Privacy Policy

1.1360ISS Inc. operates Bidding Fever and is responsible for the personal information under its control. This policy explains what we collect, why, who receives it, how long we keep it and your rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and other provincial privacy laws where they apply.

1.2The person in charge of the protection of personal information is our Privacy Officer: Privacy Officer, 360ISS Inc. (Bidding Fever), privacy@biddingfever.com.

1.3This policy covers our website, our apps, and the emails, text messages and notifications we send. Sellers who receive your information when you win a lot are separate organizations; their own privacy practices govern their use of it.

2.1Account details: your name, email address, phone number, profile photo, language, province and time zone, and sign-in information handled by our sign-in provider.

2.2Bidding and purchases: auction registrations, bids and maximum bids, watchlist, lots won, invoices, payments, refunds, claims and the messages exchanged about them, pickup appointments and shipping addresses.

2.3Payment details: you enter your card directly with Stripe. We receive the card brand, last four digits, expiry date and verification result, never the full card number.

2.4Verification and trust: phone verification codes (stored in hashed form), the result of an identity check where one is required, your trust score, non-payment records and fraud-prevention signals.

2.5Seller information: business name, contacts, registration and tax numbers, team members, and payout account details, which are held by Stripe Connect.

2.6Device and usage: IP address, browser and device type, pages visited, searches, error reports and, in the apps, a push notification token.

2.7Location: only if you allow it, your device's location to show auctions near you. Location is off unless you turn it on, and you can enter a postal code instead.

2.8What you send us: messages to us or to a seller through the platform, contact form submissions and questions you type into the chat assistant.

3.1We use personal information to:

• run accounts and auctions, and process bids, invoices, payments, refunds and payouts;
• send messages about your account, bids and purchases;
• verify identity, keep trust scores and prevent fraud, shill bidding and abuse;
• provide support and handle claims;
• meet legal obligations, such as tax records and court orders;
• keep the service secure and working, for example through error monitoring;
• send marketing messages, only with your consent (section 7).

3.2We do not sell personal information, and we do not use it for third-party advertising.

4.1We collect, use and share personal information with your consent, except where the law allows otherwise. By opening an account, you consent to the uses needed to provide the service described in this policy.

4.2Optional uses, such as marketing messages, text message alerts and device location, need your separate consent, which is never pre-selected. You can withdraw it at any time in your settings.

4.3If you withdraw consent for a use the service needs, such as payment processing, we may not be able to provide that part of the service.

5.1Some decisions are made automatically: your trust score and bidding limit, rate limits, and fraud checks that can pause a bid or a registration.

5.2When a decision about you is based only on automated processing, you can ask us what personal information was used, the main reasons for the decision, and for a person to review it. Write to privacy@biddingfever.com.

6.1We use the following service providers. Each one processes personal information for us under contract, only for the purpose listed:

• Clerk (sign-in and account security): name, email address, phone number, sign-in events and IP address. Clerk uses Cloudflare Turnstile to block automated sign-ups.
• Stripe (payments, payouts and identity checks): the card or bank details you enter, name, email address, billing address, payment amounts, and seller business and identity details.
• Neon (database hosting): all the account and transaction data we store.
• Vercel (website and app hosting): every request to our servers, including IP address, pages requested and server logs.
• Cloudflare (domain name and network security): IP address and connection data when you reach our domain.
• Postmark (email delivery): your email address, your name and the content of the emails we send you.
• Twilio (text messages): your phone number and the content of the text messages we send, such as verification codes and alerts you turned on.
• Expo (push notifications in our apps): your device's push token and the content of the notification.
• Sentry (error monitoring): technical error reports, which can include IP address, browser, the page or screen, and your account identifier.
• Ably and our own real-time service (live bid updates): a connection identifier and the auctions you are following.
• Upstash (bid rate limiting): your account identifier and IP address in short-lived counters.
• uploadthing (file storage): photos and documents you upload, such as lot photos and claim evidence.
• Meilisearch (site search): the public lot and auction catalogue and the search terms you type.
• Anthropic (AI features): the text you type into the chat assistant, and listing text sellers submit for AI writing help. We do not send payment details.
• Google Maps Platform (address suggestions and maps): the address characters you type and your IP address.
• OpenStreetMap and its Nominatim service (map tiles and address lookup): the map area you view, the addresses or postal codes looked up and your IP address.
• Canada Post and Stallion Express (shipping quotes, when a seller offers shipping): delivery address and parcel details.

