AuctionZu
Log in Request a demo
Menu

Privacy Policy

This policy explains what information AuctionZu handles, why, who we share it with and the choices you have. Auction businesses control the bidder and sale records in their own accounts, and we handle those records on their behalf.

Summary

  • AuctionZu is software for auction businesses ("houses"). When you bid with a house, that house decides how your registration, bid and purchase information is used, and we handle it on the house's behalf.
  • We do not sell personal information, and we do not share it for targeted advertising.
  • Card payments are made on Stripe's hosted pages, on the house's own Stripe account. AuctionZu never sees or stores full card numbers and never holds anyone's money.
  • Our website sets no cookies and runs no analytics, advertising or third-party scripts.
  • We keep bid history and audit records in a form that cannot be edited, because they protect the fairness of every sale. We explain below how long we keep them and how deletion works.
  • You can ask us about your information at any time: privacy@auctionzu.com.

Who we are and what this policy covers

AuctionZu is offered by Intellizu LLC ("AuctionZu", "we", "us" or "our"). This policy covers:

  • our website at auctionzu.com, including the demo request form;
  • the AuctionZu operator console, used by auction businesses and their staff;
  • the bidder storefronts that AuctionZu hosts for auction businesses, whether on an auctionzu.com address or on a house's own domain; and
  • the emails we send for the service.

In this policy, a "house" is an auction business that uses AuctionZu, a "bidder" is a person who registers to bid with a house, and a "consignor" is a person or business whose items a house sells.

Our two roles

How we handle information depends on whose information it is and why we have it.

When we act for a house

A house uses AuctionZu to run its own auctions. For the information a house collects or keeps in its AuctionZu account, such as bidder registrations, bids, invoices, payments, pickup and shipping details, consignor records, inquiries sent through its storefront and messages to its bidders, the house is in charge. In privacy law terms, the house is the "controller" or "business", and AuctionZu is its "processor" or "service provider".

This means:

  • The house decides what information to collect, how to use it, and how long to keep it, within the limits of its agreement with us and the law.
  • The house sets its own terms of sale and is responsible for its own privacy notice to bidders and consignors. Please read them before you register.
  • We use this information only to provide and protect the service for that house, as our agreement with the house allows. We do not use it for our own marketing.
  • If you want to see, correct or delete information a house holds about you, please contact that house. If you contact us instead, we will pass your request to the house and help the house respond.

When we decide for ourselves

AuctionZu is the controller for:

  • information about house accounts and the people who use the console (owners, admins, operators and finance staff);
  • bidder sign-in accounts (explained below);
  • visitors to our website and people who send us a demo request or email us;
  • billing and contract information for houses that pay us; and
  • information we need to keep the service secure, prevent fraud and abuse, and meet our legal obligations.

Bidder sign-in accounts. A bidder signs in with one AuctionZu account (email address, name and password) that can be used with any house that runs its storefront on AuctionZu, and a confirmed email address stays confirmed for every house. We maintain that sign-in account, its security and its email verification ourselves. Your registration with each house, and everything that follows from it, belongs to that house as described above. Houses do not see each other's bidder records.

Information we collect

From houses and their team

  • Account details: your name, work email address, password, the business name, the storefront address you choose and your time zone. Passwords are stored only as a one-way hash.
  • Team details: names and email addresses of people you invite, their roles, and their sign-in and security settings, including whether they use two-step verification.
  • Business and storefront settings: your public contact email, phone number and address, logo, branding, storefront pages, terms of sale, custom domains, fees and auction rules.
  • Catalog and sale content: auctions, lots, descriptions, photos, reserves and other content you add or import by file.
  • Records you create while running sales: decisions on bidder registrations, invoices, payments you record, refunds, adjustments, disputes and notes, fulfillment updates, consignor settlements, and the audit history of these actions.
  • Payment account details: when you connect a Stripe account, we store the account identifier and its status (for example, whether it can take charges). Stripe collects your business and banking details directly during its onboarding; we do not receive your bank account numbers.
  • Billing information: if you pay us, your billing contact details and the record of what you paid.
  • Support and feedback: what you tell us when you contact us, attend a demo, or give us feedback.

