Privacy Policy

1. Information We Collect

We collect information you provide directly to us and information generated through your use of the platform:

• Account information: your full name, work email address, and company/organisation domain used during registration and login.
• Inventory & product data: descriptions, images, conditions, prices, and other attributes of surplus items you list on the platform.
• Transaction data: records of purchases, bids, auction outcomes, payment confirmations, and related financial activity processed through Stripe.
• Usage logs: pages visited, features used, search queries, timestamps, IP addresses, browser type, and device information collected automatically to operate and improve the service.
• Authentication data: one-time passcodes (OTPs) sent to your work email for passwordless login; we do not store passwords.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the service: creating and managing your account, enabling listings, auctions, and purchases, and delivering platform functionality.
• Organisation matching: we use your work email domain to automatically associate you with your employer's organisation on the platform, enabling access to your company's private storefront.
• Authentication: sending OTP emails through AgentMail to verify your identity at login.
• Payment processing: passing transaction data to Stripe to process payments securely.
• Platform communications: sending transactional emails (order confirmations, auction results, account notices). We do not send marketing emails without explicit consent.
• Security & fraud prevention: monitoring for abuse, suspicious activity, and policy violations.
• Product improvement: analysing aggregated usage data to improve features and fix issues.

3. How We Share Your Information

We do not sell your personal information to third parties. We share data only in the following limited circumstances:

• Stripe: payment card and transaction data is transmitted to Stripe, Inc. for secure payment processing. Stripe's privacy policy governs their use of that data.
• Cloudflare R2: uploaded files (product images and attachments) are stored in Cloudflare's R2 object storage. Files are stored securely and not publicly indexed.
• Sentry: error and crash reports may include contextual data (e.g. user ID, browser, page) to help us diagnose and fix bugs. Data is pseudonymised where possible.
• AgentMail: your work email address is shared with AgentMail solely to deliver OTP authentication emails on our behalf.
• Legal requirements: we may disclose data if required by law, court order, or to protect the rights and safety of Corp Surplus, our users, or the public.
• Business transfers: in the event of a merger or acquisition, user data may transfer to the successor entity, subject to equivalent privacy protections.

4. Data Retention

We retain your account data for as long as your account is active. If you close your account, we will delete or anonymise your personal data within 30 days of receiving your written deletion request, unless we are required to retain certain data for legal, tax, or compliance purposes.

Transaction records may be retained for up to 7 years to comply with financial and tax obligations.

5. Your Rights

Depending on your jurisdiction (including under GDPR and CCPA), you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion of your personal data, subject to legal retention requirements.
• Portability: request your data in a structured, machine-readable format.
• Restriction: request that we limit how we process your data in certain circumstances.
• Objection: object to processing of your data for certain purposes, including direct marketing.
• Non-discrimination (CCPA): we will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, email us at support@corpsurplus.com. We will respond within 30 days.

6. Cookies

We use session cookies only. These are strictly necessary cookies that maintain your authenticated session while you are logged in and expire when you close your browser or log out.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. We do not participate in cross-site tracking or behavioural advertising.

7. Security

We implement industry-standard security measures to protect your data:

• In transit: all data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• At rest: stored data is encrypted at rest in our cloud infrastructure.
• Access controls: access to production systems and personal data is restricted to authorised personnel only, using the principle of least privilege.
• Monitoring: we use Sentry for error monitoring and maintain logs to detect and respond to security incidents.

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at support@corpsurplus.com.

8. Children's Privacy

Corp Surplus is a business-to-business platform intended exclusively for use by business entities and their employees. We do not knowingly collect personal data from individuals under the age of 18.

9. International Data Transfers

Our services and infrastructure may be hosted in data centres outside your country of residence. By using our platform, you consent to the transfer of your information to these locations. Where required by law (e.g. GDPR), we rely on appropriate safeguards such as Standard Contractual Clauses for international transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Continued use of the platform after changes constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related questions, requests, or complaints, please contact:

• Email: support@corpsurplus.com
• Website: corpsurplus.com