How this service handles your data

Last updated 3 September 2026

The Resale Llama is a bookkeeping and listing tool for people who sell on more than one marketplace. It is operated as a sole proprietorship based in Texas, United States. This policy describes what personal data the service collects, why, how long it is kept, and who it is shared with. It applies to theresalellama.com and to the data the service obtains from marketplaces and suppliers on an account holder’s behalf.

The short version

Personal data is collected only to run an account holder’s books and listings.
Nothing is ever sold, rented, or shared for advertising.
There is no analytics, no advertising, and no third-party tracking of any kind.
Marketplace data is never used to train artificial intelligence and is never sent to a generative-AI tool.
A buyer’s personal details are removed on request; the financial record of the sale is kept, because tax law requires it.

Who is responsible

The service is operated by an individual trading as The Resale Llama, a sole proprietorship in Texas, United States. For any question about this policy, or to make a request about your data, write to privacy@theresalellama.com.

What is collected

Account holders

An account holder is someone who signs in to run their own books — the operator and, where invited, members of their family. For them the service stores a password held only as a salted PBKDF2 hash and never in readable form, a signed session cookie that keeps them logged in, and the settings needed to compute their tax estimate, such as filing status. No name, postal address, or payment card is required to hold an account.

Data from connected marketplaces

When an account holder connects a store, the service reads that store’s own sales data through the marketplace’s official API, using access the account holder grants and can withdraw. What arrives depends on the marketplace:

eBay: Orders and financial transactions: item title and SKU, quantity, sale price, postage charged, marketplace-collected sales tax, eBay fees, payouts and refunds. Order records also contain the buyer’s eBay username and delivery address, and the original payload is retained for audit.
Poshmark: Poshmark provides no API. Its sales report is generated by the account holder and arrives as a CSV, which is imported. It contains order and payout figures.
Shopify: Products, inventory and orders from the account holder’s own store, including the delivery address needed to fulfil an order.

Data from suppliers

Product catalogues, prices, stock levels and shipping quotes are read from EPROLO, CJdropshipping, AliExpress and Amazon. This is product information and contains no personal data. When an order is placed with a supplier, see who data is shared with.

What is deliberately not collected

No analytics, no advertising identifiers, no tracking pixels, no third-party scripts, no fingerprinting, and no cookies beyond the two functional ones described below. Buyer payment card details are never received, because marketplaces process payment themselves and never pass card data on.

Cookies

Two cookies, both strictly functional. No consent banner, because there is nothing to consent to.

Session: Keeps an account holder signed in. HTTP-only, signed, and readable only by the server.
Authorization: Set for ten minutes while connecting a marketplace, to verify the connection finished in the same browser it started in. Deleted as soon as the connection completes or fails.

Why data is used

Personal data is used to provide the service the account holder asked for, and for nothing else. Concretely: recording sales and fees to produce a ledger; estimating federal self-employment and income tax owed; publishing and updating listings; and passing a delivery address to a supplier so an order can be shipped to the buyer.

For account holders in the United Kingdom or European Economic Area, the lawful bases are performance of a contract for account data and marketplace data, and legitimate interests for keeping the service secure and its records accurate. Where a legal obligation requires records to be retained, that obligation is the basis for keeping them.

Artificial intelligence

Data obtained from eBay or any other marketplace is never used to train an artificial intelligence model, and is never submitted to a generative-AI service. No buyer’s personal details are ever sent to such a service, under any circumstance.

AI is used in two narrow places, and both take their input from elsewhere:

Drafting listings: Listing titles and descriptions are drafted from supplier catalogue information — the product title, description, specifications and photographs published by EPROLO, CJdropshipping or AliExpress. The draft is then published to the marketplace. Nothing read from a marketplace is used to produce it.
Guided setup: An assistant helps a new account holder create their own marketplace and supplier accounts, working from public setup documentation only. It receives no marketplace data, no order data, and no personal details.

How long data is kept

Financial records: Sale amounts, fees, postage and profit are business accounting records. They are kept for at least the period United States tax law requires supporting records to be retained, and are not deleted on request, because they are needed to file an accurate return.
Buyer personal data: The stored order payload containing a buyer’s username and address is retained only while it is needed to fulfil and support that order, and is redacted on a deletion request.
Marketplace access tokens: Deleted immediately when a store is disconnected, or when a marketplace reports the account closed.
Account data: Deleted when the account is closed.

eBay account closures

This service subscribes to eBay’s Marketplace Account Deletion notifications. When eBay reports that a person has closed their eBay account or asked for their data to be deleted, the request is handled automatically and without delay:

The stored eBay payload containing that person’s username and delivery address is erased from every affected order.
If the closed account was a connected selling account, its access tokens are destroyed and the store stops syncing.
The financial figures for those orders remain, with the personal data removed. Those figures are the operator’s own accounting records and are required for tax filing; they no longer identify the person.

Your rights

You may ask what personal data is held about you, ask for it to be corrected, ask for it to be erased, ask for a copy in a portable format, or object to its processing. Write to privacy@theresalellama.com and expect a reply within 30 days. There is no charge, and exercising a right will never result in worse treatment.

Erasure applies to personal data. Where a sale must remain in the accounting record, the personal details are removed from it rather than the record being destroyed. If you are in the United Kingdom or European Economic Area you may also complain to your data protection authority.

Security

Everything is served over HTTPS. Passwords are stored only as salted PBKDF2 hashes. Marketplace and supplier credentials are held server-side and are never sent to a browser, never included in a URL, and never written into an error message or log. Access to a connected store is limited to the narrowest set of permissions the marketplace offers for the task.

International transfers

The service is hosted in the United States. Where an order is fulfilled by a supplier outside the United States, the delivery address is transferred to that supplier’s country for the sole purpose of shipping the parcel.

Children

The service is a business tool and is not directed at children. Accounts are not offered to anyone under 18, and children’s personal data is not knowingly collected.

Changes

If this policy changes, the date at the top changes with it and the current version is always published here. Account holders will be told directly about any change that materially affects how their data is handled.

Questions about any of this: privacy@theresalellama.com