ArbiKey is operated by Elmas Group LLC ("we", "us", "our"), a limited liability company registered in New Mexico, USA. This policy describes what personal data we collect, how we use it, and what rights you have over it. Our service is hosted entirely within the EU, and we process data in compliance with the General Data Protection Regulation (EU) 2016/679.
The data controller for all personal data processed through arbikey.com is:
Elmas Group LLC
1209 Mountain Road Pl NE, Ste R
Albuquerque, NM 87110, USA
Email: privacy@arbikey.com
| Category | Data | Legal Basis |
|---|---|---|
| Account identity | Email address; hashed password; Google OAuth profile (email, name, avatar) if you use "Sign in with Google". | Contract performance — needed to provide your account. |
| Business data | Products, supply costs, sale prices, order records, returns, expenses, store names and identifiers you enter into the product. | Contract performance — this is the core of the service. |
| eBay connection | eBay OAuth access and refresh tokens; your eBay seller ID; order and listing data fetched on your behalf. | Contract performance; your explicit consent when you authorise the eBay connection. |
| Billing metadata | Subscription tier, renewal date, subscription ID. Card details are handled exclusively by Paddle (our merchant of record) and are never stored by us. | Contract performance; legitimate interest in managing subscriptions. |
| Technical and security data | IP address; browser and device type; error logs; authentication events. | Legitimate interest — keeping the service secure and operational. |
| Communications | Emails you send to support@arbikey.com or privacy@arbikey.com. | Legitimate interest — responding to your enquiry. |
We do not use your data for any purpose not described above without your prior consent.
All data is stored with Supabase on servers located in the European Union (Ireland, eu-west-1). Access to your rows is enforced at the database level using Row-Level Security (RLS) — even ArbiKey engineers cannot query your data through the normal application interface. All changes to business data are written to an append-only audit log.
Data in transit is encrypted using TLS 1.2 or higher. Passwords are never stored in plain text.
When you connect an eBay account, ArbiKey requests the minimum OAuth scopes required to fetch your orders and listings. We store only what is necessary to display your own figures. You can disconnect your eBay account at any time from the Integrations section of the app, and we will delete the stored tokens and marketplace data. We honour eBay's account-closure notifications and delete associated data within 30 days of receipt.
The optional ArbiKey extension for Google Chrome (“the extension”) works only together with your ArbiKey account. This section describes exactly what it reads, when, and where that data goes.
| Data | When it is read | Where it goes |
|---|---|---|
| Your ArbiKey sign-in session (access and refresh token, user ID, email) | When you are signed in at arbikey.com in the same Chrome profile. | Stored only in the extension’s local storage in that Chrome profile, and used only to call ArbiKey on your behalf. “Sign out” in the extension deletes it. |
| Product page data on Amazon and AliExpress (title, price and currency, shipping cost, images, category, brand, rating, product ID, page address) | On a product page you are viewing, to show the profit panel. | Stays in your browser until you click “Add to ArbiKey”; then it is saved to your ArbiKey account. The optional “Check eBay demand” button sends the product title and ID to ArbiKey’s server to look up public eBay listings. |
| eBay Seller Hub orders (order number, item, price, quantity, order status, buyer name and shipping address) | Only when you start an order sync, after the extension shows you what will be read and you allow it. | Saved to your ArbiKey account so you can fulfil orders and see real profit. |
| Amazon price and stock of products already in your account | Every 2 hours while Chrome is open, unless you turn “Background price & stock tracking” off in the extension settings. | Price and availability are saved to the matching products in your ArbiKey account. |
| Extension preferences (language, selected store, panel and tracking settings) | When you change them. | Only in the extension’s local storage. |
The extension runs only on the sites its permissions name (Amazon, AliExpress, eBay and arbikey.com). It does not collect your browsing history, does not place orders or submit forms on any marketplace, does not read passwords or payment details, contains no advertising or analytics code, and does not load code from the internet. If you use the eBay demand check while signed out, the product title and your IP address are processed only to answer the request and to apply rate limits.
Data received through the extension is never sold, never used for advertising, never used to determine creditworthiness or for lending, and is shared only with the sub-processors listed in section 9 to provide the service. The use of information received by the ArbiKey extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Uninstalling the extension deletes everything it stored in your browser. Data saved to your ArbiKey account can be exported or deleted as described in section 11.
We use essential cookies only. These are strictly necessary to authenticate your session and keep the service secure. We do not use advertising, tracking, or analytics cookies. There is no cookie consent banner because we do not set any non-essential cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| sb-auth-token | Supabase session authentication | Session / up to 1 week |
| sf_mode | Your interface theme preference (light/dark) | 1 year (localStorage, not a cookie) |
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, edge functions | EU (Ireland) |
| Cloudflare | CDN, DDoS protection, static asset hosting | EU and global edge |
| Paddle | Payment processing, subscription management, merchant of record | UK/EU |
| Resend | Transactional email delivery | EU |
We do not knowingly transfer personal data outside the European Economic Area. All primary storage and processing occurs in EU data centres. If any sub-processor transfers data outside the EEA, they are contractually required to provide an equivalent level of protection (e.g. Standard Contractual Clauses).
To exercise any of these rights, email privacy@arbikey.com. We will respond within 30 days. If you believe we have infringed your rights, you may lodge a complaint with your national data protection authority.
We retain your account and business data for as long as your account is active. If you request account deletion, we will erase your data within 30 days, except where retention is required by applicable law (e.g. billing records may be retained for up to 7 years for tax compliance). Deleted accounts cannot be recovered.
ArbiKey is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, please contact us and we will delete it promptly.
We may update this policy to reflect changes to our service or applicable law. If a change materially affects your rights, we will notify you by email at least 14 days before it takes effect. The current version is always available at arbikey.com/privacy/.
Data protection enquiries: privacy@arbikey.com
General support: support@arbikey.com