Effective date: October 23, 2026
This Privacy Policy explains how 90Twenty, LLC [confirm legal entity name] ("90Twenty", "we", "us") collects, uses, shares, and protects information in connection with the 90Twenty platform at app.90twenty.com, our website at 90twenty.com, and related services (together, the "Service").
90Twenty is business software. Most of the personal information in the Service belongs to our customers' businesses: their employees who sign in, and their own customers, vendors, and contacts whose records flow through the Service. This Policy covers both the information we collect about our customers and their Users directly, and how we handle the information our customers entrust to us.
Information about our customers and their Users (account holders, people who sign in, website visitors, and people who contact us). For this information, 90Twenty decides how and why it is used. We are the "controller" or "business" under privacy laws.
Customer Data (the business records our customers load into or sync through the Service, including the personal information of their customers, vendors, leads, and marketplace buyers). For this information, our customer decides how and why it is used, and 90Twenty acts only on their instructions as a "processor" or "service provider". Our Data Processing Agreement governs that processing. If you are a customer or contact of a business that uses 90Twenty and want to exercise privacy rights over your data, please contact that business directly. We will assist them as their agreement with us requires.
Account and profile information. Name, work email address, password (stored only as a one-way hash), role, company name, company address, logo, billing contact, and the two-step authentication secret you enroll.
Usage and device information. Sign-in times, network (IP) addresses used to sign in, browser and device type, pages and features used, API calls made, and error logs. We use IP addresses to detect sign-ins from new locations and to alert account administrators.
Acceptance records. When you accept our Terms, Privacy Policy, or other agreements in the Service, we record who accepted, on behalf of which company, which version, when, and from which network address.
Communications. Messages you send to our support or sales addresses, feature suggestions submitted through the Service, and the content of email you send through the Service's outreach and campaign features.
Customer Data synced on your behalf. When you connect a Third-Party Platform (for example Amazon, eBay, Shopify, Walmart, Newegg, WooCommerce, BigCommerce, Google Merchant Center, Google Ads, Google Search Console, BrokerBin, Apollo, Stripe, carriers, freight brokers, or an email provider), the Service retrieves and stores the data needed to run your business: listings, orders, buyer names and shipping addresses, payouts, fees, returns, advertising performance, search data, lead and contact records, and shipping details. We store the access tokens or API credentials you authorize so the connection keeps working.
Payment information. If you pay by card, your card details are collected and stored by Stripe, our payment processor. We receive only a token, the card brand, and the last four digits.
Information from drive testing. The ITAD module's bench agent collects hardware identifiers, SMART and FARM diagnostic data, and test results from storage devices you test. It does not read the contents of those devices.
We do not knowingly collect information from anyone under 18, and the Service is not directed to them.
We use information about our customers and their Users to:
We use Customer Data only to provide the Service to the customer that owns it, as described in the Data Processing Agreement. We do not sell Customer Data, use it for advertising, or use one customer's data to benefit another customer.
Marketplace buyer data. To comply with marketplace data protection policies, the Service automatically redacts buyer names and street addresses from marketplace orders a fixed period after shipment, while keeping the non-personal transaction records that accounting and tax require.
AI features. Some features (such as drafted email replies, listing descriptions, SEO suggestions, and reply classification) send the relevant text to a third-party model provider to generate a result. We send only what the feature needs, we do not allow the provider to use it to train models, and the output is returned to you for review.
Google API data. 90Twenty's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Ads and Search Console data only to provide the advertising and SEO features you enable, and do not use it for any other purpose.
We do not sell personal information. We share information only as follows:
We protect information with technical and organizational measures including encryption in transit (TLS), hashed passwords, mandatory two-step authentication for every User, idle session sign-out, account lockout after repeated failed sign-ins, new-location sign-in alerts, role-based access control, tenant isolation on every database query, scheduled backups, access logging, and regular credential rotation. No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur. If we learn of a security incident affecting your information, we will notify you as described in the Data Processing Agreement and as required by law.
The Service uses a session cookie that keeps you signed in and a browser-tab identifier that lets two companies run in two tabs. These are strictly necessary and are not used for advertising. We do not use third-party advertising or analytics cookies in the Service. Our marketing website may use basic, privacy-respecting analytics. Outreach emails sent through the Service may include an open-tracking image and a one-click unsubscribe link, which are features our customer controls.
Depending on where you live, you may have the right to access, correct, delete, export, or restrict the use of your personal information, to object to certain processing, and to not be discriminated against for exercising these rights.
California residents. We do not sell or share personal information for cross-context behavioral advertising, and we have not done so in the preceding 12 months. When we process Customer Data, we do so as a service provider under the California Consumer Privacy Act. You may designate an authorized agent to make requests on your behalf.
Marketing email. Every marketing email from 90Twenty includes an unsubscribe link. Operational and security messages about your account cannot be unsubscribed from while your account is active.
The Service is hosted in the United States. If you access it from elsewhere, you consent to the transfer of your information to and processing in the United States, where privacy laws may differ from those in your location. Where required, we use standard contractual clauses or other approved mechanisms for transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland.
We may update this Policy. We will post the updated version with a new effective date and, for material changes, give notice by email or in the Service and require re-acceptance. Continued use after the effective date constitutes acceptance.
90Twenty, LLC [confirm] [Street address] [City, State ZIP] privacy@90twenty.com