From bidders, on behalf of houses

  • Sign-in account: name, email address and password (stored only as a hash), whether your email is verified, and two-step verification settings if you turn it on.
  • Registration with a house: full name, phone number, street address, city, state or region and postal code, the time you accepted the house's terms (and a fingerprint of the terms you accepted), your bidder number, and the house's decision on your registration.
  • Bidding activity: bids and maximum bids, the time each was received, lots you watch, and the results.
  • Purchases: invoices, amounts, payment status, refunds and disputes, card holds if the house asks for one, and pickup or shipping details.
  • Messages: inquiries you send to a house through its storefront, and a log of the emails sent to you and whether they were delivered.
  • Trust and safety records: if a house suspends or bans a bidder, the reason and who made the decision.

About consignors, from houses

Houses may enter consignor names, email addresses, phone numbers, notes and settlement statements. We handle this information on the house's behalf.

From visitors to our website and people who contact us

  • Demo requests and contact messages: your name, email address, business name and website, the kind of auctions you run, how many you run, the topic you choose, the tools you use today and any message you add. Your browser sends the form to the system we use to manage sales and support requests, which Intellizu operates.
  • Email: anything you send to an @auctionzu.com address.

Collected automatically

  • Server and security logs: when your browser or app talks to our servers, we record technical information such as the time, the address requested and the result, and we use your IP address for a short time to limit repeated sign-in and signup attempts.
  • Sessions: when you sign in, we record the browser or device description your browser sends (its "user agent"), when the session was created and last used, and when it expires.
  • Email delivery: whether an email we sent was delivered, bounced or marked as spam. Addresses that bounce permanently or report spam are added to a list so we stop emailing them.

We do not collect precise location, and we do not ask for sensitive information such as government ID numbers, health information or financial account numbers.

Cookies, browser storage and tracking

  • Our website (auctionzu.com) sets no cookies, runs no analytics or advertising tools, loads no third-party scripts and serves its fonts from our own domain.
  • The console and storefronts do not use cookies to keep you signed in. When you sign in, your browser stores a random sign-in token in its local storage so a reload keeps you signed in. We keep only a hash of that token, sessions expire after 30 days, and signing out removes the token from your browser. Your browser may also store display preferences, such as light or dark mode or a list or grid view, and a few temporary values while you preview a storefront. None of these are used for tracking or advertising.
  • Links to other sites: a storefront may link to a house's own website or offer a "Get directions" link that opens a map service. Those sites have their own privacy practices.

Because we do not sell or share personal information for advertising, there is nothing to opt out of. We still treat a Global Privacy Control signal from your browser as a valid opt-out request.

How we use information

We use information to:

  • Provide the service: create and secure accounts, host storefronts, run auctions and the bid engine, generate invoices and statements, take payments through the house's processor, and send the emails a sale needs, such as registration decisions, outbid and won notices, invoices, receipts, pickup notices and consignor statements.
  • Keep sales fair and records trustworthy: keep a tamper-evident history of bids and account actions so houses and bidders can check what happened and when.
  • Protect the service and its users: verify email addresses, require two-step verification for privileged roles, limit repeated attempts, detect and stop fraud, abuse and security incidents, and enforce our terms.
  • Support customers: answer questions, help houses move their records onto AuctionZu, and investigate problems.
  • Run and improve our business: bill houses, understand how the product is used so we can fix and improve it, and talk with houses and people who request a demo about AuctionZu. We use information we handle for a house only to provide and improve the service for houses, not to market to that house's bidders.
  • Meet legal obligations: keep required records, respond to lawful requests, and establish or defend legal claims.

We do not use automated decision-making that produces legal or similarly significant effects about you. Registration decisions are made by each house, which may choose to approve registrations automatically once its own requirements (such as a verified email or a card hold) are met.

