Privacy Policy

Introduction

Green Market Exchange Inc. (“GMX,” “we,” “us,” or “our”) operates https://www.greenmarketexchange.com and related services (the “Services”). GMX provides a technology platform for participating businesses, including manufacturers, brands, retailers, and stores, as well as consumer-facing features. This Privacy Policy explains how we collect, use, disclose, retain, and protect information about individuals who use or visit the Services, including business account users and consumers. It describes currently offered Services; new features may be addressed through updated notices before launch. GMX facilitates marketplace transactions between participants but is not itself the buyer or seller in those transactions.

Who Is GMX For?

GMX is intended for both businesses and consumers. Authorized business users may use GMX to manage product catalogs, listings, inventory, wholesale orders, store relationships, and related operations on behalf of manufacturers, brands, retailers, or stores. Consumers may use available GMX features to discover participating brands, products, and retailers. All individual users must be at least 21 years old. We do not knowingly allow anyone younger than 21 to register or provide personal information. If we discover that we have collected information from an underage individual, we will take appropriate steps to remove it, subject to applicable obligations. Contact info@greenmarketexchange.com if you believe an underage person has provided information.

Information We Collect

Account and identity details. We collect information such as name, date of birth, email address, contact information, credentials, and information needed to maintain accounts and respond to support requests. We store password hashes, not plaintext passwords. Business account details may include organization name, business contact and user-role information, store/brand/manufacturer affiliations, and user membership in more than one organization.

Product listings and inventory information. Business users may provide product names, descriptions, categories, images, strain or other product attributes, batch identifiers, weights, packaging and variant details, prices, inventory quantities, stock availability, listing status, and brand/manufacturer/store associations. GMX may maintain changes to these records and their connections to marketplace orders. Information shown to other businesses or consumers depends on the applicable listing settings, available product features, and user permissions.

Marketplace and transaction details. We collect wholesale and other marketplace order requests, order details and history, prices, quantities, invoices, related business records, and correspondence that participants submit or generate through the Services. Transactions between buyers and sellers are facilitated by GMX; GMX does not currently process those underlying marketplace payments.

Subscription and billing details. GMX uses Authorize.Net for its subscription payments and saved payment methods. We maintain subscription status, billing records and payment-provider references; we do not store full payment card numbers or card security codes on GMX servers.

Technical information. We may collect IP address, device, browser, session and cookie information, page interactions, performance data, error information, and similar usage information through GMX systems and analytics providers.

Communications and uploaded material. We collect messages submitted to GMX, transactional-email information, and images or documents you upload, along with associated metadata. Information users elect to publish on a profile or listing may be visible to other users or visitors, depending on the feature.

Third-Party Integrations

GMX allows business users with appropriate GMX organization permissions to connect supported third-party accounting, inventory, point-of-sale, compliance and other business services (collectively, “Integrations”), subject to the connected provider’s authorization process. If an Integration is enabled, we may receive, send, match, store or synchronize business information necessary to operate its authorized features. Depending on the provider and configuration, this information may include customer and contact details; products or services; invoices and line items; quantities, prices and taxes; payment information and payment status; account associations and mapping identifiers; and related synchronization records. Some Integrations support manual or automatic synchronization and comparison of changes made in the connected service. Where applicable, changes from a connected service are submitted for authorized review rather than automatically modifying GMX marketplace payment records.

We use information obtained from Integrations to provide, maintain, reconcile, support and secure the particular accounting or business functions authorized by the connecting organization. We do not sell Integration-derived information or use it for targeted advertising, unrelated marketing, consumer product discovery, or cross-brand commercial analytics. Access within GMX is subject to organization-based permissions. When Integrations require access credentials or tokens, we use safeguards designed to restrict and protect those credentials, including encryption for currently supported accounting Integration tokens. We do not obtain Integration data on behalf of the connected provider; GMX operates its own Services under this policy.

An authorized user may request disconnection of a supported Integration. When a disconnection is requested, GMX disables further synchronization through GMX for that connection even if the connected provider is temporarily unavailable. Where available, we request revocation of the external authorization. If revocation has not yet been confirmed, GMX may temporarily retain restricted credentials solely to retry or complete revocation, without allowing normal synchronization to resume. Applicable credentials are removed following confirmed completion. Disconnecting does not automatically erase independently maintained GMX transactions or information held by the external provider. GMX handles retained or imported information under the retention and deletion practices described below.