6.2When you win a lot, we give the seller your name, email address, phone number and shipping address, so they can invoice you, arrange pickup or delivery and keep the records the law requires. A seller receives these details only for lots you have won, only after the auction closes, and never for bidders who did not win. Sellers who use our API need a permission granted specifically for this, and every disclosure is logged.

6.3If a seller connects an outside tool to its account, such as QuickBooks for accounting, that tool receives the data the seller chooses to send, under the seller's responsibility.

6.4We also disclose personal information when the law requires it, such as a court order or a request from a tax authority; when needed to prevent fraud or protect someone's safety; or to a buyer of our business, under a confidentiality agreement and only for that transaction.

7.1Messages about your account, bids, purchases, payments and security are transactional. Canada's Anti-Spam Legislation (CASL) does not require consent for them.

7.2We send commercial electronic messages, such as newsletters, auction announcements and promotions, only with your express consent, given by a box or switch that is not pre-selected, or where CASL allows implied consent, for example within two years after a purchase or six months after an inquiry.

7.3For every consent, we keep a record of the date and time, how it was given, what it covered and when it was withdrawn.

7.4Every commercial message identifies 360ISS Inc. (Bidding Fever), gives our contact information and mailing address, and has a one-click unsubscribe link that works without signing in. We act on an unsubscribe request without delay, and in all cases within 10 business days. For text messages, reply STOP.

7.5Sellers who message bidders through the platform must comply with CASL.

7.6To complain about a message from us, write to privacy@biddingfever.com. You can also report spam to the federal Spam Reporting Centre at fightspam.gc.ca.

8.1Our main database is hosted in the United States (Northern Virginia). Many of our service providers also process information in the United States or other countries. Information held outside Canada is subject to the laws of those countries, and their authorities may be able to access it.

8.2Before we communicate personal information outside Quebec, we assess whether it will receive adequate protection, taking into account its sensitivity, the purpose, the safeguards in place and the legal framework where it goes. Transfers are made under written agreements.

8.3You can ask privacy@biddingfever.com for more information about our service providers outside Canada.

9.1Account information is kept while your account is open.

9.2Transaction records, such as bids, invoices, payments and payouts, are kept for 7 years to meet Canadian tax law.

9.3You can request account deletion from your profile, even with unpaid invoices. You have 30 days to cancel the request. Your profile data is then erased; financial, claim, fulfilment and audit records are kept as required and may still identify you.

9.4Technical logs and error reports are kept for a limited time and then deleted.

9.5When information is no longer needed, we delete it or make it anonymous.

10.1We protect personal information with encryption in transit and at rest, access limited to authorized staff using multi-factor authentication, and payment card handling by Stripe, which is certified under the PCI DSS standard.

10.2No system is perfectly secure. Use a strong password and tell us right away if you think your account has been compromised.

11.1If personal information is accessed, used, disclosed or lost without authorization, we take reasonable steps to reduce the risk of harm and to prevent it from happening again.

11.2If an incident presents a risk of serious injury, or a real risk of significant harm, we notify the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada, or both, as the law requires, and we notify the people affected promptly.

11.3We keep a register of every confidentiality incident, including those that did not need to be reported, and keep each entry for at least five years after we become aware of the incident.

12.1You have the right to:

• access the personal information we hold about you;
• have inaccurate or incomplete information corrected;
• withdraw your consent, subject to legal and contractual limits;
• request deletion of your account, and in Quebec ask us to stop disseminating your information or to de-index a link to it;
• receive the computerized information you gave us in a structured, commonly used technological format;
• be told about decisions based only on automated processing and ask for a person to review them;
• file a complaint.

12.2Send your request to privacy@biddingfever.com. We may ask you to confirm your identity. We answer within 30 days. Access is free; if the law allows a reasonable fee for copies, we tell you the amount before we charge it.

12.3If we refuse a request, we tell you why and how to challenge our decision.

12.4You can complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca), to the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca) or to the privacy commissioner of your province.

13.1We use only the cookies and local storage needed to run the service: your sign-in session and its security, your language, and the market (country) you browse.

13.2We do not use advertising cookies or trackers, and we do not currently use analytics cookies. If we add analytics, it will load only after you agree in a cookie banner, and you will be able to change your choice at any time.

14.1Bidding Fever is not intended for people under the age of majority. We do not knowingly collect personal information from minors, and we delete it if we learn that we have.

15.1This policy is available in French and in English.

16.1Each published version of this policy has a version number and an effective date, shown at the top of this page.

16.2We tell you about important changes by email or in the app before they take effect, and we may ask you to accept the new version when you next sign in.

17.1Privacy Officer, 360ISS Inc. (Bidding Fever), Ontario, Canada: privacy@biddingfever.com.