Privacy Policy

PARTS N MORE INC dba StockMyGoods · Version 1.12 · Last updated 2 November 2026

This policy explains what personal data StockMyGoods handles, why, how long it is kept, and how it is erased. It covers:

SMG Commerce, our service that connects a seller’s own online-marketplace accounts (today eBay, Amazon and Newegg; in future Walmart and BackMarket) to synchronise their orders, inventory and payouts;
SMG Marketplace, our own marketplace, where businesses that hold an SMG account buy from and sell to each other, and where SMG’s warehouse ships the orders;
the SMG Platform account used to sign in to these services, including SMG Cloud.

1. Who we are and how to reach us

PARTS N MORE INC, doing business as StockMyGoods, a corporation at 9602 Eday Dr, Spring, TX 77379, United States, operates the services listed above. In this policy “SMG”, “we” and “us” mean PARTS N MORE INC, and it is the entity responsible for the personal data described below.

For any question about this policy, or to make a request about your personal data, email stockmygoods@gmail.com, or write to the address above.

What this policy does not cover. This policy covers only the services listed above. Our public website stockmygoods.com and our warehouse system, SMG WMS, have their own privacy policy, published on that website.

2. Three different groups of people

SMG handles personal data about three distinct groups, under different responsibilities. The distinction matters, because it determines who you ask to have data erased.

2.1 Our customers — sellers

People and businesses who hold an SMG account. For their data, SMG is the controller: we decide what we collect and why.

2.2 Buyers on other marketplaces (SMG Commerce)

People who bought something from one of our customers on a marketplace such as eBay or Amazon. SMG has no relationship with these buyers and never obtains data directly from them. We receive their order details from the marketplace, on the seller’s behalf and at the seller’s instruction. For this data the seller is the controller and SMG acts as a processor for them. The marketplace itself is a separate controller with its own privacy policy.

2.3 Buyers and recipients on SMG Marketplace

On SMG Marketplace, the buyer is a business that holds an SMG account (section 2.1), and the person who places the order is one of its logins. At checkout we collect the name, address and phone number the order is to be shipped to, which may be those of someone other than the person ordering. Because SMG runs SMG Marketplace and its warehouse ships the orders, SMG is the controller of this data.

3. What we hold

3.1 From our customers

Data	Why
Name, email address and account credentials of the account owner and of each employee or other login given access to the account	To create the logins and sign them in
The name a person adds for themselves under Your name on Account & Access, which they can change or remove at any time	To greet them by it; for SMG’s own staff, it is also shown on SMG’s Staff list
The owner’s name and phone number, the business address, and the tax ID (EIN)	To know who we provide the service to, and to bill and support the business
For two-step sign-in: the authenticator key and recovery codes	So that a password alone cannot open an account
Subscription, plan and entitlement records	To determine what the account can use
Marketplace connection tokens (for example an eBay OAuth refresh token)	To call the marketplace’s API on your behalf, and only for the permissions you granted
Security and audit records of sign-ins (including the IP address and browser type used), marketplace connections and disconnections, and administrative actions	To be able to answer “who changed what, and when”, and to show you sign-ins you don’t recognise
For each phone signed in with the SMG Mobile app: the phone’s make and model, the app version, when it signed in and was last used, and a one-way code made from the number Android gives SMG Mobile on that phone (the number itself is not kept)	To show you which phones are signed in and let you sign them out, and, when the same phone signs in again, to end its older sign-in instead of listing it twice
For a phone on which the person switches on SMG alerts: the push token Google gives SMG Mobile on that phone, kept with that phone’s sign-in and removed when it signs out	To send that phone the alerts it is switched on for (section 5)
Photos a person takes or chooses in the SMG Mobile app for an eBay message or a new eBay listing. The photo’s location, camera and other hidden details are removed on the phone before it is sent	To send the photo to eBay, for that message or listing only
Files and content you upload to SMG Cloud	To store them for you
Photos and videos a person backs up from their own phone with the SMG Mobile app, stored encrypted, with the size and time of each upload and the phone it came from	To keep a private backup of that person’s photos and videos for them
When a login accepts the SMG Marketplace terms: who accepted, their email address, the IP address and browser type used, and the time	To be able to show which terms the business agreed to, and when
For a business that sells on SMG Marketplace: the identifier of its Stripe account. The bank and identity details needed to pay it are entered on Stripe’s own pages and never reach SMG	To pay the seller its sales

3.2 About buyers on other marketplaces (SMG Commerce)

When a seller connects a marketplace account, we retrieve that seller’s orders. An order can contain the buyer’s marketplace username, name, shipping and billing address, and — where the marketplace supplies them — an email address or phone number, along with the items, quantities, amounts, taxes and shipping costs. We keep the marketplace’s original order record alongside our own processed copy, so that a dispute can be settled against exactly what the marketplace sent.

