Privacy Policy

Effective date: May 5, 2026

1. Overview

Verbstack provides seller intelligence tools for Reverb sellers (the "Service"). Verbstack is owned and operated by Southnew Digital ("Southnew Digital," "we," "our," or "us"). This Privacy Policy describes the types of information we collect, how we use it, who we share it with, and the rights you have over your information. It applies to all visitors, registered users, and other users of the Service.

By accessing our Service, you agree to be bound by this Privacy Policy. If you do not agree to the terms of this Privacy Policy, you cannot use our Service. Each time you use our Service, the current version of the Privacy Policy will apply. Accordingly, whenever you use our Service, you should check the date of this Privacy Policy (which appears at the top) and review any changes since the last version.

Further, you acknowledge that this Privacy Policy is part of our Terms of Service, which is incorporated by reference, and by accessing or using our Service, you agree to be bound by the Terms of Service. If you do not agree to our Terms of Service, you cannot use our Service.

2. Personal Data Collected by Verbstack

When you use our Service, Verbstack collects information (i) that you knowingly and voluntarily provide (such as through forms or profile screens) including registration and account-setup information, and (ii) that we are able to collect from your web browser, cookies, and other similar technologies.

2.1 Personal Data That You Knowingly and Willingly Provide

Verbstack collects the information that you knowingly and voluntarily provide when you use our Service (such as through web forms or profile screens), including registration and account-setup information, profile details, payment information, and communications. We primarily use this information to provide you the Service. You can choose not to provide us with certain Personal Data, but then you may not be able to take advantage of our Service or other available features we offer. The information that we collect and use may include the following kinds of Personal Data:

  • First and last name
  • Email address
  • Password hash
  • Billing information (payment card details processed and stored by Stripe; we never see or store your card numbers)
  • Reverb shop identifiers and OAuth credentials that you authorize
  • Reverb shop data: orders, listings, feedback, and payouts that sync from your connected shop
  • Communications you send to support, feedback, and email interactions

Personal Data From and/or About Others. We may receive Personal Data about other people because of the way our Service integrates with Reverb (for example, customer names, addresses, and contact details attached to your synced orders). As a requirement to use our Service, you acknowledge that you have the appropriate consent or legal basis to share such information with us.

2.2 Personal Data That We Collect from You

Verbstack collects information that is sent to us automatically by your web browser. We may use this information to generate aggregate and/or anonymous statistics about visitors to our Service. This information typically includes details about your:

  • IP address
  • Browser type and version
  • Browser plug-in details
  • Operating system
  • Local time zone
  • Date and time of each visitor request (e.g., web pages selected and time spent on each page)
  • Referring site and/or search engine
  • Device type (e.g., desktop, laptop, tablet, phone)
  • Screen size, color depth, and system fonts
  • Language preference

Verbstack may use non-Personal Data for various business purposes such as providing customer service, fraud prevention, market research, and improving our Service. The information we receive depends on the settings on your browser. Please check your browser if you want to learn what information your browser sends or how to change your settings.

2.3 Cookies

Verbstack may obtain information about you by installing "cookies" on your computer or device. We use cookies to keep you signed in (essential authentication cookies), to support payment flows (cookies set by Stripe during checkout), and to collect aggregate statistical information about the ways visitors use our Service, including which pages they visit, which links they use, and how long they stay on each page.

When you first access the Service, you may receive a message advising you that cookies are in use. By continuing to browse the Service, you agree to our use of cookies as described in this Privacy Policy.

If you do not wish to receive cookies, you may set your browser to reject cookies or to alert you when a cookie is placed on your computer. If you limit or disable the use of cookies when you visit Verbstack, you may be unable to use the full functionality of our Service.

We do not run advertising trackers, retargeting pixels, or third-party advertising cookies on the Service.

2.4 Personal Data of Your Customers

When your Reverb shop syncs to the Service, Verbstack receives Personal Data about your buyers, including names, shipping addresses, phone numbers, proxy email addresses, and order history. With respect to this buyer Personal Data:

  • You are the data controller (or the “business” under CCPA/CPRA);
  • Verbstack is the data processor (or “service provider” under CCPA/CPRA);
  • We process buyer Personal Data only on your documented instructions and only to provide the Service to you;
  • We do not use buyer Personal Data for our own marketing, profiling, or to enrich profiles for resale;
  • You are responsible for ensuring you have a lawful basis to share buyer Personal Data with us, and for providing any required notices to your buyers.

If you require a separate Data Processing Agreement (DPA) to satisfy GDPR Article 28, UK GDPR, or comparable laws, contact support@verbstack.com.

2.5 Messaging and Communications

If you use Verbstack's automation or messaging features to communicate with your buyers, Verbstack delivers those messages on your behalf using Resend as the email sub-processor. We log delivery metadata (timestamps, recipient, delivery/bounce status, and opt-out flags) for audit, abuse-prevention, and compliance purposes. You are the sender of these messages for legal purposes (including under CAN-SPAM, CASL, and GDPR), and you are responsible for the lawful basis and content of every message you send through the Service.

