Security & Trust

Wandering Merchant AI is designed to minimize unnecessary handling of sensitive information and uses established service providers for functions such as authentication, payments, hosting, and integrations where applicable. The sections below describe what we can verify from the current implementation.

Wandering Merchant AI uses Base44 for user authentication. Sign-in is available with email and password, and Google social login is also supported.

Passwords are handled by the authentication provider and are not stored in readable form by Wandering Merchant AI. Password reset requests are processed through the platform’s authentication system — you can start a reset from the forgot password page.

Payments are processed by Stripe. Wandering Merchant AI does not directly store full payment card details. Card information is handled by Stripe’s checkout and payment infrastructure.

You can read more in Stripe’s privacy policy.

Data in transit. Traffic between your browser and Wandering Merchant AI is served over HTTPS.

Service credentials. API keys and service credentials (such as marketplace and email-provider keys) are stored server-side in the platform’s secret-management system and are not intentionally exposed in public frontend code.

Encryption of stored data at rest is managed by the underlying platform providers. Specific encryption algorithms and at-rest configurations are not separately documented here.

Application data is stored using the current Base44 infrastructure, which provides the database and file storage used by the application. Uploaded product images are stored in platform-managed media storage.

Backup and recovery capabilities are provided according to the platform’s current service configuration. The exact backup frequency, retention period, and point-in-time recovery options are not separately documented on this page.

Wandering Merchant AI connects to marketplaces using one of two methods, depending on whether the marketplace offers a public API. We aim to request only the permissions needed for supported functionality.

For API-based marketplaces (eBay, Etsy, Shopify), connections are established through OAuth and publishing happens server-to-server. For extension-based marketplaces, a browser extension automates form-filling within your own authenticated browser session — Wandering Merchant AI does not receive your marketplace login credentials for these services.

To request deletion of your account or personal data, contact us at cory@wanderingmerchantai.com or use our contact form.

Deletion requests are handled according to the current Privacy Policy and applicable legal or operational retention requirements. Certain records — such as payment records, fraud-prevention records, tax records, or records required to meet legal obligations — may be retained in limited form even after account deletion.

For details about what information we collect, how it is used, and the choices available to you, read our Privacy Policy. The site uses analytics and advertising-measurement cookies (Google Analytics, Google Ads, and Google Tag Manager), which load after page content to avoid slowing the page.

The following service providers process customer data as part of running Wandering Merchant AI:

AI listing generation is performed through the Base44 platform’s integration with large language model providers. Specific model providers are managed by the platform.

If you believe you have found a security issue affecting Wandering Merchant AI, please contact us at cory@wanderingmerchantai.com with enough information for us to investigate. Please do not publicly disclose sensitive account information, credentials, or customer data.

We do not currently operate a formal bug bounty program, response-time SLA, or coordinated disclosure policy.