Privacy Policy

1. Who we are

Operatory ("we", "us", "our") operates the auction marketplace at operatory.com. We are the data controller for personal data collected through this platform.

2. What we collect

• Account data: email address, display name, phone number (optional), practice name and location.
• Transaction data: bid amounts, purchase history, offer history, payout records. We do not store raw card numbers. Payment data is handled by Stripe.
• Listing data: photos, descriptions, condition details, and location you provide for equipment listings.
• Usage data: pages viewed, search queries, time spent, browser and device type, IP address.
• Communications: messages between buyers and sellers after a transaction closes, dispute submissions, support inquiries.

3. How we use your data

• To operate the marketplace: authenticate users, process bids, run auctions, and settle payments.
• To send transactional notifications: outbid alerts, auction end notices, payment confirmations, payout updates.
• To review listings and moderate the marketplace.
• To resolve disputes and respond to support requests.
• To improve the platform based on usage patterns.
• To comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data for behavioral advertising.

4. Data sharing

We share data only as needed to operate the platform:

• Stripe:payment processing and seller payouts. Stripe's privacy policy governs their handling of financial data.
• Supabase: database and authentication infrastructure.
• Resend: transactional email delivery.
• Between buyers and sellers: after a transaction closes, contact information is shared between the winning buyer and seller to coordinate delivery.
• Law enforcement: when required by law, court order, or to protect the rights and safety of users.

5. Data retention

We retain account data for the life of your account plus 7 years for tax and legal record-keeping purposes. Transaction records are retained for 7 years. You may request deletion of your account at any time. We will delete or anonymize personal data within 30 days, subject to legal retention requirements.

6. Your rights

Depending on your location, you may have rights to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data (subject to retention requirements).
• Object to or restrict processing.
• Data portability. Receive your data in a machine-readable format.

To exercise these rights, contact us at osita@operatoryauctions.com.

7. Cookies

We use strictly necessary cookies for authentication session management. We use analytics cookies to understand how the platform is used. These can be opted out via your browser settings. We do not use advertising or tracking cookies.

8. Security

All data is encrypted in transit (TLS) and at rest. Access to production systems is restricted to authorized personnel. We use Supabase Row Level Security to ensure users can only access their own data.

9. Changes to this policy

We will notify registered users by email of material changes to this policy at least 14 days before they take effect.

10. Contact

Questions about this policy? Email osita@operatoryauctions.com.