This Privacy Policy applies to the Auctaro website, marketplace, seller onboarding, checkout, order, messaging, support, and moderation services. It is effective from 20 July 2026.

Auctaro determines why and how personal data is processed for operation of the marketplace. For privacy questions or requests, contact [email protected].

We collect information you provide, information generated when you use the marketplace, and limited information received from service providers.

We do not store full payment-card numbers or full bank-account credentials. Stripe collects payment, bank, identity, and tax information through its hosted services and provides Auctaro with the identifiers and status information needed to operate the marketplace.

• Account, contact, profile, authentication, session, consent, device, IP-address, and security metadata.
• Listings, photographs, bids, favorites, notifications, messages, blocked-message attempts, reports, and moderation records.
• Recently viewed auction history. Guest history is stored on the device for up to 90 days; signed-in history is linked to the account and can be cleared from account settings.
• Orders, checkout selections, shipping and tracking information, delivery events, inspection deadlines, returns, refunds, chargebacks, and disputes.
• Stripe connected-account, Checkout Session, PaymentIntent, charge, application-fee, refund, dispute, and payout-status identifiers.
• Seller approval, identity-verification status, country, account type, payout readiness, tax-reporting capability status, annual reporting year, annual seller consideration, transaction count, and threshold timestamps.
• Cookie preferences and optional analytics or marketing events when you consent to the relevant category.

We process data to provide the service and perform our contracts with users, including account access, auctions, checkout, shipping, notifications, refunds, dispute handling, and seller onboarding.

We process data to comply with legal obligations, including accounting, tax, DAC7 platform reporting, fraud prevention, payment, regulatory, and law-enforcement requirements.

We process data for legitimate interests such as marketplace security, abuse prevention, payment reconciliation, service improvement, evidence preservation, legal claims, and protecting buyers and sellers. We use consent where required for optional analytics, marketing, or similar technologies.

Buyer payments are normally created as direct charges on the relevant seller's Stripe connected account. Stripe hosts checkout, processes the payment, credits the connected account subject to fees, and transfers Auctaro's application fee.

Auctaro receives payment and status records needed to confirm orders automatically from signed Stripe webhooks, reconcile fees, support users, initiate approved refunds, and respond to payment disputes.

Approved full refunds are submitted to Stripe on the seller's connected account and returned to the original payment method. Stripe and the buyer's bank or card issuer control final processing times.

Auctaro tracks seller activity by calendar year to identify potential reporting obligations. This includes annual consideration credited to a seller, the number of relevant sales, refunds, fees, reporting-year totals, and when an internal threshold is reached.

For DAC7 and similar rules, Auctaro and/or Stripe may collect and verify legal name, primary address, date and place of birth where applicable, country of residence, tax identification numbers, VAT number, business registration details, financial-account identifiers, consideration, transaction counts, fees, commissions, taxes, and seller-statement information.

Stripe may collect sensitive identity, bank, and tax information directly through hosted onboarding. Auctaro may receive confirmation that information was requested, supplied, verified, pending, overdue, restricted, or unsupported without receiving the full underlying value.

Reportable seller information may be disclosed to competent tax authorities and provided to the seller as required by law. If required information is not provided, Auctaro or Stripe may restrict selling, listings, payouts, or account access until the requirement is satisfied.

We share data only where reasonably necessary with providers that support authentication, hosting, storage, communications, analytics, fraud prevention, payments, seller onboarding, shipping, customer support, and professional advice.

Current providers can include Better Auth, Stripe, Cloudflare R2, Brevo, Firebase, Mixpanel, Microsoft Clarity, Meta, shipping or pickup-location providers, and infrastructure providers. Optional analytics and marketing providers receive data only according to your consent choices where consent is required.

We may also disclose data to buyers or sellers as necessary to complete an order, and to tax authorities, regulators, law enforcement, courts, advisers, insurers, or prospective business successors where legally permitted or required.

We retain data only for as long as reasonably necessary for the purposes described in this policy, including account operation, transaction history, support, fraud prevention, dispute evidence, accounting, tax, legal claims, and regulatory compliance.

DAC7 due-diligence and reporting records may need to remain available for a period set by applicable implementing law, generally not less than five years and not more than ten years after the end of the relevant reporting period.

Deletion of an account does not require deletion of records that must be retained for tax, payment, fraud, dispute, safety, or legal reasons. Data is deleted, anonymized, or access-restricted when the applicable retention period ends.

Some service providers may process data outside Cyprus or the European Economic Area. Where required, transfers are protected through adequacy decisions, standard contractual clauses, or another lawful transfer mechanism.

Service providers may also process data under their own privacy notices and legal obligations.

Strictly necessary cookies support sign-in, security, language routing, checkout protection, and consent storage. These are required for the service to operate.

Preference, analytics, marketing, and social-media technologies are controlled through the cookie settings where required. You can change those choices from the footer.

Subject to applicable law, you may request access, correction, deletion, restriction, objection, or portability of your personal data. You may withdraw consent at any time where processing relies on consent, without affecting earlier lawful processing.

Some requests may be limited where data must be retained for legal obligations, fraud prevention, payment disputes, tax reporting, or legal claims. We may need to verify your identity before acting on a request.

You may complain to the Office of the Commissioner for Personal Data Protection in Cyprus or another competent supervisory authority.

We use administrative, technical, and organizational measures intended to protect personal data, but no online service can guarantee absolute security.

We may update this policy when the service, providers, or legal requirements change. Material changes may be communicated through the platform or by email where appropriate.

For privacy requests or questions, contact [email protected].