An order can also contain a note the buyer wrote to the seller at checkout. Where the seller chooses to manage their marketplace messages in SMG, we also hold the messages exchanged between the seller and their buyers through the marketplace, including any pictures either side attached, and the pictures the seller sends in replies.

Amazon is different. SMG does not request Amazon’s buyer data and does not store it: an Amazon order in SMG holds the items, quantities, amounts and status, not the buyer’s name, address or contact details. When a seller removes SMG’s access to their store in Amazon Seller Central, SMG can no longer read that store and stops doing so.

Newegg sends the buyer’s name, phone number and shipping address with each order, and an email address that Newegg masks. SMG stores them encrypted (section 6) and uses them only for that seller’s own orders.

3.3 On SMG Marketplace

The ship-to: the recipient’s name, shipping address and phone number, collected on Stripe’s checkout page and passed to us.
Shipping labels the seller uploads, which show the same name and address.
The record of the sale: the buying business’s name, the items, amounts, invoices and credit notes, shipments, returns (with the reason and any note the buyer wrote), and any payment dispute.

Card details are entered on Stripe’s page and never reach SMG. Stripe also asks for an email address at checkout; SMG does not keep it.

4. What we do not do

We do not sell personal data, and we do not share it for advertising, profiling or any cross-context behavioural purpose.
We run no advertising and no third-party analytics or tracking scripts. This page sets no cookies.
We do not use buyer data for our own purposes. It exists in SMG only so that the order can be shipped, returned and reconciled. Within the seller’s business, the seller decides which of their employees see a buyer’s full shipping address and marketplace username. For orders from other marketplaces, SMG’s staff tools do not show buyers’ names, usernames, addresses, notes or messages. For SMG Marketplace orders, SMG’s own warehouse staff see the ship-to, because they pack and ship the order.
We do not request marketplace permissions we do not need. Where a marketplace offers a read-only permission for something we only read, we ask for the read-only one.

5. Who else is involved

SMG runs on hardware we own and operate ourselves. Your data is not held in a third-party public-cloud account. The parties that can nonetheless be involved are:

The marketplaces you connect (eBay, Amazon and Newegg today). They are the source of the order data and have their own privacy policies. When you ship an order from SMG, we send that marketplace the carrier, tracking number and ship date.
Stripe, which processes SMG Marketplace payments, refunds and payouts to sellers. It receives the card and checkout details directly from the buyer and the seller’s bank and identity details directly from the seller. If a buyer’s bank disputes a payment, we send Stripe, for the bank, the evidence of the sale: the buying business’s name, the ship-to name and address, the items, the shipment and its tracking. Stripe has its own privacy policy.
Our wholesale distributor, which ships some SMG Marketplace orders directly to the recipient. For those orders it receives the recipient’s name, shipping address and phone number — nothing else about them — only to deliver the order. Ask us by email and we will tell you who it is.
A transactional email provider, used to send service messages such as sign-in and account notifications. It receives the recipient address and the message.
Google Firebase Cloud Messaging, which delivers SMG Mobile’s alerts to Android phones, such as a new order or a new return. For a phone that has alerts switched on, it receives the phone’s push token and each alert’s short, generic text, such as “New eBay order”. An alert never contains a password, code, link or buyer details. Alerts start switched off on every phone, and can be turned off again in the app or in the phone’s settings. Google has its own privacy policy.
A DNS and content-delivery provider, which handles the network routing of requests to our services.

We do not otherwise disclose personal data, except where we are legally required to.

