PrimeStar HQ LLC ("PrimeStar", "we", "us") runs a multi-supplier commerce platform that lets businesses manage product listings, inventory, pricing and orders across marketplaces such as Amazon, eBay and Shopify, and sell to government agencies.
This policy explains what personal information we hold, why, who we share it with, and the choices you have. It covers the PrimeStar platform at primestar.dev-build.in and the website at primestarhq.com.
- Contact: privacy@primestarhq.com
- Postal address: 2108 N St #16764, Sacramento, CA 95816, United States
1. Who this policy is about
PrimeStar is a business tool, not a consumer app. Most people whose information we hold fall into one of these groups:
- Account holders — suppliers, resellers, value-added resellers, manufacturers and government buyers who sign in to the platform, and the colleagues they invite.
- Buyers — people who place an order that reaches us from a connected marketplace or inventory system. They do not have PrimeStar accounts; we receive their details so the order can be fulfilled.
- Website visitors — anyone browsing primestarhq.com.
2. Information we collect
From account holders
| What | Examples |
|---|---|
| Account details | Name, work email, password (stored only as a cryptographic hash), role, sign-in history |
| Security | Two-factor authentication secret and backup codes, failed sign-in attempts, session records |
| Business registration | Company and legal name, trading name, business type, address, phone, website, EIN or tax ID, DUNS number, state of registration, uploaded documents (for example a certificate of incorporation or resale certificate) |
| Banking | Bank routing number and the last four digits of the account, used to pay you. We do not hold full account numbers |
| Government accounts | UEI, CAGE code, SAM.gov registration status and exclusion record, procurement position, clearance level and identity-proofing records |
| Commercial data | Products, prices, costs, stock, feeds, orders, invoices, credit terms and payouts |
| Connections | Access tokens for the marketplace and inventory accounts you connect, always stored encrypted |
| Support and AI | Messages you send to our built-in assistant, and support correspondence |
From buyers (through your connected systems)
Name, email address, shipping address, order contents, order value and tracking details. This reaches us from your marketplace or inventory system so the order can be processed, fulfilled and paid out.
Collected automatically
IP address, browser and device information, pages used, and timestamps. We keep a tamper-evident record of significant actions (who changed what, and when) for security and compliance.
We do not collect
We do not ask for or store full payment card numbers, government-issued identity documents for individuals, biometric data, or any special-category data such as health or political information.
3. Where the information comes from
- Directly from you, when you register, complete onboarding or use the platform.
- From systems you choose to connect — Cin7, Shopify, Amazon, eBay — which send us product, inventory and order data on your behalf.
- From SAM.gov, when a supplier or agency asks us to verify a UEI. SAM.gov is a public US government registry.
4. Why we use it, and our legal basis
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Providing the platform: accounts, listings, orders, invoices, payouts | Performance of a contract |
| Publishing your products to the marketplaces you connect | Performance of a contract |
| Taking payment and paying suppliers | Performance of a contract; legal obligation |
| Verifying businesses, including SAM.gov checks and sanctions screening | Legal obligation; legitimate interests in preventing fraud |
| Keeping the service secure, investigating misuse, keeping audit records | Legitimate interests; legal obligation |
| Support, service notifications and essential emails | Performance of a contract |
| Improving the service and its AI features | Legitimate interests |
| Marketing emails, where we send them | Consent — withdrawable at any time |
5. Who we share it with
We do not sell personal information, and we never have. We share it only with the companies that make the service work:
| Who | What they receive | Why |
|---|---|---|
| Amazon, eBay, Shopify | Product, price, stock and order data for the accounts you connect | To publish and manage your listings |
| Cin7 | Product, inventory, order and purchase data | Inventory and ERP synchronisation |
| Stripe | Payment and customer billing details | Card, wallet and subscription payments |
| PayPal | Payment details | PayPal payments |
| ShipStation | Shipment and tracking details | Shipping and tracking, where enabled |
| Microsoft Azure (OpenAI and Speech) | Product text and assistant messages | Automatic categorisation and the voice assistant |
| SAM.gov (US government) | The UEI being verified | Verifying federal registration and exclusions |
| Google (reCAPTCHA) | Technical signals from sign-up forms | Preventing automated abuse |
| Our hosting and email providers | Data stored and messages sent | Running the service |
We may also disclose information where the law requires it, to enforce our terms, or as part of a merger or sale of the business — in which case we will tell you first.
6. International transfers
The platform is hosted in the United States. If you are in the UK, EU or another region with transfer rules, your information will be transferred to and processed in the US. Where required, we rely on Standard Contractual Clauses or an equivalent safeguard with the providers above.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and profile | While your account is active, then 12 months |
| Orders, invoices, tax and payout records | 5 years, to meet accounting and tax rules |
| Audit trail of significant actions | 5 years. These records are write-once and cannot be edited, including by us |
| Government contract records | 5 years, or 3 years after final payment if that is later, as federal procurement rules require |
| Marketplace access tokens | Until you disconnect the account, or the token expires |
| Failed sign-in records | 90 days |
| Assistant conversations | 30 days |
When you ask us to erase your data, we delete or irreversibly anonymise what we hold, except the records above that we are legally required to keep. We will tell you what was kept and why.
8. Your rights
Wherever you live, you can:
- See and export your data. The platform has a built-in export — Settings → Privacy — which produces a machine-readable file of the personal data held about you.
- Ask us to delete it. Also in Settings → Privacy. Deletion requests are reviewed against the retention rules above.
- Correct it. Most details can be edited directly; ask us for anything you cannot change.
- Opt out of marketing. Every marketing email has an unsubscribe link, and you can set your preferences in the platform. Service emails, such as security notices, cannot be switched off while your account is open.
If you are in the UK or EU, you also have the right to restrict or object to processing, to data portability, and to complain to your data protection authority — in the UK, the Information Commissioner's Office.
If you are in California, you have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not process sensitive personal information for inferring characteristics.
To exercise any right, use the tools in the platform or write to privacy@primestarhq.com. We respond within 30 days, or 45 days in California, and will tell you if we need longer.
9. How we protect it
- Connection credentials, marketplace tokens and other secrets are encrypted at rest with AES-256.
- All traffic is encrypted in transit with TLS.
- Passwords are stored only as salted hashes; nobody at PrimeStar can read them.
- Two-factor authentication is available to every account.
- Sessions end automatically after 30 minutes of inactivity.
- Access is role-based, and every significant action is written to a tamper-evident audit trail.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant regulator as the law requires.
10. Cookies and browser storage
The platform uses one cookie: a short-lived, essential cookie that ties a government agency single-sign-on attempt to the browser that started it. It carries no tracking information.
Your sign-in session is held in your browser's local storage, not a cookie, and is cleared when you sign out. Google reCAPTCHA and Google Fonts may set their own cookies when you use our sign-up forms; those are governed by Google's privacy policy.
We do not use advertising or cross-site tracking cookies.
11. Children
PrimeStar is for business use and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
12. Changes to this policy
If we make a material change we will update the date at the top and notify account holders by email or in the platform before it takes effect.
13. Contact us
- Email: privacy@primestarhq.com
- Post: PrimeStar HQ LLC, 2108 N St #16764, Sacramento, CA 95816, United States