Effective date: May 3, 2026
This Privacy Policy describes how Turtles.com Inc. and its parents, subsidiaries, and Affiliates (collectively, "Turtles," "we," "us," or "our") collect, use, share, and protect personal information when you visit our websites; create, maintain, or manage an account; build, configure, or operate a marketplace; list, sell, or fulfill goods or services as a brand or merchant; shop on or interact with a Turtles-powered marketplace; communicate with us; or otherwise use any Turtles product, service, application, or website (collectively, the "Service").
This Policy is incorporated into and forms part of our Terms of Use and, where applicable, the Marketplace Service Agreement ("MSA") and the Data Processing Agreement. Capitalized terms not defined here have the meaning given in those documents.
This Policy applies to personal information processed by Turtles as a business under U.S. state privacy laws (including the California Consumer Privacy Act as amended by the California Privacy Rights Act, the "CCPA," and other comprehensive state privacy laws).
The Service is intended for users in the United States. Turtles, our infrastructure, and our personnel are located in the United States. If you access the Service from outside the United States, you do so at your own initiative, and you acknowledge that your information will be transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction.
When Operators or Sellers use the Service to process personal information of Shoppers, employees, or other end users, those Operators or Sellers act as the business (or "controller") of that information, and Turtles acts as their service provider (or "contractor"). In those cases, the Operator's or Seller's privacy notice — not this Policy — governs the personal information they collect, and our processing is governed by our Data Processing Agreement. This Policy still applies to personal information that we collect from those individuals when they interact directly with Turtles' own properties or as account holders of Turtles services.
This Policy does not cover the practices of third-party services that may be linked to or integrated with the Service.
We collect personal information from three sources: (i) information you give us; (ii) information we generate or collect automatically; and (iii) information we receive from third parties. The categories below correspond to the categories described in the CCPA (Cal. Civ. Code § 1798.140) and analogous categories in other state laws.
We use personal information for the following purposes:
We share personal information in the following circumstances:
We share personal information with vendors who process it on our behalf and under written agreements that restrict their use. Categories include cloud infrastructure (e.g., Amazon Web Services, Google Cloud), payments and disbursement (e.g., Stripe, Adyen), identity verification, fraud detection, communications and email, analytics, customer support, mapping and shipping, advertising measurement, and professional advisors (auditors, accountants, attorneys).
To facilitate a Marketplace transaction, we may share order, fulfillment, and contact information with the relevant Operator and Seller (and, where applicable, shipping carriers, manufacturers, or service providers). After such sharing, that party becomes an independent controller of the data with respect to its own purposes.
We share personal information among the Turtles Affiliates listed in Section 1 of the Terms of Use, where doing so is consistent with this Policy and Applicable Law.
We may disclose personal information when we have a good-faith belief that disclosure is necessary or appropriate to: (a) comply with Applicable Law, regulation, legal process, or governmental request; (b) enforce or apply the Terms of Use, our policies, or other agreements; (c) protect the rights, property, or safety of Turtles, our users, or others; or (d) detect, prevent, or otherwise address fraud, security, or technical issues. Where permitted by law, we will provide reasonable advance notice to affected individuals of demands for their information.
We may transfer personal information in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction. We will provide notice and choices where required by Applicable Law.
We share personal information with other parties where you direct us to do so or with your consent.
Turtles does not "sell" personal information for monetary consideration. Some of our analytics and advertising activities may, however, qualify as a "sale" or "sharing" (for cross-context behavioral advertising) under certain U.S. state laws. We honor opt-outs as described in Section 9.
We and our partners use cookies, pixels, SDKs, and similar technologies to operate, analyze, and personalize the Service and to measure advertising. See our Cookie Policy for details and your choices, including how to honor Global Privacy Control (GPC) and similar signals where required by law.
We retain personal information for as long as necessary to deliver the Service, fulfill the purposes described in this Policy, or as required by Applicable Law. Retention periods vary by data category and use case. When we no longer need personal information, we delete, anonymize, or aggregate it.
We implement reasonable and appropriate technical, organizational, and administrative safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. See our Security Policy. No system is perfectly secure; we cannot guarantee the security of personal information, and you use the Service at your own risk.
