AUCTA PRIVACY POLICY

Version 1.0 · In force from 12 October 2026 · Final

This Privacy Policy explains how CaptaFlow LLC, doing business as Aucta ("Aucta," "we," "us"), collects, uses and shares personal information when you use the Aucta platform at getaucta.app, the website at getaucta.com, and related services (the "Service"). It also describes your choices and the rights you may have under U.S. state privacy laws.

The Service is built for businesses. Much of the data you add to it (inventory, costs, sales, shows) is business data rather than personal information, but where it identifies you or another person this Policy applies to it.

If you receive Aucta access through a training program or community operated by another company, that company has its own privacy practices for the information it collects from you directly. This Policy covers only what we collect through the Service.

1. INFORMATION WE COLLECT

Information you give us

Account data: name, email address, business name, password, and any profile details you add.
Business data: inventory records, purchase costs, sales and show records, goals, notes, photos of products, barcodes and files you upload or import, including sales reports you upload from selling platforms. Sales reports you upload may contain your buyers' usernames, names and shipping addresses. We keep buyer usernames only in a keyed-hashed form that Aucta cannot read back, together with purchase totals and the buyer's state, so you can see repeat and high-value buyers in your own shows. We also use those hashed identifiers across all sellers on Aucta to mark whether a buyer is a high-value buyer in the community; that mark is a tier only and never reveals a buyer's purchases with any other seller. We discard buyer names and street addresses at import and never store them, and we do not share buyer information with anyone.
Payment data: when you buy a plan or credits, our payment processor (Stripe) collects your card or bank details directly. We receive a token, the last four digits, the card brand and your billing address, not your full card number.
Communications: what you send us by email, in-app support or feedback, and your prompts to AI features.
Wholesale Desk data: if you buy through the Wholesale Desk, your order, shipping address and order history; if you are a wholesaler, your business, tax and payout details.

Information we collect automatically

Device and usage data: IP address, browser and device type, operating system, pages and features used, actions taken, session timing, referring page and error logs.
Metering data: which credit-metered features you use, how often, and the credits consumed.
Scanner and camera data: when you use a barcode scanner or camera feature, the codes or images captured, which we use for the lookup you requested.

Information from other sources

Program operators: if you join through a training program or community, its operator sends us your name, email and membership status so we can create and maintain your account.
Product and market data providers: when you look up a product or run a comp, we receive product and pricing data from third-party databases. That data is about products, not about you, but it is stored alongside your request.
Connected platforms: if you connect a selling platform in future, we receive the inventory, listing and order data that platform makes available under your authorization.

2. HOW WE USE INFORMATION

We use personal information to:

Provide the Service: create and manage your account, store and display your business data, run lookups, comps and AI features you request, meter credits, process payments and send receipts.
Communicate with you: send account, security, billing and service emails; respond to support requests; and, with your consent where required, send product updates and tips. You can opt out of non-essential emails at any time.
Improve and secure the Service: understand how features are used, fix bugs, test changes, detect fraud, abuse and security incidents, and enforce our Terms.
Produce Market Data: derive de-identified, aggregated statistics as described in Section 4.
Comply with law: meet tax, accounting and legal obligations, respond to lawful requests, and protect our rights and the rights of others.

We do not use your personal information for targeted advertising, and we do not sell it. If we ever want to use your name, words or results in our marketing, we will ask you first.

3. AI FEATURES

The Service includes an AI coach and other features that generate text, descriptions and images. When you use them, we send your prompt and the context the feature needs (for example, the item you are looking at or your recent sales figures) to our AI provider, currently OpenAI, to generate a response. We instruct our AI providers not to use your inputs or outputs to train their models, and we keep your prompts and outputs in your account so you can see them again. AI output is generated automatically; please do not enter sensitive personal information about yourself or others into AI features.

4. MARKET DATA AND DE-IDENTIFIED INFORMATION

Aucta shows sellers what is selling, at what prices, and how fast, using data pooled from many sellers. To do that we take sales, inventory and listing data from accounts, remove anything that identifies the seller, and combine it with other sellers' data and third-party sources into statistics, benchmarks and estimates ("Market Data").

Market Data never names you, your business or your individual transactions. We do not show any statistic drawn from fewer than three sellers, we do not attempt to re-identify de-identified data (except to test that our de-identification works), and we require anyone we share it with to do the same. Your agreement to this use is part of the Terms of Service, and it continues after your account closes for data already incorporated.

We share personal information only as described here:

Service providers that process data on our behalf under contract: Vercel for hosting, Supabase for our database, Stripe for payments, Resend for email delivery, OpenAI for AI features, product and pricing data providers for lookups and comps, error-monitoring tools, and similar providers we may use. They may use your information only to provide their services to us.
The seller of record. Plans and credits are sold by the seller of record named at checkout (at launch, The Mick Vault LLC) through a payment account dedicated to Aucta. The seller of record receives the transaction records needed for tax, refund and accounting purposes, and nothing else from your account.
Program operators. If you access Aucta through a training program or community, we share your account status and usage summaries with its operator so it can support you and manage membership. We do not share your inventory, costs or sales records with the operator unless you ask us to.
Wholesalers. If you buy through the Wholesale Desk, we share your name, shipping address and order details with the wholesaler so it can fulfil the order.
Legal and safety. With authorities or other parties when we believe in good faith it is required by law, or necessary to protect the rights, property or safety of Aucta, our users or others.
Business transfers. With a buyer, successor or investor in connection with a merger, acquisition, financing, sale of assets or similar transaction, or in an insolvency, in which case this Policy continues to apply to the transferred information.
With your direction. When you ask us to share information with someone, or connect a third-party platform to your account.