AuctionZu is built for businesses in the United States. Where a law asks us to state a legal basis for using personal information, we rely on: performing a contract with you or taking steps you ask for before one (running your account); our legitimate interests in operating, securing and improving the service and communicating with business customers and prospects, balanced against your rights; compliance with legal obligations; and your consent where we ask for it. For information we handle for a house, the house decides the legal basis.

How we share information

We share personal information only as described here:

  • With the house you deal with. Your registration, bids, purchases and messages with a house are available to that house's authorized staff. Houses can see only their own records.
  • With other bidders, in limited form. Storefronts show bidding activity, such as current prices and bid history, by bidder number rather than by name.
  • With service providers (subprocessors) who host and operate parts of the service for us, such as cloud hosting, email delivery and payments. They may use the information only to provide their services to us. Our current list is on the Subprocessors page.
  • With the house's payment processor. When you pay a house by card, or a house asks for a card hold, you pay on Stripe's hosted page, on the house's own Stripe account. We send Stripe the amount, a description, the invoice number and your email address. Stripe handles your card details under its own privacy policy and its agreement with the house.
  • For legal reasons. We may disclose information if we believe in good faith that the law, a court order or a valid legal process requires it, or to protect the rights, property or safety of AuctionZu, our customers, bidders or the public, including to prevent fraud.
  • In a business transfer. If AuctionZu is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that deal, subject to this policy.
  • With your permission or at your direction, for example when a house exports its own records.

We do not sell personal information, and we do not share it for cross-context behavioral (targeted) advertising, as those terms are defined in US state privacy laws. We do not knowingly sell or share the personal information of anyone under 16.

Payments

  • Card payments and card holds happen on Stripe's hosted checkout pages. Card details go straight to Stripe and never reach AuctionZu's servers.
  • Each house is the merchant of record and has its own Stripe account. Money paid to a house settles in that house's Stripe balance and is paid out to the house. AuctionZu never holds funds.
  • We store only Stripe's reference numbers (for example, for the checkout, payment, refund or dispute), amounts and statuses, so invoices stay accurate.
  • Cash, check and bank transfer payments are recorded by the house by hand; we store the amount, method and any note or reference the house enters.

How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, or longer where the law requires it.

  • House accounts and their content are kept while the account is open. A house can export its bidder, lot, bid, invoice and settlement records as CSV files at any time.
  • Bid history and audit records are append-only and hash-chained: once written, they are not edited or deleted while the account is open, because they are the evidence that a sale was run fairly. They are kept for the life of the house's account.
  • Invoices, payment records and settlements are kept for the life of the account because houses rely on them for accounting, tax and dispute purposes.
  • After a house closes its account, we delete or de-identify the account's data within 90 days. This window gives the house time to finish any export, lets in-flight payments, refunds and disputes settle, and covers our backup cycle. The exception is records we must keep to meet legal, tax or accounting obligations, or to establish or defend legal claims (for example, invoices, payment records and the bid and audit history behind them). We keep those in restricted storage for up to seven years after the account closes, and then delete or de-identify them.
  • Where a record is append-only, we meet a deletion request by deleting or de-identifying the personal details connected to it (such as a bidder's name, address and contact details) rather than altering the record itself.
  • Bidder sign-in accounts are kept until the bidder asks us to delete the account, subject to any house's need to keep its own sale records as described above.
  • Sessions expire after 30 days and are not renewed after that.
  • Server and security logs are kept for a limited time, generally no longer than 90 days, unless we need them longer to investigate a security incident or abuse.
  • The email suppression list (addresses that bounced or reported spam) is kept as long as needed to keep honoring it.
  • Demo requests, contact messages and other inquiries are kept for up to two years after our last contact if you do not become a customer.
  • Backups: deleted data may remain in backup copies for a short period, no more than 35 days, until those copies expire.

A house can ask us to delete specific records it controls sooner, and we will do so unless the law requires us to keep them.

