Privacy Policy

Version 2.2Last updated 30 October 2026

1.Introduction

This Privacy Policy explains how Auctionhouse, MB ("AuctionHouse", "we", "us") collects, uses and shares personal data when you use the AuctionHouse marketplace and related services (the "Platform"), and the rights you have. We are the data controller for that processing. Terms not defined here have the meaning given in our Terms of Service.

2.Who we are

The data controller is Auctionhouse, MB, a company registered in Lithuania (company code 308097132). For any privacy question, or to exercise any of the rights described below, contact us at admin@auctionhouse.pro and we will respond within one month. Our registered address is in "Contact" at the end of this policy.

3.Data we collect

Depending on how you use the Platform, we collect:

  • Account data — your username, email address, password (stored only as a secure hash), and any display name, bio, country or avatar you add.
  • Authentication data — where you sign in with a third-party provider (such as Google or Discord), the identifier that links your account to that provider.
  • Transaction data — orders, listings, payments, payment and delivery status, disputes, reviews, and your completed-sales history (which determines your seller tier).
  • Payment data — handled by our payment providers; we receive limited confirmation and reference data, not full card numbers. Where you are paid in crypto-assets, we store the payout address you give us and the network you choose, so we can send your money and evidence that we did.
  • Selling identity and team data — the shop you sell through, who else may act for it, and what they are permitted to do.
  • Communications — messages you send to other users or to support, and reports you file.
  • Usage and device data — IP address, device and browser information, pages viewed, when you were last active, and similar diagnostic data collected automatically, including through cookies and similar technologies.
  • View measurement — so sellers can see how their listings are performing, we record that a listing or profile was viewed, once per viewer per day. Signed-in views are recorded against your account; for everyone else we store only a short code derived from IP address and browser, which we never publish and use only to avoid counting the same visitor twice.

4.Seller and payout information

When you submit seller details, apply for a Shop or use bank withdrawals, we collect and process the information needed to administer selling access and withdrawal eligibility:

  • Seller details — legal name, address, country and contact phone number, individual or business details, trade-register number and optional VAT number where applicable, and your declaration and its date.
  • Shop application information — shop name, contact details, links, notes and related messages you supply, application status and decision records.
  • Bank withdrawal information — Payment-provider connected-account and bank-account references, country, verification and payout-readiness status, outstanding requirements and related payment records.

Our payment provider collects the identity and bank information required for its verification through provider-hosted onboarding. AuctionHouse stores the account references and status information needed to operate bank withdrawals. Seller declarations, Shop approval and payment-provider verification are separate records.

Seller declarations and application information are available to the account owner and authorised staff as needed to administer the account, application or withdrawal. Internal decision notes are restricted to authorised administrators. Public profiles display Shop verification status and relevant public seller information; full seller declarations, contact addresses and payment-account details are not published as profile content.

5.Payment providers

Payments may be processed by third-party payment service providers. Depending on the payment method selected, these providers may independently collect and process payment, identity, fraud-prevention or compliance information.

6.How and why we use your data

We process personal data to:

  • provide the Platform — create your account, publish listings, process orders, operate payment protection and payouts, and enable messaging (legal basis: performance of a contract);
  • keep the marketplace safe — verification, moderation, fraud and abuse prevention, and enforcing our Terms (legal basis: legitimate interests, and legal obligation where applicable);
  • process payments and payouts, and comply with applicable financial, tax, anti-money-laundering and sanctions obligations (legal basis: legal obligation and contract);
  • measure how listings and profiles perform, so sellers can see their own results (legal basis: legitimate interests);
  • communicate with you about orders, security and service changes (legal basis: contract and legitimate interests);
  • improve and secure the Platform, including analytics and diagnostics (legal basis: legitimate interests);
  • send optional marketing, only where you have opted in, which you can withdraw at any time (legal basis: consent).

7.Who we share data with

We share personal data with:

  • other users, as needed to complete a transaction — for example a Buyer and Seller see each other's username, ratings and the information required to fulfil an order;
  • payment providers and crypto-asset payment processors — transaction references, amounts, currencies and order information needed to process payments and payouts; for connected-account verification and bank withdrawals, account details and references needed for those services. Providers may also collect payment, identity and bank information directly through their own pages;
  • hosting, storage and diagnostic service providers — account and transaction records, messages, uploaded files and technical logs needed to operate, secure and troubleshoot the Platform;
  • email service providers — email addresses and service-message contents, including account notifications and Support correspondence;
  • sign-in providers — authentication requests and the account identifier and authorised profile information used to link your sign-in to the Platform;
  • advertising measurement providers — purchase details for Google Ads measurement and purchase details plus a hashed email address for Microsoft Advertising conversion matching;
  • analytics service providers — device and usage information, listing, shop and order identifiers, and transaction-event amounts and currencies used to measure the service;
  • other people acting for the same shop as you, who can see that shop's listings, orders and messages;
  • authorities, advisers or acquirers where required by law, to enforce our Terms, to protect rights and safety, or in connection with a corporate transaction.

