OutbidX privacy policy

1. Scope and contact

This policy covers the OutbidX website, installed web app, auction workspaces and support channels. Organizers also handle information for their own events; their notices may apply to donor records, guest communications and fulfillment outside this service.

Email support@outbidx.com with “Privacy request” in the subject for privacy questions or requests. Never email passwords, sign-in links, full card numbers or identity documents.

2. Information we handle

We handle information you provide, activity records and limited provider information needed to operate accounts and transactions. Not every visitor supplies every category.

• Account/profile: email, account identifier, display name, optional phone, profile image, organization details and notification choices.
• Auction activity: listings, photos and logos, private drafts, invitations and access, bids and proxy maximums, floor-bid records, event messages and organizer actions.
• Payments/collection: Stripe customer, seller and payment references; limited card metadata; amounts, fees, payment/refund/dispute status, purchases and pickup records. Receipts may contain buyer/supplier names, addresses and tax details.
• Support: contact-form information, emails, replies, attachments and the account/event details you supply.
• Technical information: browser/device details, IP addresses and request/security logs handled by hosting providers; sign-in storage, cached app files and an opted-in browser notification token.

3. Why we use it

We use information to authenticate accounts, save catalogs/drafts, control event access, validate bids, reconcile payments, produce records, manage pickup and answer support requests. Necessary records also support error investigation, security, fraud prevention, disputes, rule enforcement and applicable legal/accounting duties. Optional alerts do not determine whether the underlying transaction record is retained.

4. What other people can see

Public listings, approved organizer information and event activity may appear to visitors, participants and projector screens. Depending on the event, bid activity can show display names or paddle details. Do not put confidential donor, child, medical or financial information into public descriptions, photos or messages.

Private membership controls access; a link or QR code does not itself grant membership. Organizers can access information needed to administer their event, reconcile purchases and verify pickup. Purchase/billing details are not intended to be public catalog information.

Public item questions are visible to people with event access and may appear on projectors. Private organizer conversations are available only to their recorded participant and organizer through the app; their message text is omitted from notification previews. Existing conversations remain available after an event for pickup and follow-up. Authorized service operations may access retained records for support or security. Organizers can hide public comments or close item discussion; hidden comment originals are retained for moderation and possible restoration.

Organizers must obtain permission for donor details, photographs and logos. Contact the organizer about its independent collection and OutbidX about access through this service.

5. Providers and disclosures

Google/Firebase and Google Cloud provide authentication, databases, storage, hosting, logging and browser messaging. Resend handles transactional/support email. Cloudflare provides domain/email-routing services; forwarded support correspondence may be handled in Google email services. Providers receive information needed for their work.

Stripe collects card details and handles authorizations, payments, subscriptions and connected seller verification. OutbidX retains references and limited card metadata, not full card numbers or security codes. Sellers provide bank and identity-verification information through Stripe’s hosted screens, not through OutbidX support.

The contact form uses Google reCAPTCHA for abuse protection, subject to Google’s privacy policy and terms. SMS delivery is currently unavailable. Twilio would be used only if SMS is enabled with the relevant notice and choices.

We may disclose information as required by law or reasonably necessary to protect people, accounts and the service. A service ownership change may involve a transfer subject to applicable law and notice. We do not sell personal information or use it for cross-context behavioral advertising.

6. Browser storage and installed apps

Authentication uses browser storage to maintain sign-in. A service worker caches app files for loading and installation. Push uses a separate messaging registration and device token after you enable it; messages may appear on a shared device or lock screen.

You can sign out, clear site storage, uninstall the PWA or revoke browser notification permission. These actions can affect features; they do not cancel bids, erase server records or cancel a subscription.

Google Analytics is optional and loads only after you choose Allow analytics. It measures public page visits, referral sources, campaign tags, completed account signups and auction setup. Analytics excludes account identifiers, auction content, form messages, payment details, private event pages and sign-in tokens. Google processes technical browser and device information to provide these reports. Advertising features are disabled. Use Analytics privacy on a public page to decline or withdraw permission; withdrawal stops collection in this browser and removes its Google Analytics cookies. Your choice is saved for up to six months; Google Analytics cookies last up to one year. External services such as Stripe, reCAPTCHA and video links have their own storage practices. “Do Not Track” does not disable essential processing. We do not sell information or share it for cross-context advertising.

7. Notification choices

Account settings control optional email auction alerts, alert types and supported push. Marketing choices are separate from service communications. Device settings may block alerts. Delivery is not guaranteed; check the event screen rather than relying on notifications.

Sign-in messages, purchase receipts, security notices and responses to support requests may be necessary even when optional alerts are off. SMS is currently disabled. Report unexpected messages without forwarding sign-in credentials.

8. Retention and deletion

Retention depends on purpose, account/event activity, unresolved purchases/disputes, security needs and applicable legal/accounting duties. Financial/audit records may need to remain after account closure. Receipt snapshots preserve transaction history; changing a profile does not rewrite them.

Request account closure or deletion through support. We verify requests, explain records that must remain and handle them as applicable law requires. Removing a listing or clearing a device is not account deletion. Provider backup copies may remain until their retention cycle completes; we do not promise immediate deletion from every backup.

9. Processing across borders

Providers may process information in the United States or other countries, including for Canadian users. Information may be subject to laws and lawful access requirements where processed. We cannot promise that all information stays in one province or country. Contact support about organizational data-location requirements before using the service.

10. Access, correction and other rights

Depending on where you live and which laws apply, you may have rights to access/copy information, correct inaccuracies, request deletion, withdraw optional consent or complain to a privacy authority. Canadian and US state rights can differ. Withdrawing information needed for a transaction may limit features.

Email support@outbidx.com from your account address and describe the request. Representatives may need proof of authority; reasonable identity verification may be necessary. We explain exceptions and respond within applicable deadlines, without penalizing you for exercising privacy rights. Where California law applies, rights may include knowing, correcting, deleting and opting out of sale/sharing; we do not sell or share information for cross-context advertising.

11. Children and school events

Accounts, bidding and seller administration are intended for adults who are at least 18 and have reached the age of majority where they live. School/sports fundraising is for adult organizers and bidders, not child accounts. Do not publish children’s personal details. Contact support if a child has supplied account information so we can investigate and handle it appropriately.

12. Security and third-party tools

Authentication, access controls and encrypted connections reduce unauthorized access; no system is risk-free. Protect your email and devices and report suspicious activity promptly.

External sites, videos and AI tools have their own privacy practices. Share only listings you are authorized to use. The current anonymous auction planner prepares offline listings; it does not automatically access your account or publish an auction. Never give a tool passwords, Stripe secret keys or full card/bank credentials.

13. Changes to this policy

The updated date identifies this version. We publish revisions here and provide additional notice or request consent when required for material changes. This policy does not override rights given by applicable privacy law.