1. Who is responsible and what this notice covers
William Zun Park, doing business as Cossad, is responsible for personal information it processes to operate Cossad. Contact info@cossad.com or write to Lucent33, 37-34 33rd St, Long Island City, NY 11101, USA. Customer support is available at info@cossad.com and the Customer Support page.
This notice covers visitors, applicants, business representatives, Buyers, Sellers, and people whose contact details are provided for a transaction. Business contact information can still be personal information. A separate business, carrier, identity provider, or payment provider may be independently responsible for its own processing. Our role under any particular privacy law depends on the processing, not simply the marketplace label.
An account or feature may not be available in every country. Public access to the website is not a promise that trade, banking, or shipping is supported globally. Mandatory privacy rights may nevertheless apply to a visitor or representative. This notice is not a blanket consent request. Optional marketing, recommendations, bank connections, and tracking use their own choices where relevant.
2. Information we collect
Account and authentication. Name, email, verification state, membership and business role, contact phone details when provided, profile image when provided, sign-in/session identifiers, IP address, browser or device information, authentication-provider references, and security/rate-limit records. If you use password sign-in, the authentication system maintains password-verification information. If you choose supported Google or Apple sign-in, we receive the profile and authorization information needed for that choice; connecting a provider does not automatically authorize access to a business.
Business applications. Legal and trading names, activity type, country/city and any supplied business address, website or registration reference, representative name and title, contact details, product categories, estimated trading activity, Buyer purchase purpose, Seller inventory readiness, ownership or authorization explanation, inventory location, packaging type, declarations, revisions, and review notes. Historical records or optional profile fields may include a provided gender selection. We do not require gender to determine financial eligibility. Business registration and other uploaded evidence may contain personal information about representatives or owners.
Inventory and commercial activity. Listings, descriptions, photos, SKUs, quantities, condition, origin, warehouse locations, prices, offers, negotiations, accepted orders, inventory reservations, and business reporting. These records can identify representatives or contain contact details. Public or invited listings are shown to their intended audience. Private registration documents are not intended to become public listing content.
Order and fulfillment details. Buyer-confirmed name, company, email, phone, billing/shipping addresses, dispatch contacts and addresses, package size/weight, shipment instructions, quotes, chosen carrier/service, tracking, pickup confirmations, delivery and inspection records, and evidence of a delivery exception. Address verification may be performed by our shipping service provider.
Payments, payouts, refunds, and accounting. Transaction amounts, currencies, contracted fees, tax/shipping components, payment/customer/account and payout identifiers, verification and capability status, bank name and masked account details where supplied, payment-method brand/last digits/expiry where shown, saved-card consent records, payout schedules, refund/reversal/dispute details, settlement batches, holds, and financial/audit history. Cossad's payment forms are designed so that full card numbers and security codes are collected by Stripe, not stored as raw card fields in our application database.
Support and evidence. Inquiries, replies, feedback, report reasons, attachments, Admin decisions, return authorizations, return tracking, receipt/inspection evidence, and communication/audit timestamps. Do not upload unnecessary identity numbers, passwords, medical details, or other unrelated sensitive information. We cannot promise an upload never contains sensitive information; we handle information actually submitted according to its nature and applicable obligations.
Optional recommendations and email preferences. Where you enable personalized recommendations, we record eligible product-view interests linked to your account/business, a bounded view count, and recent-view timestamps, and use them to select relevant inventory. Weekly recommendations have a separate preference. The application records preference versions and consent times. Switching personalization off removes the related interest records through the preference function; this does not delete necessary order or audit records.
Technical and operational information. Requests, error/security events, authentication and authorization outcomes, browser/device identifiers, delivery status of service emails, and information needed to maintain, troubleshoot, and secure the Services. Cookies and browser storage are explained in the Cookie Notice. We do not describe a server-side recommendation record as merely a cookie.
3. Sources and collection points
Information comes from you; representatives authorized for your business; the other party to your transaction where necessary; payment, identity, shipping, and email providers; and the operation of the Services. We may consult appropriate public business information for verification and investigate a complaint using lawfully available evidence. We do not claim that publicly available information is exempt from every privacy obligation.
If an optional inventory integration is offered and you enable it, we will identify the integration and requested permissions at connection. Inventory/product identifiers, stock locations and quantities, relevant sales observations, and authorization credentials may be processed within those permissions. The existence of integration code does not mean an inactive integration is collecting data. Do not upload a store's entire customer list or unrelated personal data into inventory CSV files.
