Privacy Policy

Auctibuy collects, uses, shares, retains, protects, and deletes account, TikTok-connected, listing, bidding, payment, KYC, review, and support data. This Privacy Policy explains how Auctibuy handles personal data and business data across our websites, TikTok-connected experiences, Mini App surfaces, dashboards, APIs, support workflows, payment flows, evaluator desks, escrow workflows, and marketplace operations.

Scope

This Privacy Policy explains how Auctibuy handles personal data and business data across our websites, TikTok-connected experiences, Mini App surfaces, dashboards, APIs, support workflows, payment flows, evaluator desks, escrow workflows, and marketplace operations.

Controller role and service-provider role

Auctibuy may act as a controller or business for account, marketplace, support, security, policy, payment record, listing, bidding, and product analytics data. In limited enterprise or partner contexts, Auctibuy may process data according to written instructions from a seller, evaluator firm, escrow provider, or enterprise customer, but only where a separate written data processing agreement says so.

For ordinary marketplace use, Auctibuy decides how account, listing, bid, review, support, safety, and transaction records are processed so the platform can operate. Payment processors, hosting providers, communication tools, fraud vendors, storage providers, analytics services, and infrastructure vendors may act as processors, service providers, independent controllers, or equivalent roles depending on the service and law.

TikTok remains responsible for TikTok account, platform, API, developer, and content processing that TikTok controls. Auctibuy is responsible for its own marketplace processing. If a signed enterprise agreement or data processing addendum applies, it may add security, subprocessor, audit, retention, deletion, and transfer obligations beyond this public Privacy Policy.

Personal data, business data, and transaction data

Auctibuy handles several kinds of information. Some is personal data about identifiable people. Some is business data about companies, dealerships, agencies, evaluator practices, escrow providers, stores, or professional accounts. Some is transaction data about assets, bids, payments, documents, reviews, and settlement. These categories often overlap in a high-value marketplace.

A seller proof pack can include personal data, business data, ownership data, property data, vehicle data, title data, and financial data in one file. An evaluator report can include seller data, location data, appointment data, condition notes, valuation evidence, photos, metadata, and professional opinions. A buyer bid record can include account identity, payment state, bid amount, timing, device signals, fraud signals, and auction room context. Auctibuy treats mixed transaction records with heightened care because they may be needed for legal transfer, dispute resolution, tax, payment, fraud prevention, auditability, and platform trust.

Data we collect

We collect data you provide, data created by your marketplace activity, data from approved TikTok integrations, data from payment and compliance partners, and technical data generated by the service.

• Account data such as name, username, email, phone where enabled, avatar, role, capabilities, business profile, country, region, city, and verification status.
• TikTok-connected data such as TikTok open ID, public profile fields, avatar, creator metadata, linked content references, granted scopes, token expiry metadata, and content URLs where allowed by your permissions and TikTok API access.
• Listing and transaction data such as titles, descriptions, photos, videos, proof files, legal packs, vehicle or property details, evaluator notes, appointment windows, bids, bid history, checkout state, escrow state, ratings, reviews, and support records.
• KYC/KYB and compliance data such as identity files, proof of address, business registration, tax certificates, evaluator credentials, licenses, certificates, sample reports, references, insurance proofs, and review decisions.
• Payment data such as payment profile status, processor references, checkout intent IDs, amounts, currencies, fee purposes, refund status, escrow activation records, and settlement events. Full card numbers are handled by payment processors, not stored by Auctibuy.
• Technical data such as device or browser details, IP-derived signals, session events, audit logs, request logs, WebSocket events, fraud signals, performance telemetry, and security events.

Sources of data

Auctibuy receives information from several sources so that listings, auctions, evaluation, escrow, support, and trust workflows can function.

