Privacy Policy | Nearby Garage Sale

1. Overview

Nearby Garage Sale (the "Platform") is owned and operated by Hochcode Technology Private Limited ("Hochcode", "we", "us", "our"), a company incorporated in India with its registered office in Jaipur, Rajasthan, India. This Privacy Policy explains what personal data we collect, why, how we use and share it, and the rights available to you, including under the EU/UK GDPR, India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the US CCPA/CPRA, Brazil's LGPD, and Australia's Privacy Act 1988.

Plain-English summary

We collect only what we need to run a hyper-local marketplace. We verify every account by email — we do not use phone numbers, SMS, or OTP for login or verification. We never sell your personal data. You can access, export, correct, or delete your data at any time from Settings, and this policy explains how.

2. Who We Are

Under GDPR terminology we act as a "controller" of your personal data; under India's DPDP Act we act as a "Data Fiduciary." Under both frameworks, we are the entity responsible for deciding why and how your personal data is processed.

3. Data We Collect

Account data: email address, full name, password (stored hashed), country, phone number, and preferred language. We verify every account by email — we do not use phone numbers or SMS/OTP for verification or login.
Profile data: avatar, bio, city/state/locality/postcode, and date of birth (if provided).
Listing & transaction data: items, photos, chat messages, interest-queue activity, reviews, and ratings. We do not collect or process payment-card or bank details, because all payment happens directly between Buyer and Seller, off the Platform (see our Terms of Service, Section 6).
Technical data: IP address, user-agent, device type, and coarse (country-level) geolocation, used for country-lock enforcement and fraud prevention.
Optional data: precise geolocation (only with your device or browser permission), and NGO or logistics-partner verification documents where relevant.

4. How We Use Your Data

to operate the marketplace and connect Buyers and Sellers within the same country;
to verify your account by email and to prevent fraud, spam, and abuse;
to show the Platform in your preferred language;
to improve the product using aggregated, anonymised analytics;
to comply with tax, accounting, and lawful law-enforcement requests;
to send service updates and security notices, and, where you've opted in, product updates.

5. Legal Bases & Consent

For GDPR/UK GDPR purposes, we rely on: performance of a contract (running your account and Listings), legitimate interest (fraud prevention, safety, and analytics), and consent (optional marketing and precise location).

Under India's DPDP Act, we process personal data on the basis of your consent, given through clear notice at the point of collection, or on another ground the Act permits, such as a specified legitimate use. You may withdraw consent at any time via Settings, without affecting processing already carried out.

6. Sharing & Processors

We do not sell personal data — a disclosure required under CCPA/CPRA. We share limited data with:

Transaction counterparties — for example, the Seller sees your first name and handle once you confirm interest.
Sub-processors under contract — hosting/CDN and security providers, and our email-verification provider. We do not use SMS or OTP providers.
Authorities — only in response to a valid legal order or where otherwise required by law.

Each processor is bound by a data-processing agreement requiring them to protect your data to a standard consistent with this policy.

7. Retention

Account data: retained while your account is active, plus 90 days after deletion for fraud prevention, then anonymised.
Transaction records: retained up to 7 years to meet tax and accounting obligations.
Chat logs: retained for 2 years.
Reports and moderation evidence: retained for 2 years.

8. Your Rights

Right of access — download everything we hold about you via Settings ▸ Export data.
Right to correction — edit your profile at any time.
Right to erasure — Settings ▸ Delete account; we anonymise your data within 30 days, subject to the retention periods in Section 7.
Right to restrict or object to certain processing, including opting out of analytics.
Right to data portability — receive your data in a structured, machine-readable (JSON) format.
CCPA/CPRA (California): right to know, delete, correct, opt out of sale/share (we do neither), and to non-discrimination for exercising these rights.
GDPR/UK GDPR/LGPD: right to lodge a complaint with your supervisory authority.
India DPDP Act: right to a summary of processing, right to correction and erasure, right to grievance redressal (see Section 16), and the right to nominate another individual to exercise your rights in the event of your death or incapacity — contact us to register a nominee.
Australia Privacy Act: right to access and correct your personal information, and to complain to the Office of the Australian Information Commissioner (OAIC) if unresolved.

9. HIPAA & Health Information Note

Nearby Garage Sale is not a covered entity under HIPAA. We prohibit the listing of prescription medications or any protected health information (PHI). If you are a HIPAA-covered entity and a User accidentally shares PHI via chat, notify us at support@nearbygaragesale.com — we will delete the data promptly and assist with breach notifications as needed.

10. International Data Transfers

Data is stored on our hosting provider's global infrastructure. For EU/UK/Swiss residents, transfers to jurisdictions without an adequacy decision rely on Standard Contractual Clauses (SCCs) plus supplementary safeguards. Under India's DPDP Act, cross-border transfer is permitted except to countries the Indian government specifically restricts by notification; we monitor that list and adjust our processors accordingly.

11. Cookies & Tracking

See our full Cookie Policy for details. We use only strictly necessary, preference, and privacy-friendly analytics cookies. We never use advertising or cross-site tracking cookies.

12. Children's Privacy

Consistent with our Terms of Service eligibility rule, the Platform is not directed to, and is not for use by, anyone under 18. We do not knowingly collect personal data from children. If we learn that a child's data was collected without appropriate consent, we will delete it. Parents or guardians can request deletion at support@nearbygaragesale.com.

13. Security

We use HTTPS everywhere; HttpOnly, Secure, and SameSite session cookies; parameterised database queries; a strict Content-Security-Policy; rate-limited login and email-verification attempts; encryption of data in transit and at rest; access controls that limit internal data access to staff who need it; and a moderation team that reviews safety reports within 24 hours.

14. Data Breach Notification

If a data breach is likely to result in risk to your rights and freedoms, we will notify affected Users and the relevant authority — for example, the Data Protection Board of India, or the relevant EU/UK supervisory authority — without undue delay, as required by applicable law.

15. Changes to This Policy

We may update this Privacy Policy. We'll give at least 30 days' notice in-app for material changes, along with a short plain-language summary of what changed. Continuing to use the Platform after the effective date of an update means you accept it.

16. Contact, Grievance Officer & Data Protection Board

Grievance email: support@nearbygaragesale.com

We aim to respond to privacy requests within 30 days. If you are not satisfied with our response, you may escalate as follows:

ceo@nearbygaragesale.com