The Service is operated from the United States. Customer Personal Data is hosted with U.S.-based cloud infrastructure providers and processed by Turtles personnel and service providers in the United States. We may use service providers that operate in or transfer data to other countries; where we do, we rely on contractual data-protection terms with those providers.
The Service is not directed to users outside the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.
Subject to verification and certain exceptions, residents of California, Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Iowa, Delaware, New Jersey, New Hampshire, Maryland, Kentucky, Minnesota, Rhode Island, Indiana, and Tennessee, and residents of other states with applicable comprehensive privacy laws, may have the rights below. We will not discriminate or retaliate against you for exercising these rights.
You can submit requests by emailing privacy@turtles.com.
We will verify your identity using information already on file. Authorized agents may submit requests on your behalf with written authorization or a power of attorney that complies with Applicable Law.
We will respond within the time periods required by Applicable Law (generally forty-five (45) days, with one extension where reasonably necessary).
You have the right to appeal our denial of a privacy request where required by law (including in Virginia, Colorado, Connecticut, Texas, Montana, Oregon, Delaware, Tennessee, Indiana, Iowa, Kentucky, Minnesota, Maryland, Nebraska, New Hampshire, New Jersey, and Rhode Island). To appeal, reply to the response email or contact privacy@turtles.com with "Appeal" in the subject line.
We honor the Global Privacy Control (GPC) and similar opt-out preference signals as a request to opt out of "sale" and "sharing" of personal information for residents of states whose laws require recognition. Where the signal is associated with an authenticated user, we apply the choice to that user; otherwise, we apply it to the browser or device.
This Section supplements the foregoing for California residents.
In the past 12 months, we have collected the categories of personal information described in Section 2 (identifiers, commercial information, internet/network activity, geolocation, sensory data, professional information, inferences, and, for certain users, characteristics protected by California or federal law where you choose to provide them, and sensitive personal information limited to government identifiers, account credentials, precise geolocation when you opt in, and biometric identifiers used for KYC). We collected these from the sources, for the purposes, and shared them with the categories of recipients listed in Sections 2–4.
We do not sell personal information for monetary consideration. We may "share" certain identifiers, internet activity, and inferences for cross-context behavioral advertising with advertising partners. You may opt out by emailing privacy@turtles.com or by sending a Global Privacy Control signal from your browser.
We do not use or disclose sensitive personal information for purposes that require a right-to-limit notice under the CCPA, except as permitted by 11 C.C.R. § 7027(m).
See Section 6.
California residents may request information about the categories of personal information shared with third parties for those third parties' direct marketing purposes by writing to privacy@turtles.com.
If we offer a program that constitutes a financial incentive (e.g., a loyalty or rewards program), we will provide a separate notice describing the material terms, including the categories of personal information involved, the value of the data, and how to opt out.
The Service is for adults only. As described in the Terms of Use, you must be at least eighteen (18) years of age (or the age of majority in your jurisdiction, if older) to access or use the Service in any capacity, including as a Shopper, Operator, Seller, developer, or website visitor. We do not knowingly collect personal information from any person under eighteen (18). If we learn that we have collected such information, we will promptly delete or anonymize it and terminate the related Account. If you are a parent or guardian and believe a minor has provided personal information to Turtles, please contact privacy@turtles.com so that we can investigate and remove the information.
We use automated systems for purposes such as fraud detection, content moderation, advertising delivery, and search ranking. Where Applicable Law (including U.S. state privacy laws that govern profiling for decisions producing legal or similarly significant effects) gives you a right to opt out of, or obtain human review of, such automated decisioning, you may exercise that right by contacting privacy@turtles.com.
We send marketing communications based on your preferences and Applicable Law. You can opt out at any time:
We may continue to send service, transactional, security, and legal notices regardless of your marketing preferences.
If you apply for a job at Turtles or work for us, we process personal information in connection with recruitment, employment, and related purposes. For details, contact privacy@turtles.com.
The Service may contain links to or integrate with third parties whose privacy practices we do not control. We are not responsible for the privacy practices of third parties, including Operators, Sellers, advertisers, and authentication providers. Review their privacy notices before sharing personal information with them.
We will post any changes to this Policy here and update the effective date above. If changes are material, we will provide additional notice (such as email or in-product banner). Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.
The "business" responsible for personal information processed under this Policy is Turtles.com Inc., a Delaware corporation.
Turtles.com Inc. — privacy@turtles.com