• Directly from you when you create an account, complete onboarding, connect TikTok, create listings, upload files, place bids, send messages, open support tickets, submit ratings, or complete checkout.
• From other users when they invite you, mention you, rate you, review you, assign you, bid against you, message you, report you, or include your information in transaction documents.
• From evaluators, authenticators, escrow providers, payment providers, fraud vendors, logistics providers, financing partners, title or registry partners, and support operators involved in a transaction.
• From TikTok when you authorize approved scopes, use TikTok Login, interact with a Mini App surface, or rely on TikTok-connected content or account context.
• From your device and browser through logs, cookies, local storage, session storage, headers, realtime connections, security signals, and usage events.
• From public or commercially available sources where needed to verify a business, category, market comparable, sanctions concern, fraud signal, rights issue, or asset context.

Sensitive and high-risk information

Auctibuy may process sensitive or high-risk information when necessary for identity, compliance, safety, payment, anti-fraud, high-value asset transfer, or regulated transaction workflows. We aim to collect only what is reasonably needed for the relevant role or transaction.

• Identity documents, proof of address, business registration, beneficial ownership, tax records, trade license, evaluator credentials, insurance certificates, and seller authority records.
• Financial and payment-related records such as payment method status, processor tokens or references, bid entry fees, settlement events, refund events, chargeback records, escrow activation, and payout eligibility.
• Location information such as country, region, city, property location, appointment windows, pickup location, inspection location, and IP-derived region signals.
• Asset-sensitive records such as property title, vehicle registration, provenance, ownership chain, inheritance documents, antique certificates, restoration history, and legal packs.
• Security-sensitive records such as fraud scores, abuse reports, device signals, blocked identifiers, audit trails, investigation notes, and enforcement records.

Auctibuy does not ask users to upload unnecessary secrets such as full card numbers, passwords, seed phrases, unrelated bank statements, or unrelated private documents. If such information is uploaded accidentally, Auctibuy may restrict access, delete it where feasible, or preserve it only if legally necessary.

How we use data

We use data to operate the marketplace, verify accounts, run auctions, process payments, support high-value transaction workflows, protect users, improve reliability, and comply with legal and platform obligations.

• Authenticate users, connect TikTok accounts, maintain sessions, and authorize role-based dashboards.
• Create and manage listings, bids, live auction rooms, evaluator assignments, appointments, reports, seller approvals, launch gates, escrow workflows, and buyer access gates.
• Calculate and display fees, process checkout, reconcile payment events, manage non-refundable service gates, and handle refund or dispute workflows.
• Detect fraud, shill bidding, fake accounts, policy abuse, suspicious payments, document tampering, and marketplace manipulation.
• Rank search results, show trust signals, calculate ratings, display reviews, and improve marketplace relevance.
• Respond to support requests, enforce policies, comply with law, satisfy TikTok developer requirements, and maintain auditability.

Legal bases and permitted purposes

Where privacy law requires a legal basis, Auctibuy relies on one or more lawful bases depending on the data, region, role, and transaction. These may include contract performance, legitimate interests, consent, legal obligation, vital interests, public interest where applicable, or establishment and defense of legal claims.

Contract performance may apply when we create accounts, process bids, operate rooms, provide seller Studio, route evaluator assignments, unlock paid access, process checkout, or provide support. Legitimate interests may apply for fraud prevention, marketplace integrity, security, ranking, analytics, audit logs, dispute handling, trust scores, moderation, and product improvement. Consent may apply for certain TikTok permissions, optional marketing, optional cookies, optional profile fields, or optional document uploads where required by law. Legal obligation may apply for tax, payment, KYC/KYB, sanctions, law enforcement, court orders, accounting, consumer protection, data protection, and regulated transaction requirements. Legal claims may apply when records are retained or disclosed to investigate disputes, enforce terms, recover amounts owed, defend rights, or prevent abuse.

Marketplace visibility and public information

Some information is intentionally visible to other users because Auctibuy is a marketplace. Visibility depends on account role, listing status, payment gates, review gates, privacy settings, and transaction state.

