# Privacy Policy

**Trove Recommerce, Inc. Privacy Policy** _Last updated: May 6, 2026_

## **Introduction**

Trove Recommerce, Inc. (“ **Trove**,” “ **we**,” “ **us**,” or “ **our**”) operates [https://www.trove.com](https://www.trove.com/) (the “ **Site**”). This Privacy & Cookie Policy explains what Personal Data we collect, how we use it, with whom we share it, how long we retain it, your rights under all applicable privacy regulations — including GDPR, CCPA, and CPRA — and how you can exercise those rights.

## **1. Definitions**

**Personal Data:** Any information that identifies or can reasonably identify a natural person.

**Processing:** Any action performed on Personal Data (e.g., collection, storage, use, disclosure).

**Controller:** The entity that determines the purposes and means of Processing Personal Data.

## **2. Sources of Personal Data**

We collect Personal Data:

- **Directly from you** when you submit forms, communicate with us, or transact with our services.
- **Automatically**, through cookies and similar technologies.
- **From third parties**, such as advertising partners or analytics providers.

## **3. Information We Collect**

##### **3.1 Identifiers:**

- Name, company name, email address, phone number, postal address.

##### **3.2 Commercial Information:**

- Purchase history, transaction records, returns, and service interactions.

##### **3.3 Internet/Network Activity:**

- IP address, browser type, device identifiers, pages visited, links clicked, time spent.

##### **3.4 Geolocation Data:**

- Approximate location derived from your IP address.

##### **3.5 Inferences:**

- Preferences and interests inferred from your interactions.

##### **3.6 Sensitive Personal Information:**

- We do not intentionally collect government IDs, precise geolocation, biometric data, or health data unless required for specific transactions or legal compliance.

## **4. How We Use Your Data**

We use your Personal Data for:

- **Service Delivery:** To process orders, fulfill demo/contact requests, deliver products, and communicate with you.
- **Customer Support:** To resolve issues and respond to inquiries.
- **Personalization:** To tailor content and offers to your interests.
- **Marketing:** To send newsletters, product updates, promotions (you may unsubscribe at any time).
- **Analytics & Site Improvement:** To analyze trends, optimize performance, detect and prevent fraud.
- **Legal Obligations:** To comply with applicable laws and enforce our rights.

## **5. Cookies & Tracking Technologies**

We deploy cookies in the following categories. This table reflects cookies observed on the site as of the date of the last policy update.

| **Category** | **Provider** | **Cookie name(s)** | **Purpose** | **Retention** |
| --- | --- | --- | --- | --- |
| **Necessary** | Cloudflare | __cf_bm | Bot management protection. Set across multiple HubSpot-related subdomains including hubapi.com, hubspot.com, hs-scripts.com, hs-analytics.net, hscollectedforms.net, hs-banner.com, hsadspixel.net, hsforms.com, and apollo.io. | 1 hour |
| **Necessary** | Cloudflare | _cfuvid | Tracks users across sessions to maintain session consistency and deliver personalized services via HubSpot infrastructure. | Session |
| **Necessary** | WordPress | wpEmojiSettingsSupports | Checks whether the visitor’s browser supports emoji rendering on WordPress-powered pages. | Session |
| **Analytics** | Google Analytics | _ga, _ga_* | Calculates visitor, session, and campaign data. Stores information anonymously using a randomly generated identifier to recognize unique visitors and track site usage across sessions. | 1 year 1 month |
| **Analytics** | Google Analytics | _gid | Stores information on how visitors use the website. Resets daily and is used to generate an analytics report of site performance. | 1 day |
| **Analytics** | Google Analytics | _gat_UA-* | Throttles the rate of requests sent to Google Analytics servers to limit data collection during high-traffic periods. | 1 minute |
| **Analytics** | HubSpot | __hstc | Main HubSpot visitor tracking cookie. Stores the domain, first-visit timestamp, last-visit timestamp, current-visit timestamp, and session number to track visitor journeys across visits. | 6 months |
| **Analytics** | HubSpot | hubspotutk | Identifies website visitors and is passed to HubSpot on form submission. Used to deduplicate contacts in the HubSpot CRM. | 6 months |
| **Analytics** | HubSpot | __hssrc | Set when HubSpot changes the session cookie. Used to determine whether the visitor has restarted their browser and begun a new session. | Session |
| **Analytics** | HubSpot | __hssc | Tracks HubSpot session data including page view count within a session and session start timestamp, used to maintain session continuity. | 1 hour |
| **Functional** | LinkedIn | lidc | Set by LinkedIn to facilitate data center selection when LinkedIn embedded services (such as share buttons or the Insight Tag) are used on the page. | 1 day |
| **Functional** | LinkedIn | li_gc | Set by LinkedIn to store the visitor’s consent regarding the use of LinkedIn’s non-essential cookies. | 6 months |
| **Advertisement** | LinkedIn | bcookie | Browser identifier cookie set by LinkedIn to track the use of embedded LinkedIn services and measure advertising effectiveness. | 1 year |
| **Other** | Apollo.io | apolloAnonId, _leadgenie_session, X-CSRF-TOKEN | Apollo.io lead intelligence and visitor identification. apolloAnonId stores a persistent anonymous identifier. _leadgenie_session manages the session. X-CSRF-TOKEN provides cross-site request forgery protection. | Persistent / Session |
| **Other** | Apollo.io / Trove | 6675d262ebda27038c71ec4b_eventQueue, 6675d262ebda27038c71ec4b_canTrack | Event queue and tracking consent flag associated with an analytics or tag management integration. Stores pending events and whether tracking has been permitted for the current visitor. | Persistent |

