JerseyTradr is operated by a company organized in the United States. This Privacy Policy explains what data we collect, why, and what rights you have over it.
1. Who we are
JerseyTradr is a peer-to-peer jersey trading marketplace. We act as data controller for the personal data you provide to us.
Contact for all privacy matters: dio@jerseytradr.com
2. What we collect and why
| Data | Why we collect it | Lawful basis (US: purpose limitation) | Kept for |
|---|---|---|---|
| Email address | Account identity, magic-link login, transactional notices | Necessary to perform the service you requested | Life of account + 30 days post-deletion |
| Handle (username) | Public profile | Necessary to perform the service | Life of account + 30 days |
| Bio, location (optional) | Public profile display | You provided it voluntarily | Until you remove it or delete your account |
| Jersey photos and listing content | Marketplace listings | Necessary to perform the service | Until listing is removed or account deleted |
| Google account ID | Google sign-in authentication | Necessary to perform the service | Session; until sign-out or account deleted |
| IP address at signup | Fraud prevention, consent record | Legitimate business interest (fraud prevention) | 90 days, then anonymized |
| Consent record (ToS version, accepted_at) | Legal compliance record | Legal obligation / compliance | Minimum 3 years after account deletion |
| Trade offer data (items, counterparty, status) | Executing and recording your trades | Necessary to perform the service | Life of trade + 2 years for dispute resolution |
| Shipping address | Generating shipping labels for accepted trades | Necessary to perform the service | Deleted after trade closes + 30 days |
| Stripe customer ID | Processing trade fees | Necessary to perform the service | Per Stripe terms + 5 years for tax records |
We do not sell your personal data to third parties.
3. Who we share data with
We use the following service providers who handle your data only as instructed by us:
- Supabase: database and file storage (United States)
- Vercel: hosting and server rendering (United States)
- Stripe: payment processing (United States). Stripe has its own privacy policy governing payment data.
- Google: OAuth sign-in (United States). If you sign in with Google, Google’s privacy policy governs data on their side.
We do not share your data with third-party advertisers.
4. Cookies and tracking
We use only strictly necessary cookies required for authentication sessions. We do not run advertising trackers or behavioral analytics cookies. If this changes, we will update this policy and show a cookie notice before any non-essential cookies fire.
5. Your privacy rights
All users:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your data, subject to retention obligations (trade records, consent logs required by law)
- Withdraw consent at any time where processing is based on consent
In-app deletion: Settings → Delete Account removes your personal data. See Section 6 for what we must legally retain.
How to exercise rights: Email dio@jerseytradr.com with the subject line “Data Request”. We respond within 30 days.
California residents (CCPA/CPRA): You have the right to:
- Know what personal information we collect, use, disclose, and sell (we do not sell)
- Request deletion of your personal information
- Correct inaccurate personal information
- Opt out of the “sale” or “sharing” of personal information (we do neither)
- Non-discrimination for exercising your rights
Submit a CCPA request to dio@jerseytradr.com. We will respond within 45 days (extendable to 90 days with notice).
Other US state residents (Virginia, Colorado, Connecticut, Texas, and similar): Comparable data rights apply under your state’s consumer privacy law. Submit requests to the same address; we apply the same response process.
6. Data retention exceptions
When you delete your account, we retain:
- Consent records (ToS acceptance version, timestamp): minimum 3 years, to evidence compliance
- Trade records: 2 years for dispute resolution and legal obligations
- Tax-related payment records: 5 years per US tax record-keeping standards
After these periods, data is deleted or anonymized.
7. Children
JerseyTradr does not knowingly collect personal data from children under 13, consistent with COPPA (15 U.S.C. § 6501 et seq.). If you believe a child under 13 has an account, contact us at dio@jerseytradr.com and we will delete it promptly.
8. Data security
All data is stored in a private Supabase project (US-hosted). We do not collect or store government-issued identity documents. We use HTTPS everywhere, and authentication tokens are server-side only.
9. Changes to this policy
We’ll notify you of material changes by email or in-app notice at least 14 days before they take effect. The effective date at the top of this document will be updated.
10. Contact
dio@jerseytradr.com : all privacy inquiries, data requests, and breach reports.
Future scope note: If JerseyTradr expands to serve EU/EEA users, GDPR will apply (lawful basis documentation per Art. 6, DPAs under Art. 28, DSR infrastructure under Arts. 15–21, 72-hour breach notification under Art. 33, supervisory authority registration). If serving Argentine users, Ley 25.326 and AAIP registration will apply. These obligations are deferred to the expansion phase; v1 targets US users only.