Privacy Policy

1. Who this covers

Visitors, buyers, sellers and seller staff who use the website and its messaging, checkout, Seller Hub and support. Payments are processed by Stripe and PayPal under their own privacy policies; we never receive full card numbers.

2. What we collect

• Account: your email address (used to sign in with one-time codes) and, if you choose, your name and phone number; sign-in events and the IP address and browser they came from.
• Orders: the shipping address you enter, the parts you buy, order and shipment history, tracking events from carriers, the seller's sales invoice, and payment status (never the card number — Stripe and PayPal give us a token, the last four digits and the payment method type).
• Messages, offers, cases and feedback you send through the Marketplace, with any attachments.
• Watchlist and searches you save or run while signed in.
• Sellers: business details, licenses and verification documents, the donor VIN and proof-of-origin documents for each listing, Stripe Connect account status, and payout records. See Section 5.
• Technical: server logs (IP address, pages requested, browser, referrer, errors) kept to run and secure the site.

3. How we use it

• To run the Marketplace: show listings, process and hold payments, give sellers the shipping address, follow tracking, release payouts, decide cases and issue refunds.
• To verify that sellers are commercial automotive businesses and that each part has a documented donor vehicle.
• To send transactional email: sign-in codes, order confirmations, shipping and delivery notices, offer and message notifications, case updates and payout notices.
• To prevent fraud, enforce our policies, keep records for tax and legal purposes, and comply with carrier and hazardous-materials rules.
• To improve the site using aggregate usage data. We do not sell personal information and we do not use it for third-party advertising.

4. Who we share it with

• The seller of a part you buy receives your name and shipping address (and your messages) to ship and invoice the order — never your payment details or your email address.
• Buyers see a seller's store name, business type, ship-from state, feedback and the public parts of listings; the donor VIN is shown according to the marketplace's VIN display setting and always appears on the buyer's invoice.
• Service providers who process data for us under contract: Stripe and PayPal (payments and seller payouts), Supabase (database, authentication and file storage), Cloudflare (hosting and security), Resend (email), EasyPost (shipment tracking), and the carriers whose tracking numbers appear on orders.
• Authorities and others when the law requires it, to respond to lawful requests, to enforce our terms, to protect the rights and safety of users, or in connection with a merger or sale of the business.

5. Seller information

Verification documents and proof-of-origin documents are stored privately and are visible only to our staff and to the seller who uploaded them; they are never shown to buyers or other sellers. Sales invoices uploaded to an order are visible to that order's buyer. Payout and tax information is handled by Stripe under its Connected Account Agreement; we see account status and payout records, not bank details.

6. Cookies and analytics

We use strictly necessary cookies: your sign-in session, your cart, and security tokens. We do not use advertising cookies or sell data to ad networks. If we add privacy-respecting, aggregate analytics we will say so here. Your browser's "do not track" setting does not change what we collect because we collect only what the service needs.

7. How long we keep it

Order, payment, payout, invoice, case and message records are kept for as long as needed to run the Marketplace and then for the period tax, accounting and product-safety laws require — generally seven years for transaction records. Donor VIN and proof-of-origin records are kept for the life of the listing and at least four years after the sale, because they document where a safety device came from. Account data is deleted or anonymized within 90 days of a closure request, except for records we must keep. Server logs are kept for a short period for security.

8. Security

Data is encrypted in transit and at rest, access is limited to staff who need it and is logged, payments are handled by PCI-compliant processors, and documents are stored in private storage with per-user access rules. No system is perfectly secure; if a breach affects you we will notify you as the law requires.

9. Your choices and rights

You can view and update your profile, addresses and watchlist in My e-airbags, and sellers can update business details in the Seller Hub. You can ask us to export or delete your personal information