How we protect information

We use administrative, technical and physical safeguards appropriate to the information we handle, including:

  • Tenant isolation. Every house's records are tied to that house at the database, application and API layers, so one house's records cannot be read or changed through another house's account or storefront, including through custom domains. Automated tests check this for every table on every change.
  • Encryption in transit. The website, console, storefronts and API are served only over HTTPS.
  • Encryption at rest for files. Photos, logos and other uploaded files are stored encrypted. Files meant to stay private are never served publicly and are reachable only through short-lived signed links.
  • Strong sign-in. Passwords are hashed with argon2id. Sign-in tokens are random, and we store only their hash. Two-step verification (an authenticator app code) is required for house owners, admins and finance staff, and for AuctionZu staff who support the platform; operators and bidders can turn it on too.
  • Least privilege. Team members get one of four roles (owner, admin, operator or finance) that limits what they can do. Only a small number of AuctionZu staff can reach platform support tools, and only with two-step verification.
  • Tamper-evident records. Bid history and audit logs are hash-chained, so a change to any past entry would be detectable.
  • Limits on abuse. Repeated sign-in, signup and inquiry attempts are rate limited.
  • Infrastructure. The service runs on Amazon Web Services in the United States. The database is not reachable from the public internet, and production credentials are kept in a managed secret store, not in code.

No system is perfectly secure. If we learn of a security incident that affects your personal information, we will notify the affected house or you as the law requires.

Your privacy rights

Depending on where you live, US state privacy laws, including the Virginia Consumer Data Protection Act and the California Consumer Privacy Act (as amended by the California Privacy Rights Act), give you rights over your personal information. Subject to the limits in those laws, you may have the right to:

  • Know and access: confirm whether we process your personal information, learn what categories we collect, why, and who we disclose it to, and get a copy of it in a portable format.
  • Correct inaccurate personal information.
  • Delete personal information about you.
  • Opt out of the sale of personal information, sharing for targeted advertising, and profiling that has legal or similarly significant effects. We do none of these.
  • Limit the use of sensitive personal information. The only sensitive information we handle is account sign-in credentials, which we use only to sign you in and keep your account secure.
  • Not be discriminated against for using these rights.

How to make a request

  • About a house's records (your registrations, bids, purchases or messages with a house): contact that house directly. If you write to us, we will forward your request to the house and help it respond.
  • About your AuctionZu sign-in account, a house account, the website or a demo request: email privacy@auctionzu.com.

We will confirm receipt and respond within the time the law allows, usually 45 days, extended once where the law permits. To protect your information, we will verify your request, usually by confirming control of the email address on the account. You may use an authorized agent; we may ask the agent for proof of authority and ask you to verify your identity directly.

Appeals

If we decline your request, you may appeal by replying to our decision or emailing privacy@auctionzu.com with the subject "Privacy appeal". We will respond to an appeal within 60 days and explain our decision. If you are a Virginia resident and you disagree with the outcome, you may contact the Virginia Attorney General at www.oag.state.va.us.

California notice

In the past 12 months we have collected these categories of personal information, from the sources and for the purposes described above:

  • Identifiers: name, email address, phone number, postal address, account and bidder numbers, IP address.
  • Customer records: contact and billing details, and records of payments (not card numbers).
  • Commercial information: bids, purchases, invoices, refunds and consignor settlements.
  • Internet or network activity: sign-in sessions, browser descriptions and server logs.
  • Professional information: your role and business, for house team members and people who request a demo.
  • Sensitive personal information: account sign-in credentials.

We disclose these categories for business purposes to the house you deal with and to our service providers, as described under "How we share information". We have not sold or shared personal information, as those terms are defined in California law. Retention periods are described under "How long we keep information".

Children

AuctionZu is not for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact privacy@auctionzu.com and we will delete it.

International users

AuctionZu is operated from the United States, and information is stored and processed in the United States. If you use AuctionZu from outside the US, your information will be transferred to and handled in the US, where privacy laws may differ from those where you live.

Changes to this policy

We may update this policy as the service or the law changes. We will post the new version here and change the "last updated" date. If we make a material change, we will tell house account owners by email or in the console before it takes effect.

Contact us

For privacy questions, data requests or appeals, email privacy@auctionzu.com.

Intellizu LLC offers AuctionZu.