PRIVACY POLICY

1. INTRODUCTION

66Relics ("we," "us," or "our") operates an online marketplace and auction platform at 66relics.com (the "Site"). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you visit our Site, create an account, list items, place bids, make purchases, or otherwise interact with our Services. We are committed to protecting your privacy and complying with applicable data protection laws, including the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR).

By using our Services, you consent to the data practices described in this Privacy Policy. If you do not agree with these practices, please do not use our Services.

2. INFORMATION WE COLLECT

2.1 Information You Provide

When you register, list items, place bids, or contact us, we collect:

• Account information: Full name, email address, password (encrypted), and role assignment.
• Profile information: Username, location, biography, avatar, and preferred categories.
• Listing information: Item details, photographs, vehicle specifications, VIN/serial numbers, title documentation, registration documents, and seller notes.
• Identity verification: Driver's license photos (front and back) when required for listing verification.
• Communication: Messages sent between users, comments on listings, and correspondence with our support team.
• Offer and bid data: Offer amounts, bid amounts, and timestamps.
• Advertising information: Company name, advertiser name, advertiser email, ad creative, and target URL for advertisers.
• Merchandise orders: Buyer name, email, shipping address, size selection, and order notes.
• Notification preferences: Email addresses submitted for auction alert subscriptions.

2.2 Information Collected Automatically

When you visit our Site, we automatically collect:

• Device and browser information: IP address, browser type, operating system, and device identifiers.
• Usage data: Pages visited, time spent on pages, click paths, search queries, and referring URLs.
• Cookies and similar technologies: Session cookies, authentication tokens, and analytics cookies.
• Location data: Approximate location derived from IP address (not GPS).

2.3 Information from Payment Processors

When you make a payment (listing fees, buyer's premiums, merchandise, or auction purchases), we receive transaction metadata from Stripe and Escrow.com, such as transaction IDs, payment status, and the last four digits of your card. We do not receive or store your full credit card number, CVV, or other sensitive payment data — that information is handled directly by Stripe.

3. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

• Account management: Creating and managing your account, authenticating your identity, and maintaining account security.
• Marketplace operations: Processing listings, bids, offers, purchases, and transactions.
• Escrow facilitation: Coordinating with Escrow.com to facilitate secure transactions between buyers and sellers.
• Communication: Sending transactional emails (bid confirmations, auction closing alerts, offer notifications, payment receipts), account activation emails, onboarding emails, and re-engagement messages.
• Customer support: Responding to your inquiries and resolving disputes.
• Platform improvement: Analyzing usage patterns to improve features, usability, and performance.
• Security & fraud prevention: Detecting and preventing fraudulent activity, shill bidding, unauthorized access, and other misuse.
• Marketing: Sending promotional emails and auction notifications (only if you have opted in; you may opt out at any time).
• Advertising: Managing and serving advertisements, tracking ad impressions and clicks, and reporting to advertisers.
• Legal compliance: Complying with legal obligations and cooperating with law enforcement when required.
• AI-assisted features: Generating listing descriptions, valuations, and one-liners using AI tools to enhance the user experience.

4. COOKIES & TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies (web beacons, pixel tags, local storage) to maintain your session, remember your preferences, analyze site traffic, and serve relevant content. Cookies are small text files stored on your device.

Types of cookies we use:

• Essential cookies: Required for the site to function (authentication, session management, security). These cannot be disabled.
• Analytics cookies: Help us understand how visitors interact with the site (Google Tag Manager, page view tracking).
• Functional cookies: Remember your preferences (e.g., language, category filters).

You can control cookies through your browser settings. Disabling essential cookies will prevent you from logging in or using certain features. We do not use cookies for targeted advertising.

