Privacy Policy

1. Scope and controller

This Policy applies to the Teracotta website, applications, live marketplace, and related services (together, the “Service”). Teracotta, the operator identified in the Service's business information and Transaction communications, is the controller of personal data processed for the purposes described here.

Some providers, such as payment, identity-verification, shipping, or live-video companies, may separately act as controllers for processing they determine. Their own privacy notices also apply. Questions and privacy-rights requests may be submitted through Teracotta Support.

2. Personal data we collect

Account and profile data

Name, display name, email address, selected country, verified mobile number, profile image, account identifier, age confirmation, authentication status, preferences, followed or saved content, and account settings. Supabase processes authentication credentials and phone-verification state, and a configured SMS provider delivers the one-time code. Teracotta does not receive your password in readable form.

Seller and business data

Seller status, shop or boutique details, collaborations, trader status, connected payment-account identifier, onboarding and verification status, payout status, and information needed for tax, fraud, sanctions, identity, or trader-traceability checks. Stripe or another verification provider may collect government identification, date of birth, bank, ownership, and tax information directly and send us verification results rather than the underlying document or full financial details.

Transaction and payment data

Listings, products, bids, maximum bids, purchases, prices, fees, taxes, payment status, payment-provider customer and method identifiers, refunds, disputes, chargebacks, payouts, and accounting records. Payment-card details entered into Stripe's payment interface go directly to Stripe and do not pass through Teracotta's servers.

Shipping and fulfillment data

Recipient name, delivery address, phone number where provided, parcel dimensions and weight, label and rate information, carrier, tracking number and events, delivery status, return information, and evidence supplied for an order, claim, or inspection.

Content, livestream, and communications data

Listings, descriptions, images, public profile content, chat messages, reports, reviews, moderation records, support requests, and communications with us or other Users. If live recording is enabled, we may process livestream video, audio, participant details, session events, recordings, and related metadata for delivery, replay, safety, and Transaction evidence.

Device, usage, and technical data

IP address, browser and device type, operating system, timestamps, pages and features used, referring page, application and API logs, security events, cookie or local-storage identifiers, crash information, and approximate location inferred from IP address. If you enable browser notifications, we process the push subscription endpoint and related device keys needed to deliver them.

3. How we collect personal data

We collect personal data:

• directly from you when you register, create a profile or listing, bid, buy, sell, stream, submit a report, or contact support;
• automatically from your browser, device, Service activity, security logs, cookies, and similar essential technologies;
• from other Users involved in a Transaction, report, collaboration, livestream, or support case;
• from providers such as Supabase, Stripe, Shippo, Agora, Amazon IVS, Vercel, carriers, and browser push services; and
• from public records or authorities where reasonably necessary for verification, safety, fraud prevention, or legal compliance.

4. Why we use personal data and our legal bases

Where we rely on legitimate interests, we consider whether the processing is necessary and balance those interests against your rights. Where processing is required by contract or law, failing to provide the data may prevent us from creating an account, completing a Transaction, paying a Seller, shipping an order, or meeting a legal duty.

5. Auctions and automated processing

Teracotta's auction system automatically applies displayed bid increments, proxy-bid limits, timestamps, and auction rules to determine the leading and winning bid. Payment jobs may automatically attempt authorised charges, release inventory when payment expires, allocate funds, or process approved refunds. These outcomes are based on User instructions, Transaction state, and fixed marketplace rules.

We may also use automated signals to detect security, fraud, payment, or policy risk, but significant enforcement decisions may be reviewed by authorised personnel where required by law. Contact Support to contest an outcome or request human review when applicable.

6. How we disclose personal data

We may disclose personal data to:

• other Users: public profile and listing details, chat and stream participation, and information reasonably needed for a Transaction, delivery, return, collaboration, report, or dispute;
• Supabase: authentication, phone-verification state, database, storage, and realtime infrastructure; a configured SMS provider delivers the one-time code;
• Stripe: payment methods, charges, refunds, Connect seller onboarding, identity checks, payouts, and payment-risk management;
• Shippo, carriers, and fulfillment providers: rates, labels, tracking, delivery, returns, and shipping support;
• Agora or Amazon IVS: live-video transport, session operation, and recording when configured;
• Vercel and technical providers: hosting, content delivery, logs, security, and operation of the Service;
• professional advisers, auditors, insurers, and contractors: where reasonably needed to operate, protect, or review the Service; and
• authorities or other parties: where required by law or reasonably necessary to protect rights, safety, property, Users, the public, or the Service; investigate wrongdoing; collect a debt; or establish, exercise, or defend legal claims.