A provider may process data on our instructions for a particular service and act as an independent data controller for other purposes, such as its own account security, fraud prevention, legal compliance or product improvement. Analytics data is also shared with the analytics provider for product and service improvement, aggregated business insights, technical support and business recommendations. Those independent purposes are governed by the relevant provider's privacy notice.

We do not sell your personal data.

8.International transfers

Our main application database and uploaded-file storage are hosted in Poland, within the European Economic Area (EEA). Website delivery uses global infrastructure. Email, sign-in, analytics and payment services, and provider support or other authorised access, may involve processing outside the EEA, including in the United States. The location of our main stores does not mean that all processing takes place in the EEA.

Our cloud hosting terms include the European Commission's Standard Contractual Clauses for relevant international transfers. The mechanism for other transfers depends on the recipient and service: an applicable adequacy decision or appropriate safeguards, such as Standard Contractual Clauses, may apply. Contact us at admin@auctionhouse.pro for information about a particular transfer and how to obtain a copy of the applicable safeguards.

9.Cookies and similar technologies

Cookies, local storage and session storage keep you signed in, remember preferences, preserve work and measure use of the Platform. AuctionHouse manages the authentication and application storage below; Google provides analytics and advertising measurement, and Microsoft provides advertising measurement.

On your first visit we ask whether to allow Site improvement (Google Analytics). Essential storage keeps sign-in, checkout, saved work and settings working. Google Ads and Microsoft Advertising measurement run independently of this cookie choice, including before you answer and after Reject. Your saved Site improvement choice stays in ah:consent on this browser until you change or clear it; updates and its age do not make us ask again. You can change or withdraw Site improvement from Cookie settings at the bottom of every page, or in Settings → Notifications when signed in. Withdrawing Site improvement deletes its cookies on this site and stops further Analytics collection; it does not stop Google Ads or Microsoft Advertising. Browser settings and provider controls can block or clear their cookies. Orders, payments, Balance, refunds and Support do not depend on the Site improvement choice.

  • Sign-in — ah_refresh keeps your session signed in. It is a browser-session cookie unless you choose remembered sign-in, when its expiry is 14 days and is renewed on session refresh. ah_oauth protects Google or Discord sign-in and account linking; it expires after ten minutes and is removed on the callback.
  • Sign-in markers — ah:signed-out records an unfinished sign-out until the server confirms sign-out or a successful sign-in clears it; ah:last-provider remembers your previous sign-in provider until changed or cleared; ah:signin-safety-tip remembers that you dismissed the safety tip on the sign-in page until cleared. The tab-only ah:external-sign-in marker is used once on return from sign-in and is valid for 15 minutes.
  • Preferences — auctionhouse.theme, auctionhouse.currency, auctionhouse.sound.message, auctionhouse.sound.boost, auctionhouse.admin.density and ah:wallet-hidden remember appearance, display currency, sounds and display choices in local storage until changed or cleared.
  • Working state — ah:recent-searches, ah:recon-seen, ah:sv-queue-dismissed, ah:worker-intro-seen and ah:acting-shop remember searches, read or dismissed prompts and the selected Shop. They remain in local storage until updated or cleared; recent-search and read/dismissal markers are cleared on sign-out. Account/Shop-scoped ah-quick-replies entries remain until cleared, and ah:sell-draft entries are valid for seven days or until the draft is cleared or successfully saved to the Platform. Delivery credentials are excluded from these saved listing drafts.
  • Referrals (essential) — when you follow an affiliate link, its code is stored as ah.referral in local storage so the affiliate who sent you is credited if you create an account, including through Google or Discord. It holds only the code and the time of the click, is valid for up to 30 days, and is cleared after successful attribution, a final rejected attribution or sign-out.
  • Your cookie choice — ah:consent records your Site improvement choice and when you made it, until you change it or clear browser storage. Saved records may retain a retired advertising field for compatibility; it no longer controls advertising measurement.
  • Tab state — ah:listing-resume remembers an intended listing action for up to 30 minutes and is consumed on return; ah:payment-sent entries record a payment-sent action for up to six hours. ah:analytics entries prevent repeated analytics events within a tab session and are written only when Site improvement is allowed. ah:ads and ah:google-ads entries prevent duplicate purchase conversions for Microsoft and Google respectively, independently of the Site improvement choice. ah:client-error-reports limits diagnostic reports for the tab, and ah:stale-chunk-reload prevents repeated recovery reloads within a one-minute window. These session-storage entries end with the tab session or are cleared earlier by their flow.
  • Microsoft Advertising measurement — Microsoft Advertising uses its Universal Event Tracking tag to measure visits and successful purchases, with the order value, currency and a stable order reference. For enhanced conversions, we share a normalized SHA-256 hash of your account email with Microsoft to match a purchase to an ad interaction. We do not collect a phone number for this purpose, send passwords or payment credentials, or enable personalized advertising. Microsoft may use this data for its own advertising-service purposes under its Privacy Statement at https://privacy.microsoft.com/privacystatement. UET may use _uetvid (up to 13 months), _uetsid (up to one day) and _uetmsclkid (up to 90 days) cookies or corresponding browser storage; browser restrictions may shorten these periods.
  • Google Ads measurement — Google Ads measures visits and successful purchases using the purchase value, currency, a stable order reference and ad-interaction information. Its Conversion Linker can use first-party _gcl_* cookies or browser storage to connect a purchase with an ad click; the configured cookie lifetime is up to 90 days and browser restrictions may shorten it. This integration does not send your email or phone to Google Ads, and personalized advertising stays off. Google processes measurement data under its Privacy Policy at https://policies.google.com/privacy.
  • Site improvement (optional) — only after you allow it, Google Tag Manager loads Google Analytics to measure page visits and marketplace actions, such as checkout, purchases and offers. Google Tag Manager also delivers Google Ads and Microsoft Advertising measurement independently of Site improvement. Google Analytics runs only with Site improvement allowed; earlier actions are not replayed. Google Analytics uses _ga to distinguish browsers and _ga_8CN5YXRGZ4 to maintain session state. Their configured expiry is up to two years and may be renewed during use; browser restrictions can shorten that lifetime.