5. HOW WE SHARE YOUR INFORMATION

We do not sell your personal information. We share data with the following categories of recipients:

• Payment processors: Stripe (listing fees, buyer's premiums, merchandise, advertising) and Escrow.com (auction sale transactions) receive transaction data necessary to process payments.
• Print-on-demand fulfillment: Printify receives order details (name, shipping address, product, size) to fulfill merchandise orders.
• Email service provider: Resend processes our transactional and marketing emails and receives your email address and email content.
• Google Calendar: If you opt in to calendar sync, auction closing times may be synced to your Google Calendar via OAuth.
• Between users: When you engage in a transaction, certain information is shared between buyer and seller (names, emails for coordination). Messages sent through the platform are visible to both parties.
• Service providers: Third-party vendors who provide hosting, analytics, and infrastructure services, under contractual obligations to protect your data.
• Legal authorities: When required by law, court order, or to protect the rights, property, or safety of 66Relics, our users, or others.
• Business transfers: In the event of a merger, acquisition, or asset sale, user data may be transferred to the acquiring entity.

6. DATA RETENTION

We retain your personal information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce our agreements. Transaction records (bids, sales, payments) are retained for a minimum of 7 years for tax and legal compliance purposes. Listing data (including photos and documentation) is retained for the duration of the listing and for a period thereafter. You may request deletion of your account and associated data, subject to our legal retention obligations.

7. DATA SECURITY

We implement industry-standard technical, administrative, and physical security measures to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction. These measures include encrypted password storage, secure payment processing through PCI-compliant providers (Stripe), OAuth-based authentication for third-party integrations, access controls, and regular security reviews. However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. YOUR PRIVACY RIGHTS

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to deletion: Request deletion of your personal data (subject to legal retention obligations).
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to the processing of your data for certain purposes (e.g., marketing).
• Right to opt out of sale: Under the CCPA, you have the right to opt out of the "sale" of your personal information. We do not sell your personal information.
• Right to withdraw consent: Withdraw consent for data processing that relies on your consent (e.g., marketing emails, calendar sync).

To exercise any of these rights, please contact us. We will respond to your request within 30 days. Please note that certain rights may be subject to legal exceptions.

8.1 California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, including the right to know what personal information is collected, the right to request deletion, and the right to non-discrimination for exercising your privacy rights. We do not sell personal information as defined by the CCPA.

8.2 EU/UK Residents (GDPR)

If you are located in the European Union or United Kingdom, you have rights under the GDPR. The lawful bases we rely on for processing your data include: contract performance (providing the Services you requested), legitimate interests (platform security, fraud prevention), legal obligation (tax and compliance records), and consent (marketing emails, calendar sync). You have the right to lodge a complaint with your local data protection authority.

9. CHILDREN'S PRIVACY

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected information from a child, please contact us and we will promptly delete it.

10. THIRD-PARTY LINKS & SERVICES

Our Site contains links to third-party websites and integrates with third-party services (Stripe, Escrow.com, Printify, Resend, Google Calendar, Google Analytics). We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you use. When you interact with these services, their privacy policies govern the collection and use of your information.

11. SENSITIVE DATA HANDLING

We collect certain sensitive documents as part of the listing process, including driver's license photos and vehicle title/registration documents. This information is used solely for identity verification and listing authenticity. It is stored securely and access is restricted to authorized personnel. We do not use this information for marketing or share it with third parties except as required by law or as necessary to complete a transaction (e.g., title transfer documentation provided to the buyer upon purchase).

12. MARKETING COMMUNICATIONS

With your consent, we may send you promotional emails about new auction blocks, featured listings, and platform updates. You can opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email or by contacting us. Transactional emails (bid confirmations, payment receipts, account notifications) are not marketing communications and cannot be opted out of, as they are necessary for the functioning of your account.

13. DATA BREACH NOTIFICATION

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant authorities without undue delay, in accordance with applicable law. We will provide information about the nature of the breach, the data affected, and the steps we are taking to mitigate it.

14. INTERNATIONAL DATA TRANSFERS

Your information may be transferred to and processed in countries other than your country of residence, including the United States. By using our Services, you consent to the transfer of your data to the United States and other jurisdictions where our service providers operate. We take reasonable measures to ensure that your data is protected in accordance with this Privacy Policy and applicable law during such transfers.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Services we offer. We will post the updated policy on this page and update the "Last Updated" date. If we make material changes, we will provide a more prominent notice (such as an email or site notification). Your continued use of the Services after any changes constitutes acceptance of the revised policy.

16. CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us. We are committed to addressing your privacy concerns promptly and transparently.