HaulBlock Privacy Policy
What we collect
You give us:
- name and email (directly, or from Google/Facebook/Apple if you sign in that way)
- listing information: vehicle details, VIN, photos, maintenance records, the city and state where the vehicle sits
- questions, comments and messages you post
- what you tell us in support email
Collected automatically:
- IP address, browser and device information, pages visited, time of visit
- a session cookie that keeps you signed in
Your card: entered directly into Stripe's form and never sent to our servers. We store only Stripe's customer reference, the card brand, and the last four digits so you can recognise which card is on file.
We obtain about a listed vehicle: a vehicle history report, a federal title brand check, a UCC lien search, federal roadside inspection records, and any independent inspection report. These describe the vehicle, though the title records name the owner.
We do not collect: government ID documents, social security numbers, or bank account details. [If identity verification is added, it should run through a vendor so the documents never reach us. Update this paragraph then.]
What we do with it
- run the auctions: show listings, take bids, place and release card holds, charge the buyer fee
- tell you what is happening: outbid, won, sold, questions, answers
- connect the buyer and seller after a sale — when you win, the seller gets your name and email, and you get theirs. That is the point of the service, and it is the one disclosure people should see coming.
- prevent fraud: spot shill bidding, non-paying bidders, and duplicate accounts
- meet legal and tax obligations, and resolve disputes
- improve the service and, where you have not opted out, tell you about it
We do not sell personal information, and we do not share it with data brokers or advertisers.
Who we share it with
| Who | What they get | Why |
|---|---|---|
| Stripe | your card details (directly), name, email | payments and card holds |
| Resend or chosen provider | your email address and the message | sending notifications |
| Google / Facebook / Apple | nothing beyond the sign-in exchange | sign-in, if you use it |
| The other party to your sale | name, email and phone if we add it | completing the sale |
| History and inspection vendors | the VIN, not your identity | the vehicle file |
| Our hosting provider | everything, as the system it runs on | operating the site |
| Law enforcement, or a buyer of the business | as required or as part of the transaction | legal obligation, corporate change |
Public by design: your display name, your bids, and your questions and comments appear on the listing where anyone can read them. Choose a display name accordingly. Your email address is never shown publicly.
How long we keep it
- auction records, bids and listings: 7 years, because a sale record is what settles a dispute or a chargeback years later
- payment records: as required by tax and card rules 7 years
- account information: until you close the account, then 30 days, except what we must keep for the records above
- server logs: 90 days
- photos: for as long as the listing they belong to. Closing your account removes your profile picture and any draft photos from our backups as well. A photo you delete from a listing you keep is removed from the site, but its backup copy is not yet aged out.
Your choices
You can close your account yourself, from Settings. We keep the row, because bids, sales and fee records hang off it and other people acted on those, but your name, email address, phone number, photo, anything you wrote about yourself and your card all go, and what is left reads as "Former member". Backups of the database made before the day you close hold the old details for three days and are then overwritten. Your profile picture and any draft photos are removed from backup storage at the same time as from the site. We will not let you close in the middle of something somebody else is relying on — a live listing, a standing high bid, a sale less than 30 days old, or a buyer fee that did not go through — and the page tells you which it is and when it clears.
To correct your details, or to ask what we hold, email [email protected]. Californians have specific rights under the CCPA/CPRA to know, delete, correct, and to opt out of sharing; we honour those for everyone rather than running two systems.
You can unsubscribe from anything that is not about a transaction you are in. Auction notices — outbid, won, sold — are part of the service and are not marketing; if you do not want them, do not bid.
Security
Card details never touch our servers. Connections are encrypted. Passwords are not stored at all, since sign-in is either a provider or a session. Sessions are cookie-based, with CSRF protection on every action, and rate limits on bidding and sign-in. Backups are taken nightly.
No system is perfectly secure. If a breach affects your information, we will notify you as the law requires.
Children
HaulBlock is for adults buying and selling commercial vehicles. We do not knowingly collect information from anyone under 18, and nothing here is directed at children under 13. COPPA language if counsel wants it.
Changes and contact
We will post changes here and email you about material ones. legal entity, address, [email protected].
On the address and phone above — email does not substitute for either. Cal. Civ. Code §1789.3 requires the provider of an electronic commercial service to give its California subscribers a name, an address and a telephone number. All three, no alternatives. Separately, the Copyright Office requires a street address to register a DMCA agent, which is the price of §512(c) safe harbour on photos that strangers upload — and that directory is publicly searchable. CAN-SPAM then puts a postal address in the footer of every marketing email, once marketing starts.
So this cannot be a home address, and none of it can be taken back once indexed. A private mailbox from a commercial mail receiving agency is a real street address ("… St, Ste 400") at roughly $10–30 a month and satisfies all of them at once. A PO Box satisfies CAN-SPAM but needs a waiver from the Copyright Office before it can carry the DMCA registration. Registered-agent services cover the state filing and usually may not be used as a business mailing address.