We do not sell personal information and do not share it for cross-context behavioral advertising.

6. COOKIES AND ANALYTICS

Cookies. The Aucta app sets only the cookies it needs to sign you in and keep your session; it sets nothing else. The marketing site at getaucta.com sets no cookies and runs no analytics. We do not use advertising cookies, third-party tracking pixels or cross-site tracking of any kind. Our Cookie Notice lists the cookies in use.

Page views inside the app. Aucta records which pages you open inside the app (the page path and time, never what you type or search), per business, so our support staff can help you and so we can keep the service running well. Only Aucta staff can see this record; it is never shared, and it is deleted after 90 days.

Do Not Track and Global Privacy Control. We honor Global Privacy Control signals. We do not change how the Service behaves in response to a browser's Do Not Track signal, because we do not track you across other sites in the first place.

7. YOUR CHOICES

Access and update. You can view and update your account information, and export your business data, in the Service at any time.
Delete. You can close your account in settings; see Section 8 for what happens to your data. You can also email support@getaucta.com to ask us to delete personal information.
Email. Unsubscribe links in our non-essential emails let you opt out of them. We still send account, billing and security emails while you have an account.
AI features. Using AI features is optional. Nothing is sent to an AI provider unless you use one.
Camera and scanner. The Service asks for camera permission only when you use a camera feature, and you can revoke it in your browser or device settings.

8. RETENTION AND SECURITY

We keep personal information for as long as your account is active and as needed afterward to meet legal, tax and accounting obligations, resolve disputes and enforce our agreements. When you close your account, we delete your account and business data within thirty (30) days, except for transaction records we must keep (generally seven years), data already incorporated into Market Data, and backups that are overwritten in the ordinary course. While your account is open, your business records (lots, sales, shows, costs, coach conversations and charges) are kept for as long as the business exists; records of pages you opened are kept 90 days; records of emails we could not deliver are kept one year; and support emails you send us are kept as our support history. Suspended accounts keep their data for thirty (30) days so you can return; after that the account is closed automatically and deleted as above.

We protect personal information with administrative, technical and physical safeguards, including encryption in transit and at rest, access controls, session expiry and logging. No system is perfectly secure; if we learn of a breach affecting your personal information we will notify you as the law requires.

9. CHILDREN

The Service is for adults running a business. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, email support@getaucta.com and we will delete it.

10. USERS OUTSIDE THE UNITED STATES

The Service is operated from the United States and is intended for U.S. users. If you use it from elsewhere, your information is transferred to and processed in the United States, where privacy laws may differ from those of your country. By using the Service you agree to that transfer.

11. STATE PRIVACY RIGHTS

If you live in California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Utah, Iowa, Indiana, Tennessee, Delaware, New Jersey, New Hampshire, Nebraska, Kentucky, Maryland, Minnesota, Rhode Island or another state with a comprehensive privacy law, you may have the right to:

Know and access the personal information we have collected about you, including the categories, sources, purposes and recipients.
Correct inaccurate personal information.
Delete personal information we collected from you, subject to legal exceptions.
Port a copy of your personal information in a usable format.
Opt out of sales, targeted advertising and profiling that produces legal or similarly significant effects. We do not sell personal information, use it for targeted advertising, or engage in that kind of profiling, so there is nothing to opt out of; we honor Global Privacy Control signals in any case.
Appeal a decision we make on your request.
Not be discriminated against for exercising these rights.

To exercise a right, email support@getaucta.com from the address on your account. We will verify your identity using your account and may ask for more information. You may use an authorized agent if the agent provides proof of your authorization. We respond within the time the applicable law allows, usually 45 days. If we deny a request, you may appeal by replying to our response; if we deny the appeal, we will tell you how to contact your state attorney general.

Categories of personal information (California). In the last 12 months we have collected these categories under the CCPA: identifiers (name, email, IP address, account ID); customer records (billing address, last four digits of a payment card); commercial information (plans, credits and Wholesale Desk purchases); internet activity (usage and device data); audio or visual information (product photos and scanner images you provide); and inferences limited to feature usage. We collect them from you, your device, Program operators and service providers; we use them for the purposes in Section 2; and we disclose them to the recipients in Section 5 for business purposes. We do not collect sensitive personal information as defined by the CCPA except account login credentials, which we use only to provide the Service. We have not sold or shared personal information in the last 12 months.

Shine the Light. We do not disclose personal information to third parties for their own direct-marketing purposes.

12. CHANGES AND CONTACT

We may update this Policy. If we make material changes we will email the address on your account or post a notice in the Service before they take effect. The date at the top shows the current version.

Questions or requests: support@getaucta.com, or CaptaFlow LLC d/b/a Aucta, 6004 Lakehurst Dr, Baltimore, MD 21210.