Privacy

What we collect

• Account: name, email, phone, city, region, country, role, and a hashed password.
• Session: a signed cookie so you stay signed in. We do not use advertising pixels.
• Marketplace activity: approvals, max bids, watchlist, item questions, and contact inbox notes.
• Seller content: auctioneer profile, auctions, item photos, and terms of sale you publish from the desk.

Who sees it

The auctioneer on an auction can see bidders who requested approval, the absentee book, and questions on their items — enough to approve buyers and invoice after the gavel. Company admin can see accounts, auctions, messages, and an audit log to keep the marketplace clean. Other bidders see public auction copy and current bid, not your max or email.

Email

We send confirmation, password reset, and inbox replies from directauctions.ai through Mailgun when a sending key is configured. Until that key is set, those messages stay as an in-app preview link on your account so the loop still works locally.

What we do not collect

Direct Auctions does not take payment cards, bank details, or shipping checkout. Hammer price, premiums, tax, and pickup are settled between you and the auctioneer. Do not enter card numbers into Direct Auctions.

Retention

Production will keep account and bid records in Postgres so listings survive deploys. This preview can still run in server memory — a restart reseeds demo data. When Postgres is connected, we keep records for as long as the account and related sales need them for the absentee book and audit, and we honour a deletion request sent through Contact unless an auctioneer still needs the book for a sale you bid in.