly visible.
Service Providers
We share information with third-party service providers who process data on our behalf.
Legal Requirements We may disclose your information if required by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business Transfers If Barta is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.
With Your Consent
We may share your information for any other purpose with your explicit consent.
5. Third-Party Service Providers
| Provider | Purpose | Data Processed | Privacy Policy |
|---|---|---|---|
| Supabase | Authentication, database, backend infrastructure | Account data, profile data, listings, messages | https://supabase.com/privacy |
| Stripe | Payment processing and seller payouts | Name, email, bank details, identity documents, transaction data | https://stripe.com/privacy |
| Cloudflare | Content delivery and security | IP address, browser metadata, request data | https://cloudflare.com/privacypolicy |
| Postmark | Transactional and marketing email delivery | Email address, name, email content | https://postmarkapp.com/privacy-policy |
These providers process data according to their own privacy policies and our data processing agreements.
6. Cookies and Similar Technologies
| Type | Purpose | Duration |
|---|---|---|
| Essential / Authentication | Keep you signed in and maintain session security | Session / up to 30 days |
| Preferences | Remember your settings and choices | Persistent |
| Cloudflare Security | Bot detection and DDoS protection | Session / up to 30 days |
We do not use third-party advertising or cross-site tracking cookies.
7. Advertising Attribution and Campaign Measurement
To understand whether our marketing campaigns are effective, Barta may collect limited conversion events such as:
- App installs
- Account registrations
- Purchases or completed transactions
These events may be transmitted to advertising platforms through secure server-to-server integrations. This information is used solely to measure the effectiveness of our advertising campaigns and optimize how we reach potential creators and buyers.
Why we disclose this. Most platforms transmit conversion data to advertising networks without mentioning it in their privacy policy, or bury it in vague language about "business partners." We believe you should know exactly what data leaves our systems and why.
What we do not share. We do not provide advertising platforms with browsing histories, marketplace activity, or behavioral profiles. We do not sell personal data to advertisers. Only minimal conversion signals (e.g., "a purchase occurred") are transmitted, without details about what was purchased, from whom, or other marketplace context.
Our commitment. Barta does not share your marketplace activity, purchase history, or selling data with external advertising platforms for the purpose of ad targeting. Your marketplace data stays within Barta.
As Barta grows, we intend to increasingly rely on internal measurement and first-party analytics so that we can reduce our reliance on external advertising platforms over time.
8. Data Retention
Account Data: Retained while your account remains active. Deleted or anonymized within 30 days of account deletion unless legally required otherwise.
Transaction Records: Retained for at least 7 years to comply with tax and financial regulations.
Messages: Stored while both users maintain accounts. Deleted accounts will have messages anonymized.
Seller Data: Retained while seller accounts remain active. Archived listings are retained for 12 months before permanent deletion.
Server Logs: Retained up to 90 days for security and debugging.
9. Your Privacy Rights
Depending on your location, you may have rights including:
- Access your personal data
- Correct inaccurate information
- Request deletion of your data
- Restrict certain processing
- Receive portable copies of your data
- Object to legitimate interest processing
- Withdraw consent for marketing
To exercise these rights, contact privacy@barta.shop. We will respond to your request within 30 days (or 45 days if an extension is necessary, with notice). We may ask you to verify your identity before processing your request.
EEA/UK Residents: If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.
10. Additional Rights for California Residents (CCPA/CPRA)
California residents have the right to:
- Know what personal data we collect
- Request deletion of personal data
- Request correction of inaccurate data
- Opt out of sale or sharing of personal data
- Receive equal service regardless of exercising privacy rights
Barta does not sell personal information. We do not share personal information for cross-context behavioral advertising.
Categories of personal information collected in the preceding 12 months:
- Identifiers (name, email, IP address)
- Commercial information (transaction history, listings, shop data)
- Internet activity (browsing history on our Service, usage data)
- Geolocation data (city/state/country from profile, IP-derived approximate location)
To submit a request, email privacy@barta.shop with the subject line "CCPA Request." You may also designate an authorized agent to make a request on your behalf.
11. Children's Privacy
The Service is not directed to individuals under 16.
If we learn we have collected personal data from a child under 16, we will delete that information promptly.
12. International Data Transfers
Barta is based in the United States. Information may be transferred and processed in the U.S. and other countries where service providers operate.
We ensure that international data transfers are protected by appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Service providers certified under applicable data transfer frameworks
- Your explicit consent to the transfer where applicable
13. Data Security
We implement measures including:
- TLS/HTTPS encryption
- httpOnly secure authentication cookies
- AES‑256 encryption for locally persisted state
- Password hashing
- Restricted access to production systems
- Cloudflare WAF and DDoS protection
While we take reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but will notify affected users and relevant authorities of any data breach as required by applicable law.
14. Marketing Communications
With your consent, we may send marketing emails about features, promotions, or marketplace updates.
You can unsubscribe anytime using the link in emails or by contacting privacy@barta.shop.
Transactional emails (orders, security alerts) will still be sent as necessary.
15. Changes to This Policy
We may update this Privacy Policy periodically.
When material changes occur we will:
- Update the “Last Updated” date
- Provide notice at least 14 days before changes take effect
Continued use of the Service indicates acceptance of the updated policy.
16. Contact Us
Barta, LLC
Attn: Privacy
1300 South Blvd STE 30071
Charlotte, NC 28203
United States
Email: privacy@barta.shop
We aim to respond to privacy inquiries within 30 days.