Privacy Policy

This Privacy Policy explains how Get Vaulted LLC (“Get Vaulted,” “we,” “us”) collects, uses, shares, and protects personal information when you use our website, mobile application, and related services (the “Platform”). The Platform includes The Vault marketplace, Vault Events and live commerce, Trade Center, Vault Wallet, seller tools, and community features.

By using the Platform, you agree to this Privacy Policy. If you do not agree, do not use the Platform.

1. Information We Collect

We may collect the following categories of information:

Account and profile

• name, username, email address, and password (stored via our authentication provider);
• identifiers from Sign in with Apple or Google Sign-In when you use those options (such as provider user IDs and email, subject to your provider settings);
• profile photo, bio, and public storefront information you choose to display;
• phone number only if you voluntarily provide it (for example on a shipping address or support request).

Shipping and addresses

• shipping and ship-from addresses, recipient names, and related delivery details;
• address validation and normalization results from Shippo when you save or verify an address (to reduce label failures).

Payments and payouts

• payment method metadata processed by Stripe (such as card brand, last four digits, expiration, billing ZIP, and Stripe customer or payment method IDs) — we do not store full card numbers on our servers;
• seller payout and identity information collected through Stripe Connect (bank account details, tax information, and verification documents as required by Stripe);
• transaction amounts, order IDs, refund/dispute status, layaway schedules, and trade fees;
• sales tax calculation inputs and results when Stripe Tax is enabled.

Marketplace, live, and trade activity

• listings, bids, offers, purchases, auctions, layaways, and live-room commerce (including break spots);
• trade offers, messages attached to trades, and trade shipping label data;
• order fulfillment, tracking numbers, and carrier status from Shippo or carriers;
• reviews, ratings, reports, disputes, and support tickets you submit;
• live chat messages, moderation actions, and live-room participation data;
• livestream-related metadata (for example stream status, viewer presence counts, and replay or clip data retained for moderation, disputes, or safety as configured).

Content you upload

• listing photos and videos, profile media, and other User Content;
• messages, comments, and communications sent through Platform features.

Device, app, and technical data

• IP address, browser type, device identifiers, operating system, and app version;
• push notification tokens registered with Expo when you enable mobile push alerts;
• log files, crash data, security signals, and usage events for fraud prevention and reliability;
• cookies, local storage, and similar technologies on the web (see Section 6).

From third parties

• payment status, chargeback, and payout data from Stripe;
• tracking and label events from Shippo and carriers;
• authentication and storage services from Supabase;
• information from fraud, identity, or compliance vendors when we use them.

2. How We Use Information

We use information to:

• create and manage accounts, including Apple and Google sign-in;
• operate marketplace listings, checkout, auctions, offers, layaway, live commerce, and trades;
• process payments, payouts, refunds, taxes, and disputes through Stripe and related tools;
• generate shipping rates and labels, validate addresses, and provide tracking through Shippo and carriers;
• deliver live video and host tools through Amazon IVS and related streaming infrastructure;
• send transactional email (verification, receipts, security alerts) through Resend;
• send push notifications you opt into on mobile through Expo;
• moderate content, investigate reports, enforce our Terms and Community Guidelines, and protect users;
• provide customer support and respond to legal requests;
• analyze usage, debug issues, improve performance, and develop new features;
• comply with law, tax, payment-network, and anti-fraud requirements.

We do not sell your personal information. We do not use your personal information for third-party cross-context behavioral advertising.

