Controller and scope
- Operator
- Legal name pending — intended Wyoming LLC
- Privacy contact
- Public contact email pending
- Postal address
- Postal address pending
The operator determines how Sibidz uses personal data to run the service. This notice covers its public pages, accounts and auction tools. Your chosen AI assistant and payment provider have their own notices and responsibilities. UK GDPR and EU GDPR rights apply where the relevant law covers the processing; a Wyoming location does not remove those rights.
Information we use and where it comes from
You, your authorized agent and other auction participants supply account names, handles, email addresses and optional contact details; private principal names, countries and representatives; seller applications; lot descriptions, photos, country and city; bids, withdrawals and agreement acceptances; and seller receiving instructions, including a PayPal business email where offered. We also generate account identifiers, credential hashes, verification records, service-credit transactions and timestamps.
Requests expose connection information, including IP addresses, to the hosting service. Sibidz uses a keyed hash of the source address for abuse limits rather than storing it as a public identifier. Tokens and private settlement records are never intended for public pages. Do not include private addresses, credentials, sensitive personal data or unrelated people’s information in public lot text or photos.
Purposes and legal bases
- Contract
- Provide requested accounts and auctions, verify email, publish authorized lots and bids, record accepted terms, calculate results, communicate outcomes and supply the seller and winner with their contract and receiving details.
- Legitimate interests
- Protect accounts, prevent abuse, keep reliable auction evidence, investigate disputes and operate and secure the service. These interests must be balanced against your rights. For a business representative or other person who is not personally a contracting party, these interests may support necessary service records.
- Legal obligations
- Meet applicable recordkeeping, disclosure and rights-handling duties where a specific law requires them.
- Consent
- If a separate optional use requires consent, ask separately. Agreement acceptance is not consent to marketing, advertising or unrelated processing. You may withdraw a consent-based permission for the future without affecting earlier lawful use.
Email and necessary account and contracting details are required for authenticated participation; without them Sibidz cannot verify an account or accept a bid or listing. You may browse public lots without registering. Optional profile contacts are not required.
Public records and other recipients
Lot pages, photos, seller country and city, public account identifiers and handles, bids, withdrawals and auction results are public. They may be copied or indexed by others. Historical handles identify the account at the time of an event. Private principal names, emails, contacts and receiving details are restricted to the relevant parties and authorized operator access; after a sale the seller and winner receive the necessary counterparty contract details.
The service uses DigitalOcean hosting, managed database and object storage, and a configured email delivery provider. Authorized service providers process necessary data to host, secure, store and deliver the service. The operator must confirm the processor list and agreements before live launch. Information may also be disclosed where law requires it, or to advisers handling an actual dispute subject to appropriate confidentiality.
Sibidz does not send a purchase payment to PayPal. The buyer and seller provide information to their chosen payment provider themselves. Your AI client may send authorized tool requests and receive responses under its own privacy terms.
Location and international transfers
The intended operator is in the United States. Hosting, database, storage, email and AI providers can involve other countries. Their actual processing regions and contractual arrangements must be confirmed before live launch. Where UK or EU transfer rules apply, the operator must use an applicable adequacy decision or appropriate safeguards, such as relevant contractual clauses and any necessary additional measures, and make information about the safeguards available on request. This draft does not claim a particular certification, adequacy route or signed transfer agreement.
How long information is kept
Account and contact information is needed while an account is active and for resolving outstanding auctions, requests or disputes. Auction, agreement and service-credit records are retained as evidence of actions and obligations. The operator must set and review a proportionate schedule based on those purposes, applicable legal requirements, dispute periods and rights requests; they are not retained forever merely because a database record is immutable.
Verification codes expire after 10 minutes and their hashes are cleared by the cleanup worker after expiry. Temporary unattached photo uploads expire after 24 hours. Email payloads are cleared when completed, superseded or expired; outbox metadata is removed by cleanup seven days after its expiry. Photos attached to published lots and other historical records currently remain with the auction history. Backup retention and broader account/history deletion periods still need operator confirmation.
There is currently no self-service account deletion. A request needs operator review, including whether erasure, restriction or redaction is required and whether any lawful retention exception applies. Public copies made by others may remain outside the operator’s control.
Your rights, including the right to object
Where applicable, you can request access, correction, erasure, restriction and a portable copy of information, and withdraw consent where it is the basis for a use. You can object to processing based on legitimate interests on grounds relating to your situation. Any direct-marketing objection must be honored. These rights have conditions and lawful exceptions; the operator must explain any refusal and the available complaint route.
Use the privacy contact above once confirmed. The operator should verify identity proportionately, avoid requesting unnecessary documents and respond within the applicable statutory period, normally one month under UK/EU rules, explaining any permitted extension. No public data correction should silently falsify a recorded auction event.
You may complain to the UK Information Commissioner’s Office or your relevant EU supervisory authority, including where you live or work or where an alleged infringement occurred. You do not have to waive that right or first resolve the matter with Sibidz.
Automated rules and human review
Software validates bids against the auction’s reserve, tick, closing time and frozen rules. The standing valid highest bid wins only when the closing result is recorded; a retraction may leave no standing bid. Automated limits can reject requests or restrict account actions to prevent abuse. These decisions can affect your ability to participate or create a purchase obligation in a live auction.
If applicable data-protection law gives you rights concerning a solely automated decision with legal or similarly significant effects, you may request human intervention, explain your position and contest the decision through the operator. The operator must assess the applicable basis and safeguards before live operation; this notice does not promise that a recorded sale can simply be reversed.
Children, security and website storage
Participation is restricted to people aged 18 or older. Sibidz does not request dates of birth; an explicit age declaration is required when accepting an agreement. Contact the operator if a minor’s account or information is identified.
Credentials are hashed and sensitive agreement and receiving details are encrypted. Access is limited by account role and participation. These measures do not make a public HTTP connection private; use a secure connection for real personal or payment information. Public pages do not currently set analytics or advertising cookies or load third-party trackers. Your browser, hosting provider and connected AI client may process connection data separately.
Changes
Notice versions carry a date. Material changes should be communicated before any new use where required. A privacy-notice update does not rewrite frozen auction terms or remove existing rights.