Privacy Policy

What we collect

• Account details:your name, email address, and a hashed password (we can't see the password itself).
• Auction activity: your bids (including your private maximum bid), listings, invoices, ratings, and reports.
• Technical basics: standard server logs (IP address, time, page) used for security and debugging.

We don't collect payment card details — payment happens in person by e-Transfer or cash. We don't run third-party advertising or tracking scripts.

How we use it

• Running the auctions: bids, invoices, pickup coordination.
• Transactional email: verification links, password resets, outbid notices, and win/invoice notices. These aren't marketing — you get them because they're part of using the site.
• Keeping the site safe: rate limiting, fraud and abuse review.

We don't sell or rent your personal information. Ever.

Who can see what

• Other users see your bids only as an anonymous label ("Bidder 1") — never your name or email. Your maximum bid is never shown to anyone.
• Sellers see the winning buyer's name on the invoice so they can hand over the item at pickup.
• Service providers that process data for us: our email delivery provider (currently Resend) receives your email address to send the transactional emails above; our database and hosting providers store the data. Data may be processed outside Canada by these providers.

How long we keep it

Account and transaction records are kept while your account is active, and invoices are retained afterwards as business/tax records. If you ask us to delete your account, we remove or anonymize personal details that we aren't legally required to keep.

Your rights

Under PIPEDA you can ask us what personal information we hold about you, ask us to correct it, or withdraw consent (which may mean closing your account). Email us and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.

Security

Passwords are hashed with bcrypt, reset and verification links are single-use and expire, connections are encrypted in transit, and the database is backed up nightly. No system is perfect — if we learn of a breach that creates a real risk of significant harm, we'll notify affected users and the Privacy Commissioner as PIPEDA requires.

Contact

Privacy questions or requests: privacy@247bidders.com. We'll respond within 30 days.