Privacy Policy

1Scope

This policy covers personal information the house collects about California consumers through its website, account system, and related services. It does not cover information collected by third-party services the house links to but does not control, and it does not cover information the house processes on behalf of a business client as a service provider, if any such arrangement exists.

2Categories of Personal Information We Collect

The house collects the following categories of personal information, as those categories are defined under the CCPA/CPRA:

• Identifiers. Email address (the house identifies accounts by email; it does not use usernames), account identifiers, and IP address captured incidentally through standard web request handling and security infrastructure.
• Customer records information. Name, shipping and billing address, and phone number, where a bidder, buyer, or consignor supplies them for an order, invoice, or shipment.
• Commercial information. Bidding history, offers made and received, purchases, invoices, consignment submissions, and related transaction records.
• Internet or other electronic network activity. Session cookie and CSRF cookie values used to keep an account signed in and to protect form submissions; request metadata (such as IP address, endpoint, and timestamp) recorded briefly by the house's rate-limiting system to detect abusive traffic; and technical diagnostic data captured automatically when a software error occurs, as described under Security below.
• Audio, electronic, visual, or similar information. Photographs and written descriptions that consignors submit of the items they are consigning. These depict the item being offered, not the consignor, except to the extent a consignor's own photograph or personal image is incidentally included in submitted material.
• Sensitive personal information. Account login credentials — specifically, the password (stored by the house only as a Django-generated cryptographic hash, never in plain text) and, for accounts with two-factor authentication enabled, the TOTP (time-based one-time password) secret used to generate the second factor. Two-factor authentication is optional for ordinary accounts and required for staff and administrator accounts. The house does not collect or store payment card numbers; card and payment details are collected and processed directly by Stripe, the house's payment processor, as described below.
• Professional or employment-related information. To confirmconfirm whether staff/employee personal information (e.g., payroll, HR records) is in scope of this consumer-facing policy or covered separately

The house does not knowingly collect biometric information, precise geolocation, genetic data, health information, or information about a consumer's racial or ethnic origin, religious beliefs, union membership, or sex life or sexual orientation, and does not request such information as part of any listing, bid, offer, or purchase flow.

3Sources of Personal Information

The house collects personal information:

• Directly from you, when you create an account, sign in, place a bid, make an offer, complete a purchase, submit a consignment (including descriptions and photographs), request an invoice, or contact the house.
• Automatically, through session and CSRF cookies necessary to operate the site, and through server-side request metadata recorded briefly for rate limiting and abuse prevention.
• From service providers acting on the house's behalf, such as payment status information returned by Stripe after a transaction, and delivery and bounce status returned by Resend after a transactional email is sent.
• Automatically, when a software error occurs, through the house's error-monitoring tooling (Sentry), configured as described under Security below.

4How We Use Personal Information

The house uses personal information to:

• Create, authenticate, and secure accounts, including issuing and verifying session and CSRF cookies and, where enabled or required, TOTP two-factor codes;
• Operate the auction and fixed-price marketplace, including listing management, bidding, offers, invoicing, and consignment intake and review;
• Process payments through Stripe and send transactional communications (order confirmations, invoices, shipping notices, account notices) through Resend;
• Deliver, store, and serve listing media through Cloudflare R2 and the Cloudflare network that fronts the site;
• Detect, investigate, and prevent fraud, abuse, and security incidents, including through rate limiting and error monitoring;
• Diagnose and fix software defects, using error reports from which cookies, the Authorization header, the X-Forwarded-For header, the remote IP address, and the user's email address are stripped before the report leaves the house's server, as described under Security;
• Comply with legal, tax, and recordkeeping obligations applicable to an auction and consignment business; and
• Communicate with consumers about their accounts, bids, offers, purchases, and consignments.

The house does not use personal information to build advertising profiles for third parties and does not use sensitive personal information for any purpose beyond what is reasonably necessary to provide the services above.

5How We Disclose Personal Information

The house discloses personal information to the following categories of service providers, each engaged to perform a specific function on the house's behalf and each restricted by contract from using the information for its own purposes:

• Stripe (payment processing) — receives payment and billing details necessary to process a transaction. The house does not store card numbers.
• Resend (transactional email delivery) — receives the recipient email address and message content necessary to send account, order, invoice, and shipping communications.
• Cloudflare (content delivery, security, and object storage) — fronts the site's network traffic and hosts listing media (photographs) in Cloudflare R2.
• Sentry (error monitoring) — receives diagnostic error reports with cookies, the Authorization header, X-Forwarded-For, the remote address, and the user's email address stripped before the report leaves the house's server.

