Privacy Policy

This Privacy Policy explains how Islander Connect collects, uses, stores, and protects personal information across buyer, seller, partner, admin, and support workflows. It details our integration with leading cloud and AI infrastructure to ensure your data is secure, private, and treated with absolute integrity.

We may collect account identifiers, profile information, legal acceptance records, shipping addresses, storefront and listing data, order information, payment metadata, notification records, and operational logs.

We do not host your data on private, vulnerable local servers. To ensure enterprise-grade security and uncrashable performance, Islander Connect utilizes secure cloud architecture:

* Google Cloud Platform (GCP): Your core account data, real-time storefront inventories, compliance logs, and Firestore databases are securely hosted on Google Cloud Platform. All transactions are protected by Google's industry-leading physical security, role-based identity access management (IAM), and advanced data encryption both in transit and at rest.

* Google Cloud Storage: Product images, media, high-density customer uploads (such as design files and DTF gangsheets), and digital-product files are held in Google Cloud Storage, separate from our databases. We apply strict bucket access policies, transport-layer security (SSL/TLS), and automatic server-side encryption to keep your creative assets private and protected.

Islander Connect integrates advanced AI systems (Isla) to assist with customer support, Chamorro-language assistance, and platform moderation. We maintain a strict policy of data isolation:

* No Model Training: Your private messages, search histories, translations, and personal interactions with our AI are processed through private, enterprise API endpoints (Google Vertex AI). We do not permit these providers, nor do we allow any third parties, to use your data to train public or proprietary AI models.

* Encrypted API Pipelines: All interactions with our AI models are encrypted in transit via secure SSL/TLS protocols and are processed inside isolated, temporary sandboxes.

We use personal information to authenticate users, enforce compliance, process orders, manage storefronts, deliver notifications, support payouts, investigate abuse, and operate the platform safely.

By creating an account and completing your profile on Islander Connect, you explicitly consent to receive communications from us, including:

* Email Marketing: Platform updates, product announcements, creator highlights, community newsletters, and promotional offers.

* Direct Physical Mail: Postcards, catalogs, promotional items, and seasonal printed mailers delivered directly to your verified physical shipping address on file.

* Administrative & Transactional Notifications: Critical operational alerts, payment confirmations, compliance nudges, and account security updates (these are non-promotional and cannot be opted out of).

Your Right to Opt-Out (Unsubscribe):

We respect your inbox and mailbox. You can easily manage your communication preferences or opt-out of receiving promotional email marketing at any time by:

1. Clicking the "Unsubscribe" or "Manage Preferences" link at the bottom of any marketing email.

2. Updating your settings inside your local Account Dashboard.

3. Submitting a request to platform support or contacting our team at support@islander-connect.com.

Opting out of promotional emails or physical marketing will not affect your receipt of critical transactional messages (such as purchase receipts or security alerts) required to operate your account.

Sensitive payment credentials are handled exclusively by a PCI-DSS compliant third-party processor, Stripe. Islander Connect stores only the minimum provider identifiers and payment state needed for order processing, payouts, and operational review. Your raw credit card details never touch our databases.

For sellers who link their bank accounts for direct deposit payouts, Islander Connect collects standard routing and account numbers, account types, and legal account names to facilitate ACH transfers.

* Access-Limited Storage: Your bank routing and account numbers are never written to your public storefront record. They are held in a separate store that is server-only: no browser session, client application, or administrative console can read it directly, and it is reachable exclusively by our backend.

* Encryption At Rest: That store is encrypted at rest by our cloud provider, and your bank coordinates are transmitted only over encrypted connections (SSL/TLS).

* Privacy & Non-Disclosure: We never display your full bank account number or routing number in any browser session, client UI, or administrative console. Account numbers are always masked (e.g. showing only the last 4 digits) to protect against visual spoofing and social engineering.

Buyer shipping addresses are collected only for order fulfillment, order support, fraud prevention, and checkout readiness. Our systems use carrier APIs to calculate shipping and tax rates from the addresses stored in your profile.

Agreement acceptance records, onboarding completion data, and operational logs are retained to demonstrate compliance, support audits, and protect the platform's security. All critical credentials and API keys are stored in encrypted vaults via Google Secret Manager (GSM) and resolved dynamically at runtime, preventing credential leaks.

To support our platform's operations, provide high-value regional integrations, and foster future commercial opportunities, Islander Connect may share, transfer, disclose, or sell personal information (including your legal name, contact email, physical shipping address, phone number, and purchase history) under the following conditions:

* Integrated Infrastructure & Partners: We share data with critical transaction and delivery partners—including Stripe (for secure merchant payouts and PCI-compliant processing), Resend (for automated email delivery and marketing newsletters), and local OCONUS logistics systems—as required to fulfill orders and operate the platform.

* Commercial & Marketing Partnerships: From time to time, we may share or lease anonymized, aggregated, or specific account directories with trusted regional partners, advertisers, and merchant networks to deliver relevant offers, local services, and curated promotions.

* Business Transfers & Future Mergers: In the event that Ad Astra Tendere LLC (which operates Islander Connect) undergoes a business transition—such as a merger, acquisition, joint venture, corporate reorganization, or a sale of all or a portion of its assets—your personal data and account records will constitute a transferable business asset and will be shared with or transferred to the acquiring or successor entity.

Opting Out of Future Sharing:

You maintain the right to restrict or opt-out of the sharing or sale of your personal information for third-party commercial marketing purposes at any time by updating your dashboard settings or contacting our compliance team at support@islander-connect.com.

For users accessing Islander Connect from the United Kingdom (UK) or the European Union (EU), your personal data is protected under the UK General Data Protection Regulation (UK GDPR), the EU GDPR, and the UK Data Protection Act 2018.

We process your personal information under the following legal bases:

* Contractual Necessity: To perform our agreement with you to operate your account, process orders, and manage storefronts.

* Consent: Where you have explicitly agreed (such as opting-in to email marketing or accepting cookies).

* Legitimate Interests: To prevent fraud, ensure cloud and platform security, analyze platform performance, and optimize our services.

* Legal Obligation: To comply with statutory financial audits, transaction-tax reporting, and legal authority requests.

By using Islander Connect, you acknowledge and agree that your personal information will be transferred to, stored, and processed in the United States on our secure Google Cloud servers. We protect these transfers using standard contractual clauses, encryption in transit, and encryption at rest.

You possess the following statutory rights under the GDPR, which you can exercise at any time by contacting our compliance team at support@islander-connect.com:

* The Right of Access: Request a copy of the personal data we hold about you.

* The Right to Rectification: Request correction of inaccurate or incomplete details.

* The Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your account and personal data (except where statutory transaction or financial-retention laws apply).

* The Right to Data Portability: Request a structured, machine-readable export of your data.

* The Right to Object or Restrict Processing: Object to or restrict the processing of your data, including the right to withdraw consent for commercial sharing or data sales.

You also have the right to lodge a complaint with a supervisory authority, such as the UK Information Commissioner's Office (ICO).

We retain data for as long as necessary to operate the platform, resolve disputes, comply with law, and support auditability. We apply access controls, server-side validation, secret handling, and provider-level security boundaries to reduce risk.

Users may request profile updates, account support, or legal-document review through available platform channels. Some operational records may be retained even after access changes where legal or operational necessity applies.