How We Use Information

We use information to create and administer accounts; create, maintain, and display product catalogs and listings; manage inventory, variants, stock availability, and related business records; facilitate wholesale orders, marketplace tools, and notifications; manage subscriptions; provide customer support; authenticate users and prevent misuse; operate authorized third-party Integrations; understand Services performance and improve GMX using information lawfully available for those purposes; comply with applicable requirements; and communicate important service changes. We send transactional account, order, and notification emails. Optional marketing messages include applicable opt-out choices. Information obtained from a connected business Integration is limited to the authorized integration purposes described above and is not repurposed for GMX consumer discovery, unrelated marketing, or cross-brand insights.

When Information Is Shared

We share information as reasonably necessary to provide the Services: with members of a user’s GMX organization according to their assigned permissions; with buyers, sellers, and other authorized counterparties involved in a GMX transaction; with vendors processing information to provide services on our behalf; with connected third-party services as directed by an authorized business user; when required by applicable law or legal process; to address fraud, security, or safety concerns; and in appropriate corporate transactions subject to applicable protections. Product listing information and selected inventory or availability details may be shown to authorized businesses and, where a listing is consumer-visible, to consumers, based on the applicable feature and visibility settings. Nonpublic business inventory and account information is subject to applicable GMX access controls. Membership in multiple GMX organizations does not, by itself, permit one organization to access another organization’s information.

Our service providers currently include Vercel (website hosting, Blob file storage and analytics/performance tools), Railway (backend hosting and MySQL database), Upstash (Redis session and token storage), PostHog (product analytics), Mandrill/Mailchimp Transactional (transactional email), and Authorize.Net (subscriptions/payment methods). Providers process relevant information according to their roles and applicable contractual terms. GMX does not currently use an SMS provider for the Services. We do not sell data obtained through Integrations or make it available to third parties for unrelated purposes.

Cookies and Analytics

We use a browser HttpOnly session-ID cookie to support sign-in and session management. We also use PostHog, Vercel Web Analytics, and Vercel Speed Insights to understand how the Services function and are used. Analytics and related tools may process device or usage data. Browser settings can restrict some cookies, although essential functionality may then be affected. Any additional advertising cookies or third-party tracking introduced later will be addressed in an updated policy and applicable choices.

Storage and Security

GMX uses technical and organizational safeguards intended to protect personal and business information. Passwords are stored as hashes rather than plaintext. Credentials for supported integrations are encrypted at rest and protected through restricted access. Security measures are reviewed and updated as our Services develop.

No system can be guaranteed completely secure. Users should protect their credentials and promptly report suspected unauthorized account access.

Retention and Account Deletion

Individuals may delete their GMX user accounts using available controls or request assistance at info@greenmarketexchange.com. Deleting an individual account does not automatically delete the GMX organizations to which that person belonged, their authorized shared business records, or records needed by other participants. An organization may also be deleted through GMX’s organization-deletion process, subject to verification of the requesting person’s authority. GMX may preserve originally created GMX orders, invoices, line items and other necessary historical business records that have been shared with or relied upon by transaction counterparties, including retailers retaining their invoice copies.

Information imported solely from a third-party Integration is treated differently from independently maintained GMX marketplace records. Upon a verified deletion request, GMX will delete applicable Integration-derived information and related access credentials, subject to legally required or otherwise applicable recordkeeping obligations. Disconnecting an Integration stops further synchronization but does not, by itself, constitute a request to delete every record in GMX. We assess retention according to the type and origin of information, whether it is necessary for a pending transaction, billing, security, fraud prevention, dispute resolution, lawful recordkeeping or operation of a requested feature, and the retention practices of applicable backups. Restricted backup copies may remain until they are cycled out under verified backup procedures, and any restored data must be handled consistently with applicable deletion requests. To request deletion or ask what information remains, contact info@greenmarketexchange.com.

Your Choices and Privacy Requests

You may request access to, correction of, or deletion of information about you, subject to applicable law and legitimate recordkeeping requirements, at info@greenmarketexchange.com. You may unsubscribe from optional marketing emails. Business organization administrators manage business-user permissions and access within their organizations. Users with the applicable permissions may disconnect supported Integrations. Requests to delete Integration-derived information may require confirmation that the requester is authorized to act on behalf of the relevant organization or connected account. We may reasonably verify identity and authority before fulfilling requests.

State Privacy Rights

Residents of some states may have additional rights under applicable privacy laws, depending on where they reside and whether the relevant law applies to GMX. We will honor applicable rights and provide required disclosures or mechanisms as the Services and legal obligations evolve. For questions or requests, contact info@greenmarketexchange.com.

Changes to This Policy

We may update this Privacy Policy to reflect changes to the Services, providers, practices, or legal requirements. The revised date will appear at the top. We will provide additional notice of material changes where required by law.

Contact

Green Market Exchange Inc. Maine, United States Website: https://www.greenmarketexchange.com Privacy inquiries: info@greenmarketexchange.com