Local storage can remain on your device until cleared. A validity period means the Platform stops using an expired entry when it checks it; it does not guarantee that the browser removes the stored entry at that instant. Browser settings let you block or delete cookies and site storage. Blocking necessary storage can affect sign-in or saved work. Browser blocking or tracking protection may also prevent analytics collection.

Separately, our servers count views of listings, seller profiles and promoted listings so sellers can see how their pages perform. This uses no cookies or browser storage. For signed-out visitors, repeat views are recognised by a one-way hash of the IP address and browser details, and only counts are shown to sellers.

Payment and sign-in providers may also use cookies or similar technologies on their own pages, under their own privacy notices and controls.

10.How long we keep data

We retain transaction, payment and financial records for as long as reasonably necessary to provide our services, and for the periods required by applicable accounting, tax, fraud-prevention, dispute-resolution and other legal obligations.

Support messages, contact-form text and emailed replies are kept for 24 months after the request is closed, and then deleted automatically. This follows the final closure of each individual request; open or reopened requests are protected. Specifically necessary messages or replies may be held for a dispute or legal claim, with a recorded reason and review date, until authorised staff release the hold. Other requests in the same Support chat have their own retention periods.

Ordinary transaction chats and dispute text are kept for 24 months after final order or related-case closure, then removed automatically. Report text follows final related-report closure. Open or reopened cases and specifically necessary content held for a dispute or legal claim are protected, with a recorded hold reason and review date until authorised release. Required financial records and decision or audit history follow their separate retention requirements.

Optional image and PDF attachments are stored privately and deleted six months after final Support request or dispute and order closure. Open or reopened cases are protected. Specifically necessary evidence may be held with a recorded reason and review date until authorised release. Unsubmitted uploads expire after 24 hours.

Encrypted instant-delivery details stored with a purchase are available for 30 calendar days after final order or related-case closure, then removed automatically. Open or reopened cases delay expiry. Specifically necessary delivery details may be held for a dispute or legal claim with a recorded reason and review date until authorised release. Your receipt and required financial records remain available after delivery details expire. This shorter period applies to structured instant-delivery details; messages and attachments follow their separate periods above.

Security and diagnostic logs have an initial retention period of 90 days. Longer retention requires a justified need and review. This operational-log period does not replace the separate retention requirements for financial records, decision history or specifically held case evidence.

Other personal data is retained only for as long as necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law.

11.Your rights

Subject to applicable law, you have the right to access, correct, delete or restrict the processing of your personal data, to object to certain processing, to data portability, and to withdraw consent where processing is based on consent.

You can update your profile, email, password and notification preferences in account settings. To request access to or export of your data, deletion, restriction or objection, contact Support, use our contact page or email admin@auctionhouse.pro. We may verify your identity proportionately and retain records required for financial or legal obligations, necessary dispute evidence or other applicable exceptions. We will explain any limits on fulfilling your request.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data-protection supervisory authority. We ask that you contact us first so we can try to resolve your concern.

12.Security

We use technical and organisational measures designed to protect personal data — including encryption in transit, hashing of credentials, access controls, and encryption of sensitive delivery content at rest. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to respond to incidents appropriately.

13.Children

The Platform is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a minor has provided us with personal data, contact us and we will take appropriate steps to delete it.

14.Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "last updated" date and, for material changes, take reasonable steps to notify you.

15.Contact

For privacy questions or to exercise your rights, contact admin@auctionhouse.pro or use our contact page. Auctionhouse, MB, company code 308097132, Vaduvos g. 21-47, LT-02305 Vilnius, Lithuania.