We may transfer relevant personal data as part of a merger, financing, reorganisation, sale, insolvency, or transfer of all or part of the Service, subject to confidentiality and applicable law. We do not sell personal data or share it for third-party cross-context behavioural advertising. If that practice changes, we will update this Policy and provide any required notice or choice first.

7. Public information and other Users

Profiles, handles, listings, public shows, seller pages, chat messages, and other content you choose to publish may be visible to Users, search engines, and people who are not signed in. Other people may copy or share public content outside Teracotta. Do not publish sensitive information you do not want others to see.

We disclose delivery details only as reasonably necessary to fulfill an order, process a return, or resolve a dispute. Buyers and Sellers who receive personal data must use it only for the relevant Transaction and legal obligations, keep it secure, and not use it for unsolicited marketing or unrelated purposes.

8. International transfers

Our providers and their systems may process personal data outside the country or region where you live, including in places with different data-protection laws. Where required, we use a recognised adequacy decision, approved contractual clauses, certification, or another lawful transfer mechanism and apply supplementary safeguards appropriate to the risk. You may request information about the applicable safeguard through Support.

9. Retention

We keep personal data only as long as reasonably needed for the purposes described here. Retention depends on the data's nature, account and Transaction status, legal and tax periods, payment and chargeback windows, safety and fraud risks, disputes, enforcement needs, and backup cycles.

Account and profile data generally remains while the account is active. Transaction, payment, payout, tax, shipping, moderation, consent, and support records may remain after account closure where needed for legal compliance, accounting, fraud prevention, a dispute, or legal claims. Public content may remain until deleted or the account is closed, subject to copies shared by others and limited backup retention. When data is no longer needed, we delete or anonymise it, or isolate it until deletion is possible.

10. Security

We use technical and organisational measures intended to protect personal data, including access controls, authenticated APIs, row-level database security, encrypted network transport, signed provider webhooks, and restricted secrets. Payment-card entry is handled by Stripe. No system is completely secure, and we cannot guarantee that unauthorised access, loss, or misuse will never occur.

Protect your password and devices, use a unique password, sign out of shared devices, and tell us promptly if you believe your account or personal data has been compromised.

11. Cookies, local storage, and communications

We use cookies and similar browser storage that are necessary for authentication, security, session continuity, preferences, and core Service operation. Your browser may let you block or delete them, but essential features may then stop working. If we introduce non-essential analytics or advertising technologies, we will provide notice and a consent choice where required before using them.

Service, security, payment, and Transaction messages are necessary to administer your account and are not marketing. You can disable optional browser push notifications in your device or browser settings and unsubscribe from marketing messages using the method included in the message. Withdrawing consent does not affect earlier lawful use.

12. Your privacy rights

Depending on applicable law, you may have the right to be informed; access, correct, or delete personal data; restrict or object to processing; receive portable data; withdraw consent; and obtain safeguards relating to automated decisions. You may also object at any time to direct marketing.

Submit a request through Support. We may verify your identity and ask for details needed to locate the data. Rights can be limited where an exemption applies, including where data must be kept for law, another person's rights, fraud prevention, or legal claims. We will respond within the period required by law.

You may lodge a complaint with the privacy or data-protection regulator that has authority where you live, work, or believe an infringement occurred. Contact your local regulator for its complaint procedure.

13. Children

The Service is for adults aged 18 or older. We do not knowingly permit a child to create an account or knowingly collect a child's personal data through the Service. If you believe a child has provided personal data, contact us so we can investigate and take appropriate action.

14. Changes to this Policy

We may update this Policy when our Service, providers, practices, or legal duties change. We will post the new effective date and provide additional notice where required. Material changes apply prospectively.

15. Contact

Contact Teracotta Support with privacy questions, complaints, or rights requests. If you cannot access your account, use the contact method in a Teracotta service email or the current business contact information displayed in the Service.