Provider: The Smart Fellows ("TSF," "we," "us," "our") Applies to: the SmartPIM application and the thesmartpim.com marketing site (the "Service") Effective date: 2026-08-24 · Last updated: 2026-08-24
This Policy explains what information we handle and how. SmartPIM is a business-to-business tool. For the data a customer uploads to run its catalog ("Customer Data"), the customer is the controller and TSF is the processor — we handle it on the customer's behalf under our Terms of Service and DPA. For our own site visitors and for the account data of a customer's users, this Policy describes our own practices. SmartPIM is not designed to collect or process end-consumer personal information.
a) Account data (personal). Name, work email, role, and authentication data for the people a customer authorizes to use SmartPIM. Used to sign users in, enforce their role, and support them. b) Customer product data (business data, not consumer PII). SKUs, attributes, product copy, images, pricing/cost, and channel identifiers a customer uploads. c) Connected-channel credentials. Tokens a customer provides to connect Shopify, Amazon, or Walmart, stored server-side and used only to publish/sync that customer's product data at its direction. d) Usage & technical data. Operational server/log data — IP address, browser/device type, timestamps, error events — used for security, troubleshooting, and reliability. This is not third-party analytics or ad-tracking (see §5). e) Marketing-site & contact data. If you email us or use a contact/demo link, the information you provide (name, email, message).
Categories of personal information (CCPA/CPRA notice at collection).
| Statutory category | Collected? | Examples | Purpose | Retention |
|---|---|---|---|---|
| Identifiers | Yes | Name, work email, user ID, IP | Authenticate users; operate/secure Service; respond to inquiries | Account: subscription life + wind-down (§7); contact: 24 months |
| Commercial information | Yes | Subscription/plan, billing contact | Provide and bill the Service | Subscription life + legal retention |
| Internet/network activity | Yes | Log/usage events, error data | Security, reliability, troubleshooting | Rolling operational logs (retention period under review) |
| Sensitive PI — account log-in credentials | Yes | SmartPIM auth credentials; Connected-Channel API tokens | Only to sign in / operate the account and publish at the customer's direction | Life of the account/connection |
| Geolocation (precise), biometric, health, protected-class data | No | — | We do not collect these | — |
Sensitive personal information (SPI). The only SPI we handle is account/Connected-Channel credentials. We use SPI solely to provide the Service and do not use it to infer characteristics or for any purpose that would trigger a "Limit the Use of My Sensitive PI" right; if that ever changes we will offer that choice.
We do not sell personal information, do not "share" it for cross-context behavioral advertising, and do not use Customer Data to train generative AI models.
If a customer uses AI copy generation, the relevant product attributes are sent to our AI subprocessor to generate draft content for that customer. Inputs and outputs are used only to provide the feature and are not used to train the subprocessor's models, per its API terms.
We do not sell your data. We share it only with service providers ("subprocessors") that help us run the Service, each contractually bound to protect it and use it only to provide the Service. By category:
| Service provider / category | Purpose | Data involved |
|---|---|---|
| Cloud hosting, database & site delivery | Runs the app, database, authentication, storage, and delivers the site/app | All Service data; hosted in the USA (region us-east-1); request logs |
| Google Fonts | Delivers web fonts on the site | Visitor IP address (to serve fonts) |
| jsDelivr | Delivers two pinned open-source front-end libraries | No customer data (asset delivery only) |
| Sales channels you connect (e.g., Shopify, Amazon, Walmart) | Publish and sync your product data to the marketplace you choose | Only your product data, and only when you connect that channel |
| AI provider | Generate draft product copy when you use the AI features | Product attributes submitted for generation; not used to train models |
We identify our remaining subprocessors by name in our Data Processing Addendum (provided to customers) and will provide the current named list on request; we bind each subprocessor to protect your data and notify customers of changes. We may also disclose information to comply with law or valid legal process, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice as required).
(These match the Terms of Service §12.5.)
Row-level security isolating each tenant; encryption in transit (HTTPS/TLS) and at rest; least-privilege access and secrets held server-side in a vault (never shipped to the browser); and a written information-security program (Terms of Service §6). If a Security Incident affects a customer's data, we notify the customer without undue delay and no later than 72 hours after confirming it (see the Terms of Service §6.3, which states the same trigger).
Depending on where you live (e.g., under California's CCPA/CPRA and similar laws in Colorado, Connecticut, Virginia, Utah, Texas, and other states), you may have rights to know/access, correct, delete, and receive a portable copy of your personal information, and to be free from discrimination for exercising them.
The Service is hosted in the United States (region us-east-1). If we knowingly serve customers or users in the EEA/UK, transfers rely on an appropriate mechanism (e.g., Standard Contractual Clauses) addressed in the DPA.
The Service is a business tool not directed to children under 16 and does not knowingly collect their personal information. If you believe a child provided us data, contact privacy@thesmartfellows.us and we will delete it.
The Service links to and integrates with third parties (e.g., Connected Channels). Their handling of information is governed by their own privacy policies, not this one.
We will post updates here with a new "Last updated" date and, for material changes, provide additional notice to customers where appropriate. Continued use after the effective date constitutes acceptance.
The Smart Fellows, Ohio, USA (full mailing address available on request) · privacy@thesmartfellows.us
Version 1 · effective August 24, 2026.