Privacy Policy
Effective date: September 11, 2026. Operator: Viktor Grom (sole proprietor, trading as Sealed Ideas), 1755 N Tomahawk Island Dr PMB 1084, Portland, OR 97217, USA.
1. Who is responsible
The data controller is Viktor Grom (sole proprietor, trading as Sealed Ideas), 1755 N Tomahawk Island Dr PMB 1084, Portland, OR 97217, USA. Privacy questions and requests: privacy@sealedideas.com.
2. What we collect, where it comes from, how long we keep it
| Data | Source | Why | Kept for |
|---|---|---|---|
| Name, email, password hash, email confirmation status | You | Account, sign-in, contract | Until you delete the account; then anonymised, see section 8 |
| Listings (public and sealed parts, attachments), bids, questions, answers, reviews, reports | You | Running auctions and sales (contract) | For the life of the marketplace record; anonymised after account deletion |
| Payment references (Stripe customer, session and payment IDs, amounts, payout status), tax and identity verification data | You, Stripe | Payment, payouts, fraud prevention, tax and legal obligations | 7 years (accounting and tax law) |
| Notification and email delivery records | Generated | Delivering and troubleshooting messages (legitimate interest) | 12 months |
| IP address, browser and device information, sign-in and rate-limit records, security logs | Your browser, our hosting provider | Security, abuse prevention (legitimate interest) | 90 days |
| Automated review records (which listing was checked, token counts, verdict) | Generated | Moderation (legitimate interest) | 12 months |
| Anonymous usage statistics: page views, page speed, and which steps of sign-up, listing and checkout are completed (listing id and category only, never who did it) | Vercel Web Analytics and Speed Insights (cookieless) | Understanding usage and measuring campaigns (legitimate interest) | As kept by the provider, without identifiers |
| Campaign parameters of your first visit: utm_* and ref from the link you followed, the referring site's host name, the landing page and the date | Your browser (si_attribution cookie), copied to your account when you sign up | Knowing which campaigns bring sign-ups and sales (legitimate interest) | Cookie: 30 days. On the account: kept with the anonymised record after deletion, as it identifies a campaign, not you |
3. Who processes data for us
| Provider | Role | Data |
|---|---|---|
| Vercel (USA) | Hosting, serverless functions, file storage, analytics, speed measurement | All application data in transit; attached files; anonymous page views, speed metrics and completed-step events (listing id and category, no identifiers) |
| Prisma Postgres (USA, us-east-1) | Database hosting | All stored application data |
| Stripe (USA / EU entities) | Payment processing, seller payouts, identity verification; independent controller for its own obligations | Card and bank details (never stored by us), names, emails, amounts, KYC data |
| Resend (USA) | Transactional email delivery | Email address, name, message content |
| OpenAI (USA) | Automated listing checks | Listing title, public text and, for the pre-publish check when the seller opts in and for moderation on submission, the sealed text. Sent via the API; per the provider's API terms inputs are not used to train models and are retained for abuse monitoring for up to 30 days [to be verified against the current contract]. |
Other users see your name, your listings' public parts, masked bid and question activity, and reviews. Buyers who pay see the sealed part and attachments. Our staff may read content for security, moderation of reports, support and legal compliance.
4. Cookies
We set essential cookies (your session and your theme preference) and one measurement cookie: si_attribution stores the campaign parameters of your first visit (utm_* and ref from the link you followed, the referring site's host name, the landing page and the date) for 30 days, so we can tell which campaigns bring sign-ups. It holds no personal data and is not shared with advertisers. We do not use advertising or cross-site tracking cookies. Analytics itself is cookie-free and anonymous: Vercel Web Analytics counts page views and records which steps of sign-up, listing and checkout are completed, without identifying who completed them.
5. International transfers
Our providers are located mainly in the United States. Where you are outside the country in which data is processed, transfers rely on the providers' standard contractual clauses or equivalent safeguards.
6. Your rights
Depending on where you live you may have the right to access, correct, delete or receive a copy of your data, to restrict or object to processing, and to withdraw consent. Write to privacy@sealedideas.com; we verify requests by confirming control of the account email and answer within 30 days. You may also complain to your data protection regulator. We do not sell personal data and do not share it for cross-context behavioural advertising; if the California Consumer Privacy Act applies to you, this is also your notice of that fact and of the rights above.
7. Children
The Service is for adults (18+). We do not knowingly collect data from minors; if we learn we have, we delete it.
8. Deleting your account
When you delete your account we remove your name, email and password immediately and sign out every device. Listings, bids, questions, answers and reviews remain under “Deleted user” so other people's transactions stay intact; payment and tax records are kept for the period in section 2; backups are overwritten within 30 days.
9. Security
Passwords are hashed with bcrypt, sessions are random tokens stored hashed, all traffic is encrypted in transit, attached files are stored in a private store and served only after an access check, sign-in and reset endpoints are rate limited, and access to production data is limited to named administrators.
10. Changes and contact
We may update this policy; material changes are announced on the Service and by email. Questions: privacy@sealedideas.com, Viktor Grom (sole proprietor, trading as Sealed Ideas), 1755 N Tomahawk Island Dr PMB 1084, Portland, OR 97217, USA.