Privacy Policy

1. Who we are (data controller)

bidandbid.com operates bidandbid.com in the United States. For privacy requests contact privacy@bidandbid.com or support@bidandbid.com.

2. Information we collect

• Account: name, email, phone, password hash, role (buyer/seller), US state, verification status.
• Identity verification: legal name, date of birth, residential address, document type and last four characters, government ID images, selfie, submission history, and reviewer decisions.
• Transaction: bids, offers, watchlist, invoices, payment desk status, dispute records.
• Listing: VIN, vehicle specs, photos, title status, seller disclosures you submit.
• Technical: IP address, browser/device type, session identifiers, security logs, cookie preferences.
• Account activity: registration, sign-in, searches, listing views, watchlist actions, verification progress, bids, offers, and support interactions associated with your account.
• Consent records: consent type, policy version, timestamp, source, hashed network identifier, and device/browser information used to evidence your choices.
• Communications: support emails, desk calls notes linked to your account when you contact us.

3. How we use information

• Provide auctions, authentication, bidding, and Payment Desk settlement.
• Verify identity and prevent fraud, shill bidding, and account abuse.
• Maintain first-party account activity and audit records for security, support, auction integrity, and service improvement.
• Send transactional notices (outbid alerts, invoice updates, security events).
• Improve the platform, troubleshoot errors, and maintain audit trails for disputes.
• Comply with legal obligations and respond to lawful requests.
• Advertising measurement: Meta Pixel on public pages unless you choose Essential only (see §5).

4. Legal bases (where applicable)

For US users we process data as necessary to perform our contract with you (Terms of Service), for legitimate business interests (security, fraud prevention), and with consent where required (marketing cookies). We do not sell personal information as defined under California CPRA.

5. Cookies, advertising measurement & session analytics

• Essential cookies (NextAuth session, security) — required; cannot be disabled while using the service.
• Meta Pixel loads on public pages for US ad measurement unless you choose Essential only. Microsoft Clarity loads only after you click “Accept all”.
• Meta Pixel may record page views, searches, listing views, registration, lead, and checkout events for US ad attribution.
• Microsoft Clarity may collect interaction, device, navigation, and session-replay data to help diagnose usability. Sensitive KYC, checkout, and administrator routes are excluded.
• Change your choice anytime via “Cookie preferences” in the site footer.

6. Sharing & service providers

We share data with infrastructure providers (hosting, database, email), and with Meta and Microsoft only when you opt in to marketing analytics. We do not sell personal information. We may disclose data if required by law or to protect rights, safety, and platform integrity.

7. Retention

Account and auction records are retained while your account is active and as needed for disputes, tax, fraud prevention, and legal holds — typically seven years for transaction records unless a longer period is required. KYC records and encrypted identity documents are retained only as needed for verification, fraud prevention, disputes, and applicable legal obligations. Security logs are retained on a shorter rolling basis.

8. Security

Passwords are hashed. Production traffic uses HTTPS. KYC documents are encrypted at rest, stored outside the public web root, served with no-store controls, and accessible only to authorized administrators. Access to production systems is restricted to authorized personnel. No method of transmission is 100% secure; report suspected account compromise immediately.

9. Your privacy rights (United States)

To exercise rights, email privacy@bidandbid.com with subject “Privacy Request”, your account email, and enough detail to verify identity. We respond within timelines required by applicable law (typically 45 days for California).

• Access / know what personal information we hold about you.
• Correct inaccurate account information (via account settings or support).
• Delete your account — subject to legal retention for completed transactions.
• Opt out of marketing emails via unsubscribe links; opt out of Meta Pixel via cookie preferences.
• California (CCPA/CPRA): right to know, delete, correct, and opt out of sale/sharing — we do not sell personal information.

10. Children

The service is for adults and licensed businesses. We do not knowingly collect data from anyone under 16. Contact us to request deletion if you believe a minor submitted data.

11. International visitors

The platform is intended for United States vehicle transactions. If you access from outside the US, you understand data may be processed in the United States where laws may differ from your jurisdiction.

12. Changes

We may update this Privacy Policy. Material changes will be posted here with a revised date. Continued use after changes constitutes acknowledgment where permitted by law.