6. How it is protected

All traffic to our services is encrypted in transit (HTTPS).
Marketplace credentials are encrypted before they reach our database, using AES-256-GCM. The encryption key is held outside the database and is not present in any database backup, so a copy of the database on its own does not yield a working credential.
Credentials are write-only from every direction except the component that calls the marketplace. They are never displayed in the interface, returned by an API, or written to a log.
Buyers’ personal data — names, addresses, phone numbers, email addresses, marketplace usernames, checkout notes and messages — is encrypted inside our database with AES-256-GCM, using a key held outside the database and outside every database backup. The same applies to the SMG Marketplace ship-to and to shipping labels.
Backups are encrypted.
Photos and videos backed up with the SMG Mobile app are encrypted on the person’s own phone before they reach us, with a key that only their backup passphrase unlocks. We do not have the passphrase. We cannot open or preview those photos or videos, and we cannot recover or reset the passphrase: if it is forgotten and the phone is lost, the backed-up photos and videos cannot be recovered by anyone. Only that person can see or delete their phone backups — not their company’s owner, not their colleagues and not SMG staff.
The tax ID (EIN) is encrypted the same way, is shown only to the business’s owner and to SMG staff, and each time it is shown is recorded. Authenticator keys are encrypted, and recovery codes are kept only as a one-way hash, so neither can be read back from the database.
We deliberately store no plain buyer identifier as a lookup column. To be able to find a buyer’s records when we are told to erase them, we store a keyed HMAC of their marketplace identifier rather than a reversible or guessable hash.
No security measure is absolute, and we do not claim otherwise.

7. How long it is kept, and how it is erased

7.1 Customer accounts — 120 days, then purged

When a customer account is deleted, it and its associated data are retained for 120 days so that a deletion can be undone, and are then permanently purged. Marketplace credentials are the exception: they are destroyed immediately on deletion, not at the end of the 120 days. Reconnecting a marketplace after a restore means authorising it again.

A person’s phone backups are deleted 30 days after they leave the company, and are never given to the company. They are also deleted from the company’s account. A video whose upload was not finished is deleted 7 days after the last part of it reached us.

7.2 Buyer data — erased on the marketplace’s instruction

Marketplaces notify us when one of their users exercises a right to erasure. SMG acts on those notices automatically, without waiting for anyone to approve them:

If the person is unknown to us, nothing happens and nothing is recorded about them.
If the person appears as a buyer, every piece of their personal data is removed from our records, across all sellers — names, addresses, email addresses, phone numbers and marketplace identifiers, including inside the original marketplace payload we retained. Their messages with the seller, and the pictures attached to them, are deleted with them. The commercial record of the sale — its date, items, quantities and amounts — survives, because that record belongs to the seller’s business, not to the buyer, and once the above is removed it no longer identifies anybody.
If the person is a seller who has closed their marketplace account, that marketplace connection, its stored credentials and everything synchronised through it are deleted. Their SMG account is not deleted — closing an eBay account is not a request to close an SMG account.

Erasure is a real deletion: rows are removed and values overwritten. There is no hidden “deleted” flag and no archive copy that an administrator could restore.

7.3 SMG Marketplace orders

Shipping labels are deleted 90 days after the order ships (a return label, 90 days after it is issued or the item goes back).
The ship-to — name, address and phone number — is erased 180 days after the order is finished: every part shipped or cancelled, and no refund, return or payment dispute still open. That covers the return windows and the time banks allow for disputing a card payment.
The record of the sale — the buying business’s name, the items, amounts, invoices and credit notes — is kept, because it is the business record and tax record of the sale; once the ship-to is erased it identifies no recipient.

7.4 Backups — up to 35 days

We keep backups so that a failure or an attack cannot destroy our customers’ business records. Data erased today still exists in backups taken before today. Those backups expire so that an erasure has propagated to every copy within 35 days. Restored backups have outstanding erasures re-applied to them.

One deliberate exception: if our backup system detects that production data has been destroyed or tampered with, backup expiry stops until a human has looked at it. In that state the 35 days can be exceeded. We consider a delayed erasure recoverable and a destroyed backup not.

8. If there is a security incident

If a security incident may have exposed your personal data, we will tell you without unreasonable delay and as the law requires. We will also tell the marketplaces and the payment provider whose data is involved, as our agreements with them require — Amazon within 24 hours of our discovering the incident.

9. Your rights

You can ask us to give you a copy of your personal data, correct it, delete it, or restrict what we do with it. Email stockmygoods@gmail.com and we will respond within 30 days.

If you received or ordered something through SMG Marketplace, ask us directly at the address above — SMG holds that data itself.

If you bought on another marketplace (such as eBay), please ask the marketplace. We hold your data only on a seller’s behalf and have no way to verify who you are. eBay’s account-closure process reaches us automatically and is the fastest and most reliable route. You may also contact the seller you bought from. If you contact us directly we will pass the request to the relevant seller.

10. Children

SMG is a business tool. It is not offered to, and not intended for, anyone under 18. We do not knowingly collect personal data from children.

11. Changes to this policy

This page carries a version number and a date at the top. When we make a change that affects what we do with personal data, we will update both and notify account holders by email.