Privacy Policy
A draft tied to the account, marketplace and support data flows.
Review draft. This document has not been adopted as binding terms and is not legal advice.
Data collected
Account email and profile details support authentication and ownership. Garage records, serial identifiers, claims and uploaded media support equipment identity. Listings contain seller-supplied or externally observed descriptions, prices and locations. Favorites, saved searches, offers, messages and transaction records support requested marketplace functions. Valuation and identification workflows process inputs and analytical outputs. Trust requests contain contact details and the evidence you choose to provide.
Use and disclosure
Public listings expose the designated listing information; private account and case information is restricted. Supabase supports authentication and data storage. Vercel supports hosting and optional analytics. AI or payment processing depends on the configured provider and activated feature. Do not submit government identifiers, bank details or confidential documents in general request fields. Provider contracts, countries and subprocessors require operator confirmation.
Retention
Retention is purpose-specific. Public removal and internal evidence retention are different decisions. The proposed schedule and legal-hold process are subject to approval; no fixed statutory period is asserted here. Rights requests can seek deletion, correction or minimization. Necessary transaction or dispute records may require limited retention, with the basis documented. Backups and provider copies require coordinated handling.
Your choices
Use /privacy to request access, correction, deletion, portability, opt-out, consent withdrawal or appeal. We assess identity proportionately and explain any applicable refusal or extension. Optional analytics starts only after an affirmative choice and remains disabled when Global Privacy Control is signaled. Withdrawing browser consent does not itself erase previously collected records.
International and children’s data
Publicly visible source data may still be personal data. No GDPR, UK GDPR, Canadian or state-law applicability determination is implied. Lawful bases, transfer safeguards, representative obligations and local rights must be assessed before expansion. Proposed accounts are for adults; do not provide children’s personal data.
Items for counsel and operator review
Confirm controller identity/contact/address, processing inventory, retention periods, vendors/transfers, lawful bases, sale/sharing classification, notices at collection and jurisdiction thresholds.
Version history
2026-09-05 — Initial engineering draft for counsel review; not adopted. Permanent version