The house may also disclose personal information where required by law, subpoena, or court order, to protect the rights, property, or safety of the house or others, or in connection with a merger, acquisition, or sale of business assets, subject to this policy or a successor policy.

6No Sale or Sharing of Personal Information

To confirmconfirm no sale/sharing — counsel and client to verify against actual ad tech in use

7Your CCPA/CPRA Rights

If you are a California resident, you have the right to:

• Know what personal information the house has collected, used, disclosed, and (if applicable) sold or shared about you, including the specific pieces of personal information collected;
• Delete personal information the house has collected from you, subject to certain exceptions (such as completing a transaction, maintaining required transaction and tax records, or detecting security incidents);
• Correct inaccurate personal information the house maintains about you;
• Opt out of the sale or sharing of personal information, to the extent the house engages in either, as addressed above;
• Limit the use and disclosure of sensitive personal information to what is necessary to perform the services requested;
• Non-discrimination for exercising any of these rights; the house will not deny goods or services, charge different prices, or provide a different level of quality because you exercised a CCPA/CPRA right; and
• Data portability, to receive a copy of the personal information the house has collected from you in a portable format, where technically feasible.

8How to Exercise Your Rights

You may submit a request to know, delete, or correct, or a request to limit the use of sensitive personal information, by contacting the house at To confirmdesignated privacy-request contact — email address and/or toll-free number and/or web form. The house will confirm receipt of a verifiable consumer request within ten business days and will respond substantively within forty-five calendar days, extendable once by an additional forty-five calendar days where reasonably necessary, with notice of the extension. A consumer, or their authorized agent, may make a request to know or delete free of charge up to twice in a twelve-month period.

9Verification of Requests

Because the house identifies accounts by email address rather than username, the house will generally verify a request to know, delete, or correct by matching the request to the email address on the associated account and confirming ownership of that email address, and, where the request concerns transaction records, by matching to information such as a recent order or invoice number. The house may decline a request it cannot verify to a reasonable degree of certainty appropriate to the sensitivity of the information requested. To confirmdescribe the specific verification procedure and match points once the intake process is built

10Authorized Agents

You may designate an authorized agent to submit a CCPA/CPRA request on your behalf. The house will require the agent to provide proof of authorization to act on your behalf (such as signed written permission or a valid power of attorney) and, except where a power of attorney is provided, will also independently verify your identity or ask you to directly confirm you provided the agent permission to submit the request.

11Data Retention

The house retains personal information for as long as reasonably necessary to maintain an account, complete a transaction, provide customer support, satisfy the tax, accounting, and consignment-recordkeeping obligations that apply to an auction and consignment business, resolve disputes, and enforce agreements, after which it is deleted or de-identified. Server-side rate-limiting request metadata is retained only briefly and is not kept as a standing profile. To confirmspecific retention periods, by record type, to be supplied by counsel and client once a retention schedule is adopted

12Security

The house maintains administrative and technical safeguards designed to protect personal information, including: password hashing using Django's built-in password-hashing framework, so the house never stores a plaintext password; optional two-factor authentication (TOTP) for ordinary accounts, required for all staff and administrator accounts; a payment flow that never places card numbers on the house's own servers, since payment is processed directly by Stripe; a content and security network (Cloudflare) in front of the site; and error monitoring (Sentry) configured to strip cookies, the Authorization header, X-Forwarded-For, the remote address, and the user's email address from a diagnostic report before it leaves the house's server. No method of transmission or storage is completely secure, and the house cannot guarantee absolute security.

13Cookies and Similar Technologies

The site uses two cookies: a session cookie and a CSRF (cross-site request forgery) cookie. Both are strictly necessary to operate the site — the session cookie keeps a signed-in account authenticated, and the CSRF cookie protects form submissions from forgery — and neither is used for advertising, analytics, or cross-site tracking. Because these cookies are strictly necessary, they are not subject to an opt-out. To confirmconfirm whether Cloudflare sets any additional cookie (e.g., a security/bot-management cookie) in front of the site, and disclose it here if so

14Children's Privacy

The site is not directed to children, and the house does not knowingly collect personal information from children. To confirmconfirm minimum account age / bidder eligibility age and state it here. A parent or guardian who believes a child has provided personal information to the house may contact the house using the details below to request deletion.

15Changes to This Policy

The house may update this policy from time to time. A revised policy will be posted at this location with an updated effective date. Material changes affecting how previously collected personal information is used will be communicated as required by law.

16Contact Us

To exercise a CCPA/CPRA right, ask a question about this policy, or reach the house's privacy contact, write to: To confirmbusiness legal name, mailing address, privacy contact email, and/or phone number.

(Draft -- counsel to finalize.)