Security, payments, data: what we do

• Encrypted connections

  Pages and the API only go through HTTPS: a page requested over http is redirected, the API does not answer over http, and browsers remember never to connect any other way.

• Unreadable passwords

  A password is never stored as such, only its irreversible fingerprint (a hash): nobody can read it back, not even us. You can also sign in with a code sent by email, or with Google.

• Each marketplace kept apart

  Each marketplace’s data is partitioned in the database: every query only sees the data of its own marketplace.

• Restricted team access

  Only the people on our team who need to can access your data. Our team console requires two-factor authentication from each of them. A list of sensitive actions, such as suspending an account, granting a period or adjusting credits, also requires a reason and a recent code there, and these actions are recorded in the log.

• Daily backups

  The database is backed up every day, each backup kept for thirty days, with restore to the minute.

• If an incident happens

  For the data we are responsible for, if a breach poses a risk, we notify the CNIL, the French data protection authority, and, where necessary, the people concerned. For your marketplace’s data, which we process on your behalf, we notify you of any breach without undue delay.

• Stripe for online payments

  Your marketplace’s online payments and your subscription’s go through Stripe, PCI DSS certified. Card numbers are handled by Stripe and never reach us.

• Your sales money, in your account

  Your customers’ payments arrive in your own Stripe account, which deducts its fees according to its own pricing.

• Our share, billed separately

  Our share of online sales is never added to the price your customers pay: it is billed to you once a month, on an invoice separate from the subscription.

Beta During the beta, Marketplace Factory’s payments are in test mode and nothing is billed: the subscription and the share of sales will be from the month of the public launch.

• Main hosting in the European Union

  The API, the database and the files run on Amazon Web Services in Stockholm, Sweden; the application is served by Vercel, with its functions in Stockholm. Pages and public photos are delivered by global networks, and some providers are outside the Union (see “Transfers outside the Union”).

• Your data is yours

  “Export my data”, in your account, gives you your listings, orders, customers, payments and messages as spreadsheets, and your photos in an archive, on every plan (on Enterprise, we prepare it on request). If you cancel, export stays open for thirty days after your subscription ends.

• Your customers’ data

  For the buyers and sellers of your marketplace, you are the controller and we are your processor. You are notified by email before any new sub-processor.

• What AI receives

  Our artificial intelligence providers receive what the task needs, for example texts, photos or figures from your activity. Never your passwords or your card numbers.

• Transfers outside the Union

  Some providers process data outside the European Union, notably in the United States. For transfers to the United States, we rely on the European Commission’s standard contractual clauses or on the EU–US Data Privacy Framework. The list of providers and their locations is in the privacy policy.

• Your rights

  Access, rectification, erasure, restriction, portability, objection: write to contact@marketplacefactory.com; you can also lodge a complaint with the CNIL. If you are a buyer or seller on a marketplace, contact it first. You can also request the deletion of your account from your profile.