1. Introduction
EnjoyPrices ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect when you use enjoyprices.com, how we use it, and your rights regarding your data.
2. Information We Collect
Information you provide directly
- Account data: email address, username, password (hashed), and optionally a profile avatar.
- Seller verification: government-issued ID photo submitted during seller application. This is deleted immediately after review.
- Payment data: Withdrawal details (USDC wallet address, Payoneer ID, or bank IBAN). We do not store full card numbers — card payments are processed directly by Stripe.
- Communications: messages sent via order chat, direct messages, and support tickets.
- Listings and transactions: listings you create, orders you place or fulfill, reviews, and disputes.
Information collected automatically
- IP address: We log IP addresses on account actions, order placements, and checkout attempts for fraud detection and abuse prevention. IP data is associated with your account activity and retained as part of our fraud protection system.
- Log data: Browser type, referring URL, and pages visited are recorded by our hosting infrastructure for operational monitoring.
- Rate-limit identifiers: IP addresses are also temporarily stored for rate limiting purposes (auto-expires; no personal profiles built from this data).
Information from third parties
- Google OAuth: If you sign in with Google, we receive your email address and display name from Google. We do not receive your Google password or access other Google services.
3. How We Use Your Information
- To create and manage your account and authenticate your sessions.
- To process orders, payments, and withdrawals.
- To send in-app notifications about your orders, requests, and account activity.
- To enforce our Terms of Service and investigate abuse, fraud, or violations.
- To provide customer support and respond to inquiries.
- To improve the Platform through aggregated, anonymised analytics.
- To comply with applicable legal obligations.
4. How We Share Your Information
We do not sell your personal data. We share information only in the following circumstances:
- Between buyers and sellers: Your username is visible to the counterparty on any order. Your email is never shared with other users.
- Service providers (sub-processors): We rely on the following third-party sub-processors to operate the Platform. Each processes only the data necessary for their specific function:
- Supabase — database hosting and user authentication
- Stripe — credit/debit card payment processing
- NOWPayments — cryptocurrency payment processing
- Upstash — rate limiting (stores IP addresses temporarily)
- Cloudinary — storage of media files sent in order and direct message chats
- Resend — transactional email delivery
- DigitalOcean — application hosting infrastructure
- Legal requirements: We may disclose information if required by law, court order, or to protect the rights and safety of EnjoyPrices or its users.
5. Cross-Border Data Transfers
EnjoyPrices operates globally and relies on sub-processors located in the United States and potentially other countries outside your country of residence. By using the Platform, you acknowledge that your personal data will be transferred to and processed in these jurisdictions, which may have data protection laws that differ from those in your home country.
Where required by applicable law (including the EU General Data Protection Regulation), we rely on appropriate safeguards for these transfers, such as Standard Contractual Clauses or other mechanisms recognized by the relevant authorities. For questions about the safeguards in place, contact us at [email protected].
6. Data Retention
- Account data is retained for as long as your account is active.
- Seller ID photos are deleted immediately after application approval or rejection.
- Order records, transaction history, and chat messages are retained for a minimum of 2 years for dispute resolution and legal compliance.
- Support ticket data is retained for 1 year after closure.
- Rate-limit records in Redis expire automatically (no persistent storage).
7. Cookies and Local Storage
We use Supabase authentication cookies to maintain your session. We store your theme preference (dark/light) and selected currency in your browser's localStorage. We do not use third-party advertising or tracking cookies.
8. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your account and associated personal data, subject to legal retention obligations.
- Portability: Request your data in a machine-readable format.
- Objection: Object to certain processing activities.
Important Limitation on the Right to Deletion
The right to deletion is not absolute. We reserve the right to retain personal data — including IP logs, chat logs, order records, and financial transaction data — for users who:
- have been permanently banned from the Platform for fraud, abuse, or serious violations;
- are under active investigation for suspected fraudulent activity; or
- are involved in an active escrow dispute, chargeback, or legal proceeding.
This retained data is used solely for fraud prevention, chargeback defense, legal compliance, and the protection of other users. It is not used for marketing purposes.
To exercise any of these rights, contact us via the support widget or at [email protected].
9. Security
We implement industry-standard security measures including TLS encryption in transit, hashed passwords, Row-Level Security (RLS) on all database tables, input sanitization, and CSP headers. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.
10. Children's Privacy
EnjoyPrices is not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. This age threshold is set in compliance with default EU GDPR standards and supersedes the U.S. COPPA minimum age of 13 on a global basis. If you believe a child under 16 has provided us with personal information, please contact us and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy on this page with a revised "Last updated" date. Continued use of the Platform after changes constitutes acceptance of the updated policy.
12. Contact
For privacy-related questions or requests, contact us via the support widget on this site or email us at [email protected].