Privacy Policy

Offramp Tech LLC(“Offramp”, “we”, “us”) operates The Exchange marketplace from 422 Leonard St NW Ste 301, Grand Rapids, MI 49504. We are the controller of personal information described in this policy.

Account information. When an account is created we collect your email address, name, organization name, and role (school, buyer, or admin). This information is provided by the person inviting you to the Platform.

Transaction information. We record every bid, ask, trade, order, and shipment on the Platform, including quantities, prices, fulfillment status, tracking numbers, and settlement amounts.

Uploaded documents. We store documents you upload (verification photos, W-9 forms, resale exemption certificates, invoices) in encrypted object storage operated by our hosting partner Supabase.

Technical information. Standard server logs (IP address, user agent, timestamp, request path) are retained for operational and security purposes for up to 90 days.

Email communications. We retain a record of transactional emails sent through the Platform (trade notifications, invoices, magic-link sign-in emails).

We use the information described above to:

• Operate the marketplace and complete transactions
• Authenticate sign-in via magic-link email
• Generate invoices, certificates of data destruction, and shipping documents
• Provide customer support and resolve disputes between buyers and sellers
• Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations and respond to lawful requests

We do not sell personal information, and we do not share it with advertisers or marketing partners.

We share information only as needed to operate the Platform:

• Counterparty disclosure. Buyers and sellers stay anonymous to each other by default. We may disclose identifying information to a counterparty only as required for shipping or dispute resolution.
• Service providers. We use a small set of vendors to run the Platform: Netlify (hosting), Supabase (database + storage), Resend (transactional email), and Stripe (payment processing, as it comes online). Each provider acts as a processor under our instructions.
• Compliance. We may disclose information in response to a valid legal request, court order, or to protect the rights, safety, or property of Offramp or others.

The Platform uses a single first-party cookie (ox_session) to keep you signed in. We do not use third-party advertising cookies, retargeting pixels, or session-replay tools. We do not implement any cross-site tracking.

We retain transaction information for as long as your account is active, plus any period required by applicable tax, accounting, or legal-records rules (generally seven years). Server logs are retained for 90 days. Uploaded compliance documents (W-9, resale certificates) are retained for the life of the account and 4 years after closure, in line with IRS guidance.

We use industry-standard safeguards: HTTPS in transit, encrypted object storage at rest, role-based access control for administrative functions, and passwordless sign-in via magic-link email. We never collect or store passwords.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at billing@offramptech.com.

You may request access to, correction of, or deletion of your personal information by contacting us at billing@offramptech.com. Where required by California, Virginia, Colorado, or other applicable state privacy laws, we honor verifiable consumer requests at no charge.

Deletion requests will be honored within 30 days, except where we are required to retain information by law (for example, completed transaction records for tax purposes).

The Platform is a B2B marketplace and is not directed at children under 13. We do not knowingly collect information from children. If you believe we have collected information from a child, contact us and we will delete it.

The Platform is operated from the United States and processes data in the United States. By using the Platform you consent to the transfer of your information to the United States, which may have different data-protection rules than your country.

We may update this policy from time to time. Material changes will be communicated by email and reflected by the updated “Last updated” date at the top of this page.

Privacy questions or rights requests: billing@offramptech.com