AuClose — Privacy Policy
Last Updated: April 2026
Version: 1.0
Effective Date: [April, 5 2026]
1. Introduction
AuClose LLC ("AuClose," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, share, and protect your personal information when you use the AuClose mobile application and related services (collectively, the "Platform").
This policy is designed to comply with applicable U.S. federal and state privacy laws, including the Children's Online Privacy Protection Act (COPPA), the FTC Act, the New Mexico Data Breach Notification Act (NMSA § 57-12C), and applicable provisions of the Gramm-Leach-Bliley Act (GLBA) to the extent they apply to our payment-adjacent services.
By using the Platform, you consent to the data practices described in this policy. If you do not agree, do not use the Platform.
AuClose LLC
[INSERT REGISTERED ADDRESS], New Mexico
[INSERT EMAIL]
[INSERT PHONE]
2. What We Collect
2.1 Information You Provide
Account Registration
Full legal name
Email address
Mobile phone number
Username
Password (stored in hashed form — we never access your plaintext password)
Biometric Identity Verification (Trinity — Tier 1)
AuClose uses Stripe Identity, a third-party service operated by Stripe, Inc., to verify government-issued ID and perform a biometric selfie match. Through this process, Stripe collects and processes:
Images of your government-issued photo ID;
A live selfie or video selfie for biometric matching.
AuClose does not receive, store, or process your raw biometric data or ID images. We receive only a verification status (verified / not verified). Stripe's collection and handling of your biometric data is governed by Stripe's Identity Privacy Notice. By submitting to verification, you consent to Stripe's biometric data processing.
Payment Information (Trinity — Tier 2)
Payment method data is collected and stored exclusively by Stripe, Inc. AuClose receives and stores only:
The last 4 digits of your card;
Your Stripe customer ID and payment method reference token.
We do not collect or store full card numbers, CVVs, or bank account credentials.
Address Information (Trinity — Tier 3)
Full residential address (used for verification and pickup coordination only)
Converted to an approximate geospatial H3 Resolution 8 cell index for local discovery (see Section 5)
Listing and Transaction Content
Item title, description, and condition
Listing images and photos
Answers to AI-generated condition questions (Director Mode)
Auction configuration and pricing
Pickup preferences and scheduling
Bounty Board Content
Bounty title, item specifications, and budget
Desired pickup window
2.2 Information Collected Automatically
Transaction and Behavioral Data
Bids placed, auctions entered, auctions won/lost
Listings created and sold
Pickup and handoff events (arrival timing, PIN usage, completion status)
Karma-relevant events (no-shows, late arrivals, payment failures, clean completions)
Watchlist activity, listing views, and search interactions
Device and Technical Data
Device type, operating system, and app version
IP address at the time of session
Push notification tokens
Crash reports and diagnostic data
Location Data
Approximate location derived from your registered H3 cell index — not real-time GPS tracking
The Platform does not run location tracking in the background
2.3 Information from Third Parties
Stripe: Verification status, payment authorization results, payout status
Google Maps / Geocoding API: Address validation and coordinate conversion
Google Gemini: AI-generated listing questions based on item category (we do not send your personal information to Gemini — only item category and context)
3. How We Use Your Information
Purpose Information Used Account creation and authentication Name, email, phone, password hash Trinity of Trust verification Identity (via Stripe), payment method, address Operating auctions and processing bids Bid history, auction activity, payment holds Processing payments and seller payouts Stripe customer/account IDs, payment reference Calculating Karma scores Transaction events, handoff data, Chip Ratings Powering local discovery H3 cell index (approximate location) Sending transaction notifications Push tokens, email, phone AI-assisted listing creation Item category and context only (not PII) Fraud detection and trust enforcement Account activity, device data, payment patterns Improving the Platform Anonymized and aggregated usage data Complying with legal obligations As required by applicable law Communicating Platform updates Email address
We do not sell your personal information to third parties. We do not use your personal information for advertising.
4. Biometric Information
AuClose recognizes that biometric information — including facial geometry derived from identity verification selfies — is sensitive personal data.
As described above, biometric verification is performed exclusively by Stripe Identity. AuClose does not receive, retain, or use your biometric data. Your consent to biometric collection is obtained by Stripe at the point of verification. Stripe's retention and deletion practices are governed by Stripe's Identity Privacy Notice.
If you reside in a state with a specific biometric privacy law (such as Illinois' BIPA, Texas' CUBI, or Washington's MY Health MY Data Act), Stripe's collection of your biometric data is subject to the requirements of that law. Because AuClose does not itself collect or process biometric data, we are not independently subject to those statutes with respect to your identity verification, but we encourage you to review Stripe's disclosures.
5. Geospatial (Location) Data
AuClose uses Uber H3 geospatial indexing at Resolution 8 to convert your registered address into an approximate geographic cell (roughly 0.74 km² average area). This approximate cell index — not your precise address — is used to:
Match your listings with nearby buyers;
Power the drive-time discovery algorithm; and
Display approximate proximity indicators to buyers (e.g., "15 min away").
Your full residential address is only disclosed to the winning buyer of your listing, after a successful payment authorization, for the purpose of arranging pickup. It is not displayed publicly on your listing or profile.
6. How We Share Your Information
We do not sell your personal information. We share information only as follows:
6.1 With Other Users
Your username, Karma score, badge portfolio, and listing content are visible to other users on the Platform.
Your residential address is shared with the winning buyer of your listing after payment authorization, for pickup purposes only.