Public profile details may include display name, username, avatar, seller store, ratings, reviews, trust score, completion rate, active rooms, ended rooms, badges, country or region, and role signals. Listing pages may show title, description, media, category, location signals, seller identity, room status, valuation state, trust badges, bidding state, and selected documents or reports after access gates. Evaluator or authenticator identity, category coverage, region, rating, assignment status, report status, and appointment outcome may be visible where relevant to a governed listing. Buyer names or usernames, bid amounts, bid ranking, winner status, and bid history may be visible in room leaderboards or records, depending on product settings. Private documents, identity files, payment details, fraud notes, internal risk scores, support notes, and compliance documents are not intended for general public display.

TikTok-connected data

When you connect TikTok, Auctibuy uses TikTok data only for the purposes authorized by you, allowed by TikTok, and needed for the marketplace experience. TikTok controls its own services, APIs, content availability, account status, and privacy practices.

We do not sell TikTok account data. We do not use TikTok data outside the permissions granted by the user and the approved developer product surface. If TikTok tokens expire, permissions are revoked, content becomes unavailable, or TikTok API access changes, Auctibuy features may degrade or require reconnection. You may disconnect TikTok where supported. Some historic audit or transaction records may remain where needed for legal, safety, financial, or dispute reasons. Users should also review TikTok Privacy Policy and TikTok Terms of Service because TikTok separately governs TikTok account and platform data.

TikTok permissions, scopes, and app review

Auctibuy may request TikTok permissions only when needed for an approved user experience, such as TikTok Login, profile display, creator context, video references, or other TikTok developer products. TikTok may review, approve, restrict, revoke, or change access to developer products and scopes.

Auctibuy should maintain externally accessible Terms, Privacy Policy, support, app description, app icon, demo credentials, screenshots, and review materials where required by TikTok app review. Auctibuy should not mislead users into believing Auctibuy is TikTok, owned by TikTok, endorsed by TikTok, or operated by TikTok. Auctibuy should not request TikTok scopes that are unrelated to the active product experience. If TikTok deprecates an API, changes review requirements, restricts a scope, disables an app, or removes content, Auctibuy may need to change, limit, or remove affected features.

Cookies, local storage, and similar technologies

Auctibuy may use cookies, local storage, session storage, device identifiers, pixels, SDK storage, and similar technologies to operate sessions, keep users signed in, remember preferences, secure accounts, measure performance, debug failures, prevent fraud, and improve product quality.

Strictly necessary storage supports login, security, payment flow continuity, CSRF or anti-abuse controls, routing, language, theme, and product state. Functional storage may remember preferences such as theme, filters, draft state, onboarding progress, and dashboard layout. Analytics or performance storage may help measure route usage, errors, load time, auction events, conversion, and product reliability. Advertising or cross-context tracking should not be used unless approved, disclosed, and controllable as required by law and platform policy. Browser settings may allow blocking or deleting cookies, but doing so can break login, bidding, checkout, document upload, realtime room updates, or security features.

Automated processing, ranking, and fraud controls

Auctibuy uses automated and semi-automated systems to protect marketplace integrity and make the product usable. These systems may support search ranking, feed ordering, trust signals, fraud detection, payment risk checks, duplicate detection, bid validation, document workflow routing, listing eligibility, and moderation queues.

Automated systems may consider account history, role status, KYC/KYB status, ratings, completion rate, payment state, bid behavior, device signals, geographic signals, listing category, value, documents, and support history. Auctibuy may use human review for high-impact decisions such as account suspension, evaluator approval, dispute resolution, governed listing launch, high-value transaction review, and severe enforcement. Users may contact support to ask for review of certain restrictions or decisions, though Auctibuy may preserve internal fraud signals and security logic where disclosure would create risk.

Sharing and disclosure

We share data only as needed to run the marketplace, complete transactions, satisfy compliance requirements, protect users, and operate approved integrations.

• With buyers, sellers, evaluators, authenticators, escrow providers, admins, and support teams when needed for a listing, bid, review, appointment, settlement, rating, or dispute.
• With payment processors, fraud vendors, hosting providers, email providers, analytics or observability services, storage providers, and infrastructure vendors acting on our behalf.
• With TikTok or TikTok developer or platform review channels where required for app review, integration functionality, policy compliance, security, or abuse investigation.
• With regulators, courts, law enforcement, tax authorities, rights holders, payment networks, or safety partners when required by law or reasonably necessary to protect users and the platform.
• With a successor, acquirer, investor, or restructuring party if Auctibuy is involved in a merger, financing, asset sale, bankruptcy, or corporate transaction, subject to appropriate confidentiality where applicable.