4. Why we use information
We use appropriate information to establish accounts and memberships; verify business applications and selling authority; present inventory and process offers; create and administer orders; coordinate authorized payments, refunds, returns, shipping and payouts; send necessary account and transaction messages; provide support; investigate fraud, misuse and safety issues; maintain reliable services and financial records; satisfy legal, tax and provider duties; resolve disputes; and protect rights and security.
Optional recommendations and marketing use the preferences described above, not an inference that accepting Terms means agreeing to every promotion. Inventory recommendations may use category, product text, authorized viewing interests, and operational sales information. They are not a guarantee of value or a credit report. Automated validation and risk controls can restrict a feature, but you may contact support about a suspected error; we do not promise every restriction can be overridden.
Where a law requires a legal basis, relevant bases include steps requested by you or performance of a contract with an individual; legitimate interests in operating and securing a business marketplace, subject to the required assessment and balancing; compliance with a legal obligation; and consent for processing that requires it. A contract with a company is not automatically a contractual legal basis for all processing about its employees. We do not use “legitimate interests” to override a legal consent requirement.
5. Stripe, bank connection, and identity information
Stripe-hosted or official Stripe components collect information required for payments, connected accounts, identity/business verification, and bank registration. Stripe, Link, Financial Connections, and a connected financial institution may process additional identity, account-owner, bank, device, authentication, and financial information under the specific screen you choose and their applicable notices. The permissions in that flow matter; linking a payout account is not blanket permission for Cossad to read all of your bank transactions or debit your bank.
Cossad receives account references, masked bank/payment details where supplied, verification requirements and status, and transaction/settlement results needed to operate its services. Cossad may submit accurate business details you provided to reduce repeated entry. We do not ask you to send bank login credentials, card security codes, or Stripe authentication codes to Cossad staff. Closing a Cossad account does not necessarily close an independent Stripe or Link account or delete information those providers must retain.
6. Who receives information
Other transaction participants. We share the information reasonably necessary for an authorized transaction, fulfillment, or issue review, such as business identity, ordered goods, delivery contact/address, and relevant case information. We do not give every marketplace participant access to your private application or bank data. Business administrators may access information permitted by their role; some support inquiries are scoped to the submitting member rather than every coworker.
Service and infrastructure providers. Hosting and operations providers, database/storage and backup providers, authentication services, email providers, Stripe, EasyPost, and the selected carrier receive information needed for their functions. The reviewed service architecture uses Vercel-hosted application infrastructure and PostgreSQL through Prisma-related infrastructure. Payment and carrier providers may also act independently for their own legal, security, fraud, and operational purposes. We limit access and impose appropriate terms where we control the relationship; we do not imply every provider is solely our processor.
Professional and legal recipients. Advisers, insurers, auditors, regulators, law enforcement, courts, and other recipients may receive information when reasonably necessary and legally justified for advice, claims, compulsory requests, investigations, or protection of rights. We assess the validity and scope of demands rather than treating any informal request as authority.
Business changes and directed disclosure. Relevant information may be transferred in a genuine merger, financing diligence, acquisition, insolvency, or reorganization with appropriate confidentiality and legal safeguards. We also share information at your direction or with a valid separate permission. A material new use remains subject to applicable notice and consent requirements.
Our launch policy is not to sell personal information for money or use it for third-party cross-context behavioral advertising. We do not treat ordinary service-provider processing or a transaction you request as permission to advertise across unrelated businesses. Before introducing any activity legally classified as a sale, sharing for behavioral advertising, or targeted advertising, we must assess the law, update the disclosures, and provide required opt-out or consent mechanisms before it begins.
7. Cookies, preferences, and marketing
Necessary cookies support authentication, security, and the selected business workspace. Optional browser technologies, if introduced, must be identified and controlled as described in the Cookie Notice. Browser deletion of cookies does not itself erase records already held in the account or database.
You can manage available inventory-alert and recommendation preferences in account settings. Marketing messages must provide a working unsubscribe mechanism, and requests are honored within applicable legal deadlines. Service, security, order, refund, and payout messages may still be sent when needed even if marketing is declined. Adding promotional content to a service message does not exempt that message from applicable marketing rules.