## **6. Data Sharing & Disclosure**

We share Personal Data with:

- **Service Providers:** Vendors providing hosting, analytics, marketing, payment processing, customer support — under confidentiality obligations.
- **Third Parties:** For analytics and marketing, only aggregated or pseudonymized data is shared.
- **Legal Compliance:** When required by law, regulation, or to protect our legal rights.

We do not sell your Personal Data. To opt out of any future “share” activity, please email **privacy@trove.com** with the subject **“Opt Out Request.”**

## **7. Data Retention**

- **Contact & Transaction Data:** Retained as needed to fulfill requests and comply with legal obligations.
- **Analytics Data:** Retained per each provider’s policy (e.g., Google Analytics up to 2 years).

## **8. International Data Transfers**

If we transfer Personal Data outside the EEA, we rely on:

- EU Standard Contractual Clauses (SCCs)
- Adequacy Decisions
- Additional Safeguards (encryption, access controls)

Request SCC copies at **privacy@trove.com**.

## **9. Your Privacy Rights**

##### **9.1 GDPR Rights (EU Residents)**

You have the right to:

- Access & Portability
- Rectify inaccurate data
- Erasure (“Right to be Forgotten”)
- Restrict Processing
- Object to Processing
- Withdraw Consent at any time

**To exercise these rights:** Email **privacy@trove.com** (subject: **“GDPR Request”**).

##### **9.2 California Privacy Rights (CCPA & CPRA)**

California residents have the right to:

- Know what Personal Data we collect, use, share.
- Access or delete Personal Data.
- Correct inaccurate data.
- Limit use of Sensitive Personal Information.
- Opt-out of sale or sharing.
- **Non-Discrimination:** You will not receive different prices or services for exercising your rights.

**To exercise these rights:**

- **Email:** privacy@trove.com
- **Phone:** +1-510-255-0925

Identity verification may be required.

**Response Timelines:**

- CCPA: within 45 days (one possible 45-day extension)
- CPRA: within 30 days (one possible 30-day extension)

##### **Notice of Financial Incentives:**

If we offer discounts or benefits in exchange for your Personal Data, we will provide specific details and request your consent before enrolling you. You may withdraw at any time.

## **10. Security**

We apply administrative, technical, and physical safeguards to protect your Personal Data, including annual SOC 2 Type II audits, encryption, and access controls. For more, visit our [Trust Center](https://trust.trove.com/).

## **11. Children’s Privacy**

Our Site is not intended for children under 16. We do not knowingly collect Personal Data from minors. Please contact us if you believe we have inadvertently done so.

## **12. Accessibility**

If you have a disability and need this policy in an alternative format, please contact us at **privacy@trove.com** or call +1-510-255-0925.

## **13. Changes to This Policy**

We may update this Privacy & Cookie Policy periodically. Updates will be posted here with a revised “Last updated” date. Significant changes may be communicated via email or prominent notice on our Site.

## **14. Contact Us**

For any questions, or to exercise your rights:

- **Email:** privacy@trove.com
- **Phone:** +1-510-255-0925
- **Mail:** Trove Recommerce, Inc.

Attn: Data Protection Officer

2648 International Blvd, Ste 115

Oakland, CA 94601