Operational access controls

Auctibuy limits internal access based on operational need. Support, admins, engineers, trust and safety, evaluator operations, escrow operations, payment operations, and compliance personnel may receive different levels of access depending on role and task.

Support may access account, listing, ticket, payment status, and audit context needed to solve user issues. Evaluator operations may access listing proof, appointment windows, report files, seller notes, valuation status, and review history. Payment operations may access payment references, fee purposes, processor events, refund state, chargeback evidence, and reconciliation records. Engineers may access logs, error traces, limited production records, and infrastructure data to debug and secure the service, subject to operational controls. Auctibuy may maintain audit logs of sensitive administrative actions where technically feasible.

Processors, subprocessors, and vendors

Auctibuy uses vendors to host infrastructure, store files, send emails, process payments, provide observability, secure accounts, prevent fraud, support users, analyze product performance, and operate realtime features. Vendors are selected based on operational need, capability, reliability, security posture, and contractual commitments where applicable.

Vendors may change over time as Auctibuy improves or regionalizes the platform. Auctibuy aims to provide vendors only the data reasonably needed for their services. Some vendors, such as payment processors or TikTok, may operate under their own legal role and terms rather than only as Auctibuy processors. Enterprise customers may request subprocessor details if a signed data processing agreement gives that right.

Retention

We retain data for as long as needed for marketplace operation, legal obligations, safety, financial records, dispute handling, auditability, fraud prevention, and platform review readiness.

Account, role, KYC/KYB, and compliance records may be retained while the account is active and for a reasonable period after closure. Auction, bid, payment, escrow, evaluator, seller approval, and audit records may be retained longer because they are needed for contractual, financial, tax, chargeback, and dispute evidence. Temporary logs, screenshots, debug artifacts, and local QA captures should not be committed to source control and may be deleted regularly. Where law requires deletion or restricts retention, we apply those requirements unless another legal basis permits or requires retention.

Typical retention categories

Retention periods vary by record type, legal requirement, jurisdiction, payment provider, dispute status, and operational need. The categories below describe Auctibuy retention logic without promising a fixed deletion date for every record.

• Session and security logs may be retained for a shorter operational period unless needed for fraud, abuse, debugging, audit, or legal claims.
• Support tickets may be retained while needed to resolve the issue and for a reasonable period to maintain service history, safety evidence, and quality controls.
• Bid ledgers, auction records, payment events, refund events, escrow events, evaluator reports, seller approvals, and dispute evidence may be retained for longer because they are commercial transaction records.
• KYC/KYB, evaluator credentials, licenses, and compliance documents may be retained while the role is active and after closure where required for fraud prevention, audit, legal, tax, or regulatory reasons.
• Deleted or hidden public content may remain in backups, logs, dispute records, payment records, moderation records, or legal hold systems for a period after public removal.

Backups, legal holds, and deletion limits

When a deletion request is approved, Auctibuy aims to remove or de-identify active records where feasible. Some records may remain temporarily in backups or permanently where retention is needed for legal, payment, fraud, safety, audit, dispute, or transaction integrity purposes.

Backup deletion may occur on the normal backup lifecycle rather than immediately. Records subject to legal hold, chargeback, dispute, investigation, tax, regulatory, or security review may be retained until the hold ends. Auctibuy may retain minimal account identifiers to prevent repeat abuse, enforce bans, comply with legal duties, or maintain an audit trail.

User controls and requests

Depending on your location and account status, you may request access, correction, deletion, export, restriction, objection, or withdrawal of consent. Some requests may require identity verification and may be limited where records are needed for transactions, disputes, compliance, safety, or fraud prevention.

You can update many account and profile fields in the product. You can contact support for privacy requests, account closure, TikTok disconnect questions, or document correction. Deleting or restricting data may prevent bidding, selling, evaluator access, escrow processing, support investigation, or transaction completion.

