Privacy Policy

Diecast Markets Inc. is responsible for personal information collected through Diecast Markets. This policy describes what we collect, why, who processes it for us, how long we keep it, and how to make a request or complaint. For the current Canada-only marketplace, our privacy program is designed for the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, substantially similar provincial private-sector privacy laws such as Alberta's and British Columbia's Personal Information Protection Acts. The Privacy Officer is accountable for this program and can be reached at privacy@diecastmarkets.com and by mail at po box 68642 brampton RPO great lakes, ON, L6R0J8. We do not sell personal information. Quebec marketplace access is not enabled.

1. Information we collect

Account

Email address, password (stored hashed by our authentication provider), username, display name, and, for sellers, a phone number and its verification status. Accepted policy versions with the time of acceptance and a hashed marker of the browser used, so we can prove which version you agreed to.

Seller identity, tax, and payout information

Seller type, legal name, city and province, and, where a legal reporting or payout rule requires it, primary or residential address, tax residence, a tax identifier such as a SIN or business number, date of birth for an individual, GST/HST registration status and number, and the last four digits of a financial account. Tax identifiers and date of birth are encrypted at rest and are never shown in full in the browser. Stripe Connect account identifiers, onboarding status, and payout capability flags reported by Stripe. Verification status and review timestamps where a review has taken place.

Transactions

Shipping name and address entered at checkout; order details and the stored snapshot of the listing, seller and buyer names, price, and policy versions at the time of purchase; Stripe customer, checkout session, payment, refund, transfer, and chargeback identifiers and statuses; payout status and hold reasons; carrier and tracking numbers; dispute descriptions, evidence, and outcomes; cancellation reasons; reviews you give and receive; and messages between buyers and sellers, which cannot be edited after sending. This includes images sent through marketplace chat and automated moderation records associated with message text or images.

Marketplace activity

Listings you create, including titles, descriptions, condition, price, and photos; listing drafts; moderation decisions and policy categories associated with listing text or images; favourites; cart contents; and market-pricing context attached to a listing when you use the eBay price lookup on it. The free price-check tool sends your search to our pricing provider to return results; we do not keep a per-user history of those searches. Collection Tracking stores the cars you add, including private notes and photos you choose to keep, and uses those records only to show your collection and to warn you when a listing, cart item, or scan looks like a car you already own. An AI scan sends that photograph to OpenAI so it can suggest an identification. The scan cache keeps a hash of the image and the suggestion, not the photograph. OpenAI's own retention of API inputs is governed by OpenAI's terms. This collection description still needs qualified Canadian legal review before it is treated as the final privacy notice.

Technical and security

Authentication session cookies set by Supabase Auth; an admin session cookie on the separate admin sign-in; IP address as forwarded by our host, used in memory to rate-limit phone verification requests and to protect the service, and not stored in a marketplace profile; a hashed browser user-agent marker on legal acceptance records; audit records of significant actions (for example listing creation, checkout start, payment, payout, dispute, and admin actions) with the acting account, its email, the target, and related metadata; Stripe webhook event records; and logs kept by our hosting and database providers for security and troubleshooting.

Premier Partner applications

If you apply to the Premier Partner Program without creating an account, we collect your name, email address, and phone number. If you choose to provide them, we also collect a store, brand, or organization name and a website or social profile. We collect the role you select and the kind of partnership you are interested in. We use that information to review the application and reply to you. Sending an application does not create a marketplace account and does not subscribe you to marketing email.

Communications

Support and legal requests you send us; a log of transactional emails we send you (template, recipient, status, and non-sensitive metadata); in-app notifications; your marketing preference, consent version, consent time and source; and, if you unsubscribe or a marketing email bounces or is reported as spam, the time of that event so we stop sending.

Cookies, browser storage, and analytics

Your cookie choice, theme preference, a phone-verified flag, and an in-progress listing draft may be stored in your browser's local storage. Google Analytics is loaded only after you turn analytics on, and it then processes page views, approximate location derived from IP, device and browser type, and interaction events. We do not send it your name, email, address, tax information, or your account identifier. See the Cookie & Analytics Policy.

