Privacy Policy

WaxDepot LLC, a Wyoming limited liability company ("WaxDepot," "we," "us") operates the marketplace at waxdepot.io. This policy explains what personal data we collect about you, what we do with it, and your rights to control it.

We collect three categories of data:

Account data (you provide)

• Email address, display name, password (hashed by Supabase Auth — we never see plaintext)
• Optional bio, location, avatar color

Marketplace data (you create)

• Listings you create, bids you place, orders you place or fulfill
• Shipping addresses for orders, tracking numbers
• Reviews you write, messages you send to other users, dispute filings
• Watchlist, follows, recently-viewed products, saved searches

Technical data (we observe)

• IP address, browser, OS, device type
• Pages visited, click events, time on page (via product analytics)
• Cookies for authentication session and CSRF protection

What we don't collect: we do not see or store your full Social Security Number, full bank account number, or full credit-card number. Identity verification (KYC) and payment instruments are handled entirely by Stripe — we receive only a yes/no on whether your account is verified.

• To run the marketplace — process orders, hold payments until delivery, ship packages, resolve disputes
• To verify your identity through Stripe before allowing payouts
• To send transactional email about your activity (orders shipped, funds released, disputes opened)
• To prevent fraud, abuse, and Terms violations (shill bidding, resealed product, off-platform fee evasion)
• To improve the Service — understand which products are popular, where users drop off, what to fix next
• To comply with legal obligations (tax reporting, court orders, sanctions screening)

We do not sell or rent your personal data to advertisers, data brokers, or any other third party. We do not run third-party ad networks on the Service.

We share the minimum data necessary with these third-party processors, each of whom has signed a Data Processing Agreement:

We may also disclose your data when required by law (subpoena, court order), to enforce these Terms, to investigate fraud, or in connection with a sale of substantially all of WaxDepot's assets.

We use a small number of cookies:

• Essential— authentication session, CSRF token, cart state. Without these the site doesn't work; no consent banner needed under most laws.
• Analytics — PostHog / Vercel Analytics tracking cookie. Anonymous-by-default, no cross-site tracking.

We do not use third-party advertising cookies, retargeting pixels, or social-network share trackers.

• Active accounts: for as long as the account exists.
• Closed accounts: profile is anonymized within 30 days; transaction history (orders, payouts, sales) is retained for at least 7 years to satisfy IRS, marketplace facilitator, and Stripe record-keeping requirements.
• Server logs: retained for 90 days for security and abuse investigation, then deleted.
• Stripe-held data: governed by Stripe's privacy policy. We can't delete data stored on Stripe's side; you can request deletion directly with Stripe.

You can:

• Access — see most of your data right now in your account. For a full export, email privacy@waxdepot.io.
• Correct — update your profile in account settings.
• Delete — close your account from settings, or email privacy@waxdepot.io. Note that financial records are retained for 7 years per the schedule above.
• Object / restrict — opt out of analytics by enabling Do Not Track in your browser. Email us to opt out of non-transactional email.
• Portability — request a JSON export of your data, no charge, within 30 days.

California residents (CCPA/CPRA):you have the additional rights of non-discrimination for exercising the above, and the right to opt out of any data sale (we don't sell, but this disclosure is required). Submit requests via privacy@waxdepot.io.

EU/UK residents (GDPR): our lawful basis for processing is (a) contract for marketplace operations, (b) legitimate interest for fraud prevention and product improvement, (c) legal obligation for tax and KYC, and (d) consent for non-essential analytics. You may withdraw consent at any time.

We protect your data with encryption in transit (TLS 1.3), encryption at rest (AES-256 via Supabase), bcrypt password hashing, and least-privilege database access (row-level security). Stripe is PCI-DSS Level 1 certified for payment data.

No system is perfectly secure. If we detect a breach affecting your data, we'll notify you within 72 hours of confirmation via email and (if material) a banner on the Service.

The Service is not intended for users under 18 and we do not knowingly collect data from minors. If you believe a minor has created an account, email privacy@waxdepot.ioand we'll delete it.

We are based in the United States. Our processors (Stripe, Supabase, Resend, Vercel) primarily store data in the US. EU/UK data transferred to the US relies on the EU-US Data Privacy Framework certifications maintained by these providers, plus Standard Contractual Clauses where applicable.

We'll notify you of material changes by email and/or a banner at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

Privacy questions: privacy@waxdepot.io
General support: help center
Mailing address: WaxDepot LLC, [registered agent address], Sheridan, WY