Regional privacy rights

Privacy rights vary by region. Auctibuy will honor applicable rights required by law, which may include rights to know, access, correct, delete, port, restrict, object, withdraw consent, appeal certain decisions, opt out of certain processing, or lodge a complaint with a data protection authority.

Users in some regions may have GDPR-style rights, including access, rectification, erasure, restriction, portability, objection, and complaint rights. Users in some United States jurisdictions may have rights to know categories of data, access data, correct data, delete data, opt out of sale or sharing where applicable, limit certain sensitive data use, and avoid discrimination for exercising rights. Users in other regions may have local rights under consumer, privacy, data protection, telecommunications, electronic transaction, or platform laws.

Auctibuy may verify identity before fulfilling requests and may deny or limit requests when an exception applies. Auctibuy does not intentionally sell personal data in the ordinary meaning of exchanging personal data for money. If future advertising, analytics, or partner integrations create opt-out obligations, Auctibuy should provide the required controls before enabling them.

Security

Auctibuy uses administrative, technical, and organizational safeguards designed for a high-value marketplace, including role-based access, token handling, audit logs, validation, rate limiting, secure payment redirection, document controls, and least-privilege operational practices. No system is perfectly secure, and users must protect their own credentials and devices.

Security incident handling

If Auctibuy detects a security incident involving personal data, it will investigate, contain, remediate, preserve evidence, and provide notices where required by law, contract, or platform obligations. Notice timing and content depend on the facts, applicable law, law enforcement needs, and risk to users.

Users should immediately report suspected account compromise, unauthorized payment activity, document exposure, suspicious messages, or phishing attempts. Auctibuy may reset sessions, require password or payment re-verification, revoke tokens, suspend access, disable integrations, or preserve logs during an investigation. Auctibuy may coordinate with TikTok, payment providers, hosting vendors, law enforcement, regulators, and affected users where appropriate.

De-identification and aggregated data

Auctibuy may create aggregated, anonymized, or de-identified information for analytics, security, reporting, product development, market insights, fraud prevention, pricing quality, and operational planning. Auctibuy will not attempt to re-identify de-identified data except to test whether de-identification remains effective or as otherwise allowed by law.

Artificial intelligence and model-assisted tools

Auctibuy may use model-assisted tools to summarize support tickets, classify listings, detect abuse, extract document fields, route evaluator queues, improve search, generate internal risk signals, or help operators work faster. These tools should support human workflows and should not replace legally required human judgment for high-impact marketplace decisions.

Auctibuy should not intentionally train public foundation models on private user documents unless a separate disclosure and legal basis supports that use. Sensitive documents, payment records, identity files, and evaluator reports should be handled with heightened controls when used in model-assisted workflows. Users should not upload unnecessary sensitive information into free-text fields or support notes.

Children and restricted users

Auctibuy is not intended for children or users who cannot lawfully enter commercial transactions. Users must satisfy age, legal capacity, TikTok account, payment, KYC, and regional requirements before bidding, selling, reviewing, or settling transactions.

International transfers

Auctibuy may process data in countries where we, our vendors, or platform partners operate. Data protection laws may differ by region. Where required, we use appropriate transfer mechanisms, vendor commitments, and access controls.

Business transfers

If Auctibuy is involved in a merger, acquisition, financing, investment, restructuring, bankruptcy, sale of assets, or similar transaction, data may be disclosed to advisers, diligence recipients, counterparties, courts, regulators, or successors as reasonably necessary. The receiving party may continue processing data under this Privacy Policy or a replacement policy with appropriate notice where required.

How to contact Auctibuy about privacy

Users can submit privacy, deletion, correction, TikTok disconnect, data export, or account closure requests through Auctibuy support. Auctibuy may require verification before acting on a request and may route payment, escrow, evaluator, or legal-record questions to specialized support workflows.

Changes to this policy

We may update this Privacy Policy for product changes, TikTok integration changes, legal requirements, new vendors, new data uses, security improvements, or operational changes. The updated date tells you when the policy was last changed.