Privacy Policy

1. Who is responsible for your data

The data controller is Ruslan Lukianenko, an individual operating AuctionHub as a personal project. For any privacy question or to exercise your rights, contact: [email protected].

2. What personal data we collect

We collect only what is needed to run the Service:

• Account data. Your email address; a hashed password (we never store plain-text passwords); and, if you sign in with Google, your Google account identifier and email-verified status. When you use Google sign-in we receive only your email and a Google user ID — not your name, photo, contacts, or other Google data.
• Auction content you create. Auctions, lots, lot descriptions, prices, and any images you upload.
• Data you enter about other people. When you run an auction you may enter the name and email of buyers and of people you invite to bid. See section 8.
• Activity data. Bids placed, room membership, and similar records generated while using the Service.
• Technical data. A session cookie, authentication tokens stored in your browser, and server logs (which may include IP address and request metadata) used for security and operation.

3. Why we use it and our legal basis

Under Article 6 of the GDPR, we rely on the following legal bases:

• Performance of a contract. To create and secure your account, run auctions, process bids, and send transactional emails such as email confirmation and invitations.
• Legitimate interests. To keep the Service secure, prevent abuse and fraud, debug problems, and improve the product. We balance these interests against your rights.
• Consent. Where we ask for it specifically — for example, optional communications. You can withdraw consent at any time.
• Legal obligation. Where we must retain or disclose data to comply with applicable law.

4. Cookies and local storage

We use a strictly necessary session_id cookie to keep you signed in, and we store short-lived authentication tokens in your browser’s local storage so that live auction rooms work. These are essential for the Service to function and are not used for advertising or cross-site tracking. We do not currently use analytics or marketing cookies.

5. Who we share data with

We do not sell your personal data. We share it only with service providers (“processors”) that help us operate, and only as needed:

• Amazon Web Services (AWS). Hosting, database, file storage (S3), and content delivery (CloudFront). Our infrastructure runs in the EU region eu-north-1 (Stockholm, Sweden).
• Google. Optional “Sign in with Google” authentication. Your use of Google sign-in is also subject to Google’s Privacy Policy.
• Email delivery provider. A transactional email provider sends confirmation and invitation emails on our behalf.

We may also disclose data where required by law or to protect the rights, safety, and security of users and the Service.

6. International data transfers

Your data is primarily stored in the EU (Sweden). Some providers, such as Google, may process data outside the EU. Where that happens, the transfer is protected by an appropriate safeguard such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

7. How long we keep data

• Account data is kept for as long as your account is active. Account deletion is currently handled manually: you can ask us to delete your account at any time by emailing [email protected], and we will delete it and the associated personal data without undue delay (and in any case within 30 days), except where we must keep limited records to comply with the law.
• Auction content, buyer and participant records, and bids are kept while the related auction exists and are deleted when you delete the auction or your account.
• Server logs are kept only for a short period for security and troubleshooting.

8. Data you enter about other people

If you enter another person’s name or email (for example, a buyer or someone you invite to bid), you are responsible for having a lawful basis to do so and, where required, for informing them. For that data you act as the controller and we act as a processor handling it on your behalf. Please only enter data you are entitled to share.

9. Your rights

Subject to applicable law, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent where processing is based on it. To exercise any of these, email [email protected].

In particular, to exercise your right to erasure (“right to be forgotten”), send a deletion request from the email address associated with your account, or otherwise allowing us to verify your identity. We process such requests manually and will delete your account and associated personal data without undue delay, and in any case within 30 days, except where the law requires us to retain limited records.

You also have the right to lodge a complaint with a supervisory authority. In Ukraine this is the Ukrainian Parliament Commissioner for Human Rights (Ombudsman). In the EU it is the data-protection authority of your country of residence.

10. Children

The Service is not directed to children. You must be at least 16 years old (or the minimum age required in your country) to create an account. We do not knowingly collect data from children below that age.

11. Security

We use measures such as encrypted connections (HTTPS), hashed passwords, access controls, and EU-based hosting to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and to address issues promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, where changes are significant, take reasonable steps to notify you.

13. Contact

Questions about this policy or your data? Email [email protected]. See also our Terms of Service.