3. How Is Your Personal Data Used?

We will only process your Personal Data, including sharing it with third parties, where (1) you have provided your consent, which can be withdrawn at any time by contacting support@verbstack.com; (2) the processing is necessary for the performance of a contract to which you are a party; (3) we are required by law; (4) processing is required to protect your vital interests or those of another person; or (5) processing is necessary for the purposes of our legitimate commercial interests, except where such interests are overridden by your rights and interests.

We may use Personal Data we collect about you on its own or combine it with other information we have about you to:

  • Create user accounts and profiles through registration;
  • Perform internal operations, such as tracking and improving the effectiveness of our website, mobile experience, and marketing efforts;
  • Provide product and Service fulfillment, such as creating accounts, managing purchases, and processing payments;
  • Personalize user experiences, such as remembering your settings and preferences (for example, language, theme, dashboard layout);
  • Provide support;
  • Resolve disputes between users and the company as set forth in our Terms of Service;
  • Conduct surveys, research, and audits;
  • Receive feedback;
  • Provide information to our representatives and advisors, such as our attorneys and accountants, to help us comply with legal, accounting, and security requirements;
  • Transfer your information, such as to servers outside of the United States, or as part of a merger or sale of the business;
  • Protect the rights, safety, and information of our members, third parties, and ourselves, including fraud prevention, business or product recalls, and prosecuting or defending legal proceedings;
  • Comply with legal obligations.

We may also disclose your Personal Data as otherwise set forth in this Privacy Policy, as permitted by law, or with your consent.

4. Who Can Access the Information We Collect?

We will only transfer your Personal Data to trusted third parties who provide sufficient guarantees in respect of the technical and organizational security measures governing the processing to be carried out and who can demonstrate a commitment to compliance with those measures.

Where third parties are processing Personal Data on our behalf, they will be required to agree, by contractual means or otherwise, to process the Personal Data in accordance with applicable law. This contract will stipulate, among other things, that the third party and its representatives shall act only on our instructions, or as permitted by law.

Verbstack may disclose your Personal Data in the following instances:

Agents (Service Providers). We employ other companies and individuals to perform functions on our behalf, including database hosting, payment processing, email delivery, error monitoring, application hosting, and customer service. These providers are listed in Section 5 (Sub-processors). We share Personal Data with these agents only as necessary for them to perform their functions.

Employees. Only authorized employees and contractors have access to your Personal Data, and only to the extent required to perform their job duties.

To Comply with Legal Process, Protect Verbstack, or Enforce Our Rights. We may release your Personal Data when it is necessary to (i) conform to legal requirements or comply with legal process; (ii) enforce or apply our Terms of Service and other agreements; (iii) protect the rights, safety, or property of Verbstack, our service providers, our users, or the public; or (iv) prevent a crime or protect national security (including exchanging information with other companies and organizations for fraud protection).

As Part of a Merger or Sale of Business. We may disclose your Personal Data in connection with a substantial corporate transaction, such as the sale of our business, a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.

5. Sub-processors

We rely on the following service providers to deliver the Service. All are bound by their own privacy and security commitments and process Personal Data only on our instructions.

  • Supabase: database hosting and authentication (United States)
  • Vercel: application hosting and content delivery (United States)
  • Stripe: payment processing and subscription billing (United States)
  • Resend: transactional email delivery (United States)
  • Sentry: error monitoring and performance tracking (United States)
  • Vercel Analytics: aggregate, privacy-friendly traffic analytics on our marketing site (United States; no advertising identifiers)
  • Reverb: your connected marketplace, accessed via OAuth credentials you authorize
  • ShipStation: optional shipping-cost integration; pulls shipment metadata via OAuth credentials you authorize (United States)

6. Selling of Personal Information

We will not sell your Personal Data to third parties for their use without your consent.

7. Minors and Children's Privacy

7.1 Children Online Protection

Our Service is not directed to children under the age of 16. If you are not 16 years of age or older, do not use our Service. We do not knowingly collect Personal Data from children under the age of 16. If we learn that Personal Data of persons less than 16 years of age has been collected through our Service, we will take the appropriate steps to delete this information. If you are a parent or guardian and discover that your child or a minor under the age of 13 has posted, submitted, or otherwise communicated Personal Data to our Service without your consent, you may alert us at support@verbstack.com so that we may take appropriate action to remove the minor's Personal Data from our systems.

7.2 Erasure Law (California Minors)

California minors who have submitted Personal Data to the Service may request removal under California Business & Professions Code §22581 by emailing support@verbstack.com.

