Data Policy

What we collect

Your name, email address, phone number, date of birth (to confirm you are 18 or older; never shown to an auction house) and, if you buy, a shipping or billing address. Your bids, invoices, payments, questions, ratings, support tickets and messages sent through the platform. If you sign in with Google, the name and email address Google gives us. If you run or work for an auction house, what you add to it: lots, photos, consignors and bidders you bring across from other systems. Technical records (time, network address, browser) of your sign-ins, so you can see where your account is signed in and we can spot misuse, and of each bid and each staff action, as evidence if an auction is ever disputed. If you save a card, our payment processor (Stripe) holds the card; we keep only a reference to it and the last four digits.

Why

To run auctions: to take and rank bids, produce invoices, send the emails an auction needs (a verification code, an outbid notice, an invoice, a shipping notice), and to let the house you deal with contact you about your lots. To keep the platform safe: to detect fraud, shill bidding and abuse.

Identity checks

Some people are asked to prove who they are: every auction house owner before their house can sell, and bidders once their winnings pass a set amount. You photograph a government ID and take a selfie on a page run by Stripe, our payment processor, which compares the selfie with the photo on the ID and checks the ID is genuine. We learn the result (verified or not) and keep a reference to the check; we keep no copy of the images.
If you are ever locked out of your account, we may ask you to do the check again and compare it with your earlier one, to confirm it is really you before letting you back in. To make that comparison we may keep a one-way fingerprint of the name and date of birth on your ID, which cannot be turned back into them. We use identity checks only to confirm who you are, to prevent fraud and to keep accounts safe, never for advertising and never to decide credit, housing, employment or insurance.
We use Stripe for risk and identity verification services. We share personally identifying information with Stripe, which analyzes and uses it to operate and improve the services it provides to us, including for risk evaluation and identity verification. Stripe and we are each independent controllers of that information, and Stripe processes it under its own privacy policy at stripe.com/privacy. Stripe may process it outside your state or country, including in the United States, and may pass it to service providers, including government authorities, to check an ID. Stripe keeps the images and details from a check on our behalf for up to seven years unless you ask us to have them deleted.
If you would rather not take a selfie, or not use Stripe at all, email us at [email protected] and we will arrange another way to confirm who you are.

Who sees it

The auction house you register with sees your registration, your bids and your invoices with that house — nothing from other houses. The services that run the platform see what they need to do their job: our hosting provider (Amazon Web Services); Cloudflare, which stands in front of the site, sees the network address of every visit and runs the bot check on our forms; our email and text-message providers, which carry the messages we send you; our payment processor (Stripe, which also runs identity checks); Google, if you sign in with Google, and when you type an address, to suggest the rest of it; Apple, to deliver notifications to our iPhone app if you turn them on; and an error-monitoring service (Sentry) that receives a report when something on the platform breaks. Before such a report leaves our servers, names, email addresses, phone numbers, addresses, payment references and anything from an identity check are removed from it. We do not sell your information and we do not share it for advertising.

How long

Bids, invoices and payments are kept permanently, because they are the record of an auction, and so is the network address and browser recorded with each bid and each staff action. A record of a sign-in is kept while that sign-in lasts and for 30 days after it ends. Notifications are kept for 180 days, and closed support tickets for 90 days. If you close your account we remove your email address, phone number, addresses, date of birth and ways to sign in, but the auction records stay, with your name, because houses must keep the record of what they sold and to whom.

Analytics and problem reports

When you register you are asked one optional question: analytics. If you say yes, the platform may learn from how you use the site (which pages, on what kind of device, how long things take) to improve it, and when a page fails for you a problem report is opened for you automatically with the page and the time — never what you typed. If you say no, neither happens; you can still report a problem yourself. Change your answer any time under Privacy and Data on your account. Error reports that carry no personal details are sent to our monitoring service whatever you choose, as described above.

Your choices

You can see and change your details on your account page, remove your saved card, change your analytics answer, and close your account. To ask for a copy of your information, its deletion beyond what is described here (including the details from an identity check held by Stripe), or anything else about your data, email [email protected].

Cookies

We use cookies only where the site needs them to work: to keep you signed in, to carry you through the steps of signing in (including Sign in with Google), to protect our forms from being submitted by another site, to show a message after a page reloads, and, if you ask us to, to remember a browser so it is not asked for your second check for 30 days. Your browser also keeps the email addresses you have signed in with, so you can pick one next time (you can remove them), and your light or dark choice. We use no advertising or tracking cookies.

Children

The platform is for adults. Every account gives a date of birth and must be 18 or older; we do not knowingly collect information from anyone younger, and we close any account we learn belongs to someone under 18.

Changes to this policy

When we change this policy in a way that matters, we will tell you by email or on the site before the change takes effect. The date it last changed is shown at the top.

Security

Passwords are stored hashed; sessions can be revoked; staff accounts require a second factor; every action that touches money or a reserve is written to an audit log; the database is encrypted and backed up daily.