Card details are visible only to you in your account settings (last 4 digits only).
6.2 With Service Providers
Provider Role Data Shared Stripe, Inc. Payment processing, identity verification, Connected Accounts Payment reference, verification results, transaction amounts Supabase, Inc. Cloud database, authentication, storage, backend All Platform data (processed under data processing agreement) Google LLC Address geocoding, Gemini AI (listing questions) Address data for geocoding; item category/context for AI (not PII) Apple / Google Push notification delivery Push tokens, notification content
All service providers are contractually required to process your data only for specified purposes and in compliance with applicable law.
6.3 Legal Disclosure
We may disclose your personal information to law enforcement, regulatory agencies, or courts when required by law, valid legal process (such as a subpoena or court order), or when we reasonably believe disclosure is necessary to prevent fraud, protect safety, or comply with legal obligations.
6.4 Business Transfers
In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the successor entity, subject to equivalent privacy protections. We will notify you via email and/or in-app notice before any such transfer.
7. Data Retention
We retain personal information for as long as your account is active and for a period thereafter as required by law or legitimate business need.
Data Type Retention Period Account and profile data Duration of account + 5 years post-closure Transaction records 7 years (federal tax and financial records) Karma and badge history Duration of account + 3 years Identity verification records Verification status retained for account lifetime; raw biometric data retained by Stripe per their policy Listing content and images Duration of account + 12 months Anonymized analytics Indefinitely Deleted account PII Deleted or anonymized within 90 days of account closure, subject to legal holds
8. Your Privacy Rights
8.1 Access and Portability
You may request a copy of the personal information we hold about you by contacting us at [INSERT EMAIL]. We will respond within 45 days.
8.2 Correction
If you believe information we hold is inaccurate or incomplete, you may request correction through your account settings or by contacting us.
8.3 Deletion
You may request deletion of your account and associated personal information. We will process deletion requests within 90 days, subject to legal retention obligations. Deletion forfeits your Karma history, badges, and any active listings or open transactions.
8.4 Opt-Out of Non-Essential Communications
You may opt out of marketing communications at any time using the unsubscribe link in any email or through your notification settings in the app. You cannot opt out of transactional communications (auction alerts, payment notifications, handoff reminders) while your account is active.
8.5 Do Not Sell / Do Not Share
AuClose does not sell or share personal information for cross-context behavioral advertising. No opt-out is required, but you may contact us at [INSERT EMAIL] to confirm.
8.6 Exercising Your Rights
To exercise any of the above rights, contact us at [INSERT EMAIL] with your name, account email, and the right you wish to exercise. We will verify your identity before processing your request. We will not discriminate against you for exercising your privacy rights.
9. Security
We implement commercially reasonable technical and organizational security measures, including:
TLS encryption for all data in transit;
Row-Level Security (RLS) policies on database access;
JWT-based authentication with secure token handling;
Handoff PINs stored in hashed (SHA-256) form — never stored or transmitted in plaintext;
Payment data handled exclusively within Stripe's PCI DSS-compliant infrastructure;
API keys and credentials excluded from client-side storage.
No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at [INSERT SECURITY EMAIL].
9.1 Data Breach Notification
In the event of a data breach affecting your personal information, we will notify you and applicable state regulators as required by the New Mexico Data Breach Notification Act (NMSA § 57-12C-4) and other applicable law, within the timeframes required by law.
10. Children's Privacy
The Platform is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13. The Platform is further limited to users 18 and older. If we become aware that a person under 13 has provided us with personal information, we will delete it promptly. If you believe a child has registered on the Platform, contact us at [INSERT EMAIL].
11. AI and Automated Decision-Making
11.1 Director Mode (Listing Questions)
AuClose uses Google Gemini to generate condition questions for your listing. We send your item's category and general context to Gemini's API. We do not send your name, address, payment information, or other personally identifying information to Gemini.
11.2 Karma Calculation
Your Karma score is calculated automatically from objective transaction events. This score has meaningful effects on your Platform access — for example, very low Karma results in a bid cap. This constitutes automated processing with significant effect.
You may contact us at [INSERT EMAIL] to request review of a Karma calculation you believe was produced by a Platform error. We do not adjust scores based on subjective disagreement with outcomes.
11.3 Search and Discovery Embeddings
Listing content is processed to generate vector embeddings that power semantic search and discovery features. This processing is applied uniformly and does not discriminate based on protected characteristics.
12. Third-Party Links and Services
The Platform may contain links to third-party websites or services. AuClose is not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party service you access through the Platform.
13. Tracking and Advertising
The AuClose mobile application does not use browser cookies. We use standard mobile technologies — session tokens, push notification tokens, and device identifiers — for authentication, session management, and notification delivery.
AuClose does not use cross-app tracking, interest-based advertising, or data brokers. We do not share your personal information with advertising networks.
14. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice via in-app notification and/or email before the updated policy takes effect. Continued use of the Platform after the effective date constitutes acceptance. If you do not agree with the changes, you may close your account before the effective date.
15. Contact and Privacy Requests
For all privacy inquiries, access requests, deletion requests, or complaints, contact:
Privacy Contact — AuClose LLC
[INSERT EMAIL ADDRESS]
[INSERT MAILING ADDRESS]
New Mexico, USA
We aim to respond to all privacy requests within 45 days.
This Privacy Policy is a general information document and does not constitute legal advice. AuClose recommends consulting a licensed attorney if you have questions about your specific rights.