8. Links to Third-Party Services

Our Service may contain links to third-party websites, applications, and services not operated by us. These links are provided as a service and do not imply any endorsement by Verbstack of the activities or content of those sites, applications, or services, nor any association with their operators. Verbstack is not responsible for the privacy policies or practices of any third party, including websites or services directly linked to our Service. We encourage you to review the privacy policies of any third-party site that you link to from our Service.

9. Social Media Features & Widgets

Our Service may, from time to time, include social media features (such as a "Share This" button) or authentication features that let you sign in via a social media account. These features may collect your IP address, identify which page you are visiting on our Service, and may set a cookie to enable the feature to function properly. Social media features and widgets are either hosted by a third party or hosted directly on our Service. Your interactions with these features are governed by the privacy policy of the company providing them.

10. Security, Storage, & Retention

10.1 Security

We take reasonable technical and organizational precautions to protect the confidentiality, security, and integrity of your Personal Data. Data is encrypted in transit (TLS) and at rest. Reverb OAuth tokens are encrypted with AES-256-GCM before storage, and database access is protected by row-level security policies that isolate accounts. Application secrets are managed via Vercel's environment vault, and we maintain audit logs of administrative and billing events. Although we use security measures to help protect your Personal Data against loss, misuse, or unauthorized disclosure, we cannot guarantee the security of information transmitted to us over the Internet.

In the event of a confirmed security incident affecting your Personal Data, we will notify you without undue delay and, where feasible, no later than 72 hours after we become aware of the incident.

10.2 Storage

The Personal Data that you provide to us is generally stored on servers located in the United States. If you are located in another jurisdiction, you should be aware that once your Personal Data is submitted through our Service, it will be transferred to our servers in the United States and that the United States currently does not have uniform data protection laws in place.

10.3 Retention

We will retain your information for as long as is needed to provide the Service. If you wish to cancel your account or request that we no longer use your information to provide you Service, contact us at support@verbstack.com. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention practices include:

  • Active account: data is retained for the duration of your subscription.
  • Cancelled account: data is retained for 30 days, then permanently deleted.
  • Deleted account: all associated data is erased immediately on request.
  • Audit logs: retained for 90 days for security purposes.

11. International Users

Verbstack is operated from the United States, and our sub-processors store data in the United States. By using the Service from outside the U.S., you consent to the transfer of your information to the United States, which may have data protection laws that differ from those in your country.

12. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy from time to time. If we make any material changes to this Privacy Policy or the way we use, share, or collect Personal Data, we will notify you by revising the "Effective date" at the top of this Privacy Policy, prominently posting an announcement of the changes on our Service, or sending an email to the email address you most recently provided us (unless we do not have such an email address) prior to the new policy taking effect. Users are bound by any changes to the Privacy Policy when they use our Service after notice of such changes has been communicated. We encourage you to review this Privacy Policy regularly to ensure that you are familiar with Verbstack's current practices.

13. Your Rights

13.1 Correction & Removal

If any of the information that we have about you is incorrect, or you wish to have information (including Personal Data) removed from our records, please contact us at support@verbstack.com. We will respond to such inquiries within forty-five (45) calendar days.

13.2 Marketing

By consenting to this Privacy Policy, you agree to receive marketing materials from us. If Personal Data is collected by us for marketing purposes, we will usually inform you before collecting your data or sharing it for third-party purposes. You can prevent the processing of your Personal Data for these purposes by checking certain boxes on the forms we use to collect your Personal Data. Additionally, if you prefer not to receive marketing messages from us, please let us know by clicking on the unsubscribe link within any marketing message that you receive, or by sending a message to us at support@verbstack.com.

13.3 Your California Rights

For residents of California only.

Section 1798.83 of the California Civil Code requires select businesses to disclose policies relating to the sharing of certain categories of your Personal Data with third parties. If you reside in California and have provided your Personal Data to Verbstack, you may request information about our disclosures of certain categories of Personal Data to third parties for direct marketing purposes. Such requests must be submitted to us at one of the following addresses: support@verbstack.com or

Verbstack
Attn: California Privacy Rights
PO Box 173
Nazareth, PA 18064

Within thirty (30) days of receiving such a request, we will provide a list of the categories of Personal Data disclosed to third parties for third-party direct marketing purposes during the immediately preceding calendar year, along with the names and addresses of those third parties. This request may be made no more than once per calendar year. We reserve our right not to respond to requests submitted other than to the address specified in this Section.

13.4 EU and UK Rights (GDPR)

If you are in the European Union or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR), including the right to access, rectify, restrict processing of, port, and erase your Personal Data, and to object to certain uses. To exercise these rights, contact us at support@verbstack.com. You also have the right to lodge a complaint with your local Data Protection Authority if you believe we have not handled your data correctly.

14. Privacy Inquiries

If you have any questions or concerns about this Privacy Policy or our privacy practices, please contact us as follows:

By email: Privacy Department at support@verbstack.com.

By mail post to:

Verbstack
Attn: Privacy Department
PO Box 173
Nazareth, PA 18064