For browser Do Not Track signals, the reviewed implementation does not implement a separate DNT-based preference. DNT is distinct from legally recognized opt-out preference signals such as Global Privacy Control. Where an applicable law requires honoring such a signal, we must apply it to covered sale/sharing or targeted-advertising activity without requiring unnecessary identity information. We will not represent a nonworking signal handler or preference button as a functioning choice.
8. Retention and account closure
We retain information for the purposes described, considering the type and sensitivity of information, the duration of the relationship, an unresolved transaction, tax/accounting and legal retention rules, fraud prevention, disputes, and provider obligations. Retention is not unlimited simply because storage is inexpensive. Where no longer necessary and not subject to an applicable exception, information is deleted or appropriately de-identified under the adopted retention process.
The account system has a self-service closure/deletion flow for eligible accounts. It can require recent authentication, closure of saved-card profiles, resolution of active transactions, or management of shared business membership. Required transaction snapshots, accounting, and immutable audit records may remain after ordinary identity, uploads, and untraded inventory data are removed. Records retained by counterparties or providers and protected backups are not necessarily erased by the same application operation.
A shared business account cannot authorize deletion of every coworker's or counterparty's records. Nevertheless, a blocked self-service button is not a rejection of every statutory privacy request. Contact us for an individual assessment, including appropriate redaction, access restriction, or deletion of information not needed for the surviving purpose. Any restriction is limited to the information and legal basis that justify it.
We do not promise that all information disappears immediately at account closure, that a recommendation lookback period is a deletion deadline, or that every backup is erased on the same day. Backup retention, restore controls, and the handling of deleted information after a restore form part of the retention process.
9. Security
We use safeguards appropriate to our activities, such as authentication, role/organization access checks, controlled service-provider credentials, and protections for financial actions and records. No website or transmission can be guaranteed completely secure. This statement is not a waiver of our obligation to use legally required safeguards, investigate incidents, and provide notifications where required. Report a suspected security issue through support without sending passwords or usable financial credentials.
10. Rights and requests
Depending on the law applicable to you and to Cossad, you may have rights to know/access information and disclosures, obtain a portable copy, correct inaccuracies, request deletion, restrict or object to processing, withdraw consent, opt out of certain processing, or appeal a denied request. Some laws provide specific rights for sensitive information, authorized agents, and freedom from unlawful discrimination. Availability and exceptions depend on the actual legal requirements, not on whether you call yourself a business user.
Send a request to info@cossad.com or by post to the operator address above. The route must be available even if you cannot log in. Explain the request and information reasonably needed to locate your records; do not send an unredacted ID unless we securely request necessary verification. We verify proportionately and explain any additional information needed. An authorized agent may be asked for proof of authority, and identity verification may still be appropriate.
We respond within the period required by applicable law, notify you of permitted extensions, explain a material denial or exception where required, and provide an available appeal route. You may request an internal review by replying “Privacy appeal”; this does not replace an applicable statutory appeal or complaint mechanism. You may complain to your relevant regulator. We do not charge except where applicable law permits a disclosed, justified fee.
Where the California Consumer Privacy Act applies, the relevant categories can include identifiers; commercial information; internet/electronic activity; professional or employment-related information; submitted records or images; related inferences such as inventory interests; and sensitive information such as account credentials or information contained in verification documents. Sources, purposes, recipients, and retention criteria are described above. Historical business-to-business status is not a blanket exemption. If required, we provide a Notice at Collection before collection and legally required opt-out/limit-use mechanisms rather than treating this paragraph alone as compliance.
Where European, UK, or another jurisdiction's data law applies, we assess territorial scope, the appropriate controller/processor roles, legal bases, rights, local representation requirements, and lawful transfer safeguards. We do not claim a representative, adequacy certification, or contractual transfer safeguard that has not actually been put in place. Expansion into a new regulated market requires that assessment before the new processing begins.
11. Location, children, and updates
Information may be processed where Cossad and its authorized providers operate, including the United States. We do not promise that all information stays in one region or that every provider follows the same retention rule. Where transfers are regulated, required safeguards must be implemented and further information is available on request.
The marketplace is intended for adults acting for businesses and is not directed to children. Do not submit a child's data unless specifically necessary and lawfully authorized for a legitimate issue, and contact us about suspected inappropriate collection. We will assess and remove or restrict such information as required.
We publish the current effective date and retain prior versions as appropriate. Material changes are communicated through a suitable website, account, or direct notice before the changed processing where required. New consent is obtained when the law requires it. For questions or requests, use info@cossad.com; for operational support use info@cossad.com.