3. How We Share Information

We may share information with:

• Other users — when needed for transactions (for example shipping name and address to a seller for fulfillment, username on listings, or public profile and review content);
• Stripe — to process payments, Connect payouts, tax, fraud signals, and disputes;
• Shippo and carriers — to quote rates, purchase labels, validate addresses, and provide tracking (USPS, UPS, FedEx, and others as returned by Shippo);
• Supabase — for authentication, database, file storage, and Realtime features;
• Netlify — to host the website and run serverless backend functions;
• Resend — to deliver email;
• Amazon Web Services (including IVS) — for live video ingest, playback, and related infrastructure;
• Expo — to deliver push notifications to devices you register;
• Apple and Google — when you authenticate with those services (subject to their policies);
• Sentry — application error monitoring and performance tracing so we can detect and fix bugs; configured to exclude cookies, request headers/bodies, and query parameters, and to mask text, inputs, and media in any diagnostic session replay;
• professional advisers, auditors, or successors in a merger, acquisition, or asset sale;
• law enforcement or regulators when required or permitted by law, or to protect rights and safety.

We may share aggregated or de-identified information that cannot reasonably identify you.

4. Third-Party Providers

Our service providers process data on our behalf under contractual obligations. Key providers include:

• Stripe — payments, Connect, Tax, and financial compliance;
• Shippo — shipping labels, rates, address tools, and tracking;
• Supabase — auth, database, storage, Realtime;
• Netlify — hosting and functions;
• Resend — email;
• AWS (IVS) — live streaming;
• Expo — push delivery;
• Sentry — error monitoring and performance tracing;
• optional providers we may enable (such as Redis, Kafka, OpenTelemetry, or alternate escrow partners when disclosed in-product).

These providers may process and store data in the United States and other countries. Their own privacy policies and terms apply to their services. Your use of the Platform constitutes consent to such processing as reasonably necessary to provide the services.

5. Mobile App and Push Notifications

If you install our mobile app and enable notifications, we store a push token linked to your account so we can send alerts about orders, trades, live activity, messages, and security events. You can disable push notifications in your device settings at any time; some in-app notifications may still appear when you use the Platform.

6. Cookies and Tracking

On the web we use cookies, local storage, session tokens, and similar technologies for login (including NextAuth sessions), preferences, security, fraud prevention, checkout (including Stripe Elements), and platform performance. You can control cookies through browser settings, but some features may not work if cookies are disabled.

7. Public Content and Livestreams

Content you post publicly — including listings, profile information, reviews, live chat, and livestream participation — may be visible to other users and may be copied or shared outside the Platform. Livestreams and related recordings or clips may be stored for moderation, dispute evidence, safety, and platform improvement for a limited retention period.

Do not post sensitive personal information you want kept private.

8. AI Features

If we offer AI tools, we may process prompts, inputs, outputs, and related metadata to provide and improve those tools. AI outputs may be inaccurate and should be independently verified.

9. Retention

We retain information as long as needed to provide the Platform, resolve disputes, meet legal and tax obligations, prevent fraud, and enforce our agreements. Some data must be kept after account deletion where required by law, payment networks, or active disputes.

10. Security

We use reasonable administrative, technical, and organizational safeguards, including access controls and encryption in transit for sensitive flows handled by our providers. No method of transmission or storage is perfectly secure. You are responsible for protecting your account credentials and devices.

11. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, or limit certain processing, or to opt out of specific uses where applicable law provides those rights.

You can update profile and wallet information in the app or on the web. You can delete your account from the web or mobile app where available. Deletion may be delayed or limited while trades, disputes, payouts, or legal holds are open.

To submit a privacy request, email support@shopgetvaulted.com with the subject line “Privacy Request” and enough information for us to verify your account.

California residents may have additional rights under the CCPA/CPRA (know, delete, correct, opt out of sale/sharing — we do not sell personal information). We will not discriminate against you for exercising privacy rights where prohibited by law.

12. International Users

Get Vaulted is operated from the United States. If you access the Platform from outside the U.S., your information may be transferred to, stored in, and processed in the U.S. and other countries where our providers operate, which may have different data protection laws than your jurisdiction.

13. Children

The Platform is not intended for children under 18. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided information, contact us and we will take appropriate steps to delete it.

14. Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the latest revision. Material changes may be communicated through the Platform or by email where appropriate. Continued use after changes means you accept the updated policy.

15. Contact