2. Why we use it

• To create, secure, and administer accounts, and to verify seller phone numbers.
• To show listings, run search, and operate favourites and the cart.
• To take payment, confirm it with Stripe, and pay sellers through Stripe Connect.
• To ship orders, share tracking, and send transactional notices.
• To review disputes, refunds, cancellations, chargebacks, and reviews.
• To automatically screen marketplace chat text and images for harassment, threats, explicit sexual content, prohibited-item transactions, fraud, personal or payment information, and attempts to move a marketplace transaction off-platform.
• To detect and prevent fraud, abuse, prohibited listings, and unauthorized access, including automated review of listing text and images, and to keep audit records.
• When a seller chooses AI-assisted listing creation, up to three uploaded listing photos go to OpenAI to suggest editable title, description, brand/series and release year. Sellers choose condition, price and shipping; AI cannot publish listings.
• To keep accounting, financial, and tax records, including platform-operator reporting where the law requires it.
• To record which policy versions you accepted and when.
• To answer support, privacy, and legal requests.
• To send marketing email only after you opt in, and to honour unsubscribes.
• To measure how the site is used, only after you turn analytics on.

We identify the purposes for collecting, using, and disclosing personal information at or before collection and use information only for purposes a reasonable person would consider appropriate in the circumstances. We obtain meaningful consent where Canadian privacy law requires it, including separate consent for optional marketing and analytics. Canadian law also permits certain collections, uses, or disclosures without consent, for example where a statute requires reporting, where an exception for fraud or security applies, or where another statutory exception is satisfied. We do not rely on a generic contract clause to create a new purpose for personal information.

3. Service providers and other recipients

Supabase stores account, marketplace, moderation, and transaction data and provides authentication. Vercel hosts the application. OpenAI processes listing and marketplace-chat text and images that we submit for automated safety, prohibited-item, privacy, fraud, and off-platform-transaction moderation. Voluntary AI listing assistance also uses OpenAI to process up to three uploaded listing photos. Stripe processes payments, subscriptions, and Stripe Connect payouts, and receives the information Stripe needs for onboarding and payment, including seller identity details you give Stripe directly. Resend sends email. Twilio sends phone verification codes. eBay's API returns pricing data for the price-check tool and listing context. Google Analytics processes usage data only after you consent. Stallion Express provides shipping-cost estimates to sellers and receives only the destination country, postal code and package details entered into the estimator; it receives no buyer names or addresses while label purchasing is off. Each provider acts on our instructions to deliver its service.

The other party to your transaction receives what they need to complete it: a seller sees the buyer's shipping name and address and public name; a buyer sees the seller's public name. Messages are visible to both parties. Chat text and images may also be processed by our automated moderation providers and, when flagged or needed for a dispute, safety review, or enforcement action, may be reviewed by authorized Diecast Markets personnel. Reviews are public.

We disclose information when a statute, court order, or regulator requires it, including to the Canada Revenue Agency where digital platform operator reporting applies, and to law enforcement where the law permits or requires. We may disclose information to defend a legal claim, to enforce our terms, or to a successor if the marketplace is sold, with notice to you.

4. Cross-border processing

Some providers, including OpenAI, Stripe, Vercel, Supabase, Resend, Twilio, eBay, and Google, may store or process information in the United States or other countries. While information is outside your country it can be subject to the laws of the country where it is processed, and courts, law enforcement, and regulators there may be able to access it. We limit what each provider receives and use contractual, access-control, encryption, and other technical safeguards appropriate to the service. Transferring information to a service provider does not transfer our accountability for it. We assess providers that handle personal information, including their purposes, safeguards, subprocessors, processing locations, retention and deletion practices, and use contractual or other measures to require protection comparable to the protection required of us under applicable Canadian privacy law.

Our service providers can change as our infrastructure changes. We keep this notice current enough to explain the categories of providers and material cross-border processing, and you can contact privacy@diecastmarkets.com for current information about service-provider processing and safeguards applicable to your account.

5. Retention

We keep information while your account is open. After closure we keep what is needed for the purposes above: order, payment, payout, refund, dispute, chargeback, message moderation, and listing moderation records for the period required for accounting, tax, and platform reporting; legal acceptance records as evidence of the contract; security and audit records for fraud prevention; and marketing suppression records so we do not email you again. Messages and reviews tied to an order are kept with that order. Listing drafts and browser storage remain only in your browser until you clear them. Business, accounting, transaction and tax records are generally retained for the Canadian recordkeeping period that applies to them (commonly six years from the end of the relevant tax year), and longer only where another legal obligation, dispute, audit, investigation or litigation hold requires it. Encrypted tax identifiers are kept only for the retention period that applies to the reporting rule that required them. We maintain documented retention and disposal rules and delete, erase, or anonymize personal information that is no longer needed for an identified purpose or legal obligation. A deletion request is completed for everything not covered by a retention requirement.

6. Safeguards

Access to data is controlled by database row-level security and server-only service roles. Tax identifiers and dates of birth are encrypted with a key held outside the database, are never returned to the browser in full, and are excluded from logs and emails. Payment card details are handled by Stripe and never reach our servers. Sensitive user-provided text is escaped before it is placed in email. Administrative access requires a separate sign-in. No system is perfectly secure; report a security concern to security@diecastmarkets.com.

7. Your choices and rights

You may request access to, or correction of, your personal information, or request deletion or account closure, from the privacy request page or by emailing privacy@diecastmarkets.com. For requests governed by PIPEDA, we respond with due diligence and no later than 30 calendar days after receiving the request, unless a permitted extension applies; if we extend the period, we give the notice and complaint information required by law. Where an applicable provincial law sets a different deadline, we follow that deadline. We will explain any lawful refusal, redaction, or information we must keep and why, and tell you about the applicable complaint route. Account closure is a request: it stops marketplace use and removes public content, but does not erase records that tax, accounting, dispute, security, or other law still requires us to keep, and it cannot be completed while an order or dispute is open.

You may withdraw optional consent at any time: unsubscribe from marketing through the link in any marketing email, and turn analytics off with Cookie Settings in the footer. Withdrawing consent does not affect processing that already happened or processing needed to complete an order or meet a legal duty.

8. Breach notification

For Canadian personal information, if a breach of security safeguards creates a real risk of significant harm, we will notify affected people and the Office of the Privacy Commissioner of Canada as soon as feasible and as the law requires. We keep a record of every breach of security safeguards for at least 24 months from the day we determine the breach occurred, including breaches that do not meet the notification threshold. Where Alberta privacy law applies, we also assess notification duties to Alberta's Information and Privacy Commissioner and affected individuals. Where British Columbia privacy law applies, we assess notification and mitigation as part of our safeguard obligations and current provincial guidance.

9. Canadian privacy rights and provincial laws

Canadian privacy rights can depend on the province and the nature of the transaction. PIPEDA applies to commercial activities within its scope and continues to apply to personal information crossing provincial or national borders. Alberta and British Columbia have private-sector privacy statutes that may apply to activity within those provinces. Our privacy request page is the common entry point; you do not need to identify the statute yourself.

• Ask whether we hold personal information about you and request access to it, subject to lawful exceptions.
• Challenge the accuracy and completeness of personal information and ask us to correct it where appropriate.
• Withdraw optional consent, subject to reasonable notice and legal or contractual limits that we explain.
• Ask how personal information has been used and disclosed, to the extent applicable law requires.
• Challenge our privacy practices with the Privacy Officer and, if unresolved, complain to the applicable federal or provincial privacy regulator.

10. Children

The marketplace is for people who have reached the age of majority. We do not knowingly collect information from minors. If you believe a minor has an account, contact privacy@diecastmarkets.com.

11. Complaints

Contact the Privacy Officer first at privacy@diecastmarkets.com. You may also complain to the Office of the Privacy Commissioner of Canada or to the privacy commissioner of your province where provincial law applies, including the Office of the Information and Privacy Commissioner of Alberta or British Columbia where applicable. For Canadian commercial electronic messages you may also contact the CRTC.

12. Changes

A material change to this policy gets a new version identifier and effective date and is posted in the Policy Center. Where a change needs your consent, we will ask for it. The Marketplace Terms and the Cookie & Analytics Policy are separate documents.