Privacy

> **PLACEHOLDER — NOT YET REVIEWED BY COUNSEL.** Drafted from the internal brief so the page has > shape and the footer has a destination. Replace before launch. # Privacy Policy ICP, Inc., doing business as SupplyPop ("ICP, Inc. dba SupplyPop", "we", "us"), is the controller of the personal information described here. SupplyPop is a trade name of ICP, Inc. **What we collect.** Account and contact details; the address we deliver to; orders and order history; professional license numbers and any license documents you upload; support messages; and payment tokens. **We never hold your card number** — Stripe does. We also collect basic device and usage information needed to run the site securely. **Why we use it.** To take and fulfill orders; to review a professional license before a restricted item ships; to calculate tax; to provide support; to detect fraud and secure the service; to meet our legal obligations; and — separately, and only with your consent — to send marketing. **Our basis for using it.** Performing our contract with you; our legitimate interest in running and securing the store; complying with law; and your consent where we ask for it. Where consent is the basis you can withdraw it at any time. **License review is done by a person.** A member of staff opens and reads the license document you upload. It is used only to decide whether a restricted item may ship to you, and it is not used for marketing or profiling. **Who we share it with.** Our fulfillment partner, to pick and ship your order; Stripe, to take payment; HubSpot, for marketing where you have consented; and a tax service, to calculate tax. We may disclose information where the law requires, and to a successor if the business is transferred. **We do not sell personal information, and we do not share it for cross-context behavioral advertising.** **How long we keep it.** Order records for the period tax and commercial law require. License records for the regulatory retention period. Marketing contact details until you withdraw consent. Support messages for as long as needed to resolve and evidence the matter. **Your rights.** You can ask for a copy of your data, ask us to correct it, or ask us to erase it, from your account. **We will decline erasure while an order is open or a line is held for license review** — we need the record to complete or cancel it — and will act once those close. You will not be treated differently for exercising a right. **Children.** The store is not intended for anyone under 18 and we do not knowingly collect their information. **Where your data is held.** In the United States. If we ever transfer it elsewhere we will use a lawful transfer mechanism. **Automated decisions.** We do not make decisions about you by automated means alone. A license review is always made by a person. **Email and text messages.** Transactional messages about your orders are separate from marketing. If you reply STOP to a text we suppress **both**, by design, so order updates by text will stop as well. You can re-enable them in your account. **Security.** Access to personal data is restricted by role and logged. No system is perfectly secure, and we will tell you and any regulator if a breach requires it. **Changes.** We version this policy and will tell you before a material change takes effect. **Contact.** support@supplypop.com.