1. Information We Collect
We collect information you provide when creating an account (email address), creating listings (business details, equipment descriptions, photos), signing NDAs (legal name), and communicating through the platform (message content).
2. Blind Listing Data Protection
Blind Listing data is protected by design. When a seller creates a listing, sensitive information — including the exact business name and street address — is stored separately from publicly visible fields. Public listing views display only the general neighborhood, business category, rent range, and equipment summary.
Exact addresses and business names are shared only after a buyer has completed a digitally signed Non-Disclosure Agreement (NDA) for that specific listing. NDA signatures are recorded with timestamps and stored in an immutable audit trail.
3. How We Use Your Information
We use your information to operate the platform, facilitate transactions between buyers and sellers, provide AI equipment appraisals, send transactional notifications (message alerts, deal updates), and maintain security and audit trails.
4. Anonymous Messaging
Messages between buyers and sellers are anonymized. Real names, email addresses, and phone numbers are never displayed to the other party. Platform-assigned display identifiers are used instead. Messages containing detected personal contact information are flagged for review.
5. Payment Information
We do not store credit card numbers or payment credentials on our servers. All payment processing is handled by Stripe Connect. We retain only transaction references (payment intent IDs, amounts, timestamps) for audit purposes.
6. Data Security
All data is transmitted over HTTPS with TLS 1.2 or higher. Database access is controlled by Row-Level Security (RLS) policies ensuring users can only access data they are authorized to view. All authentication events, NDA signatures, and financial transactions are logged in an immutable audit trail.
7. Account Deletion
You may request account deletion at any time through your account settings. Upon deletion, all personally identifiable information (email, name, phone) is removed from all database tables within 30 calendar days. Anonymized or tombstone records may be retained for audit and legal compliance purposes.
8. Data Sharing
We do not sell your personal information. We share data only as necessary to operate the platform: with Stripe for payment processing, with AI providers (OpenAI/Anthropic) for equipment appraisals (photos only, no PII), and as required by law.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. Continued use of the platform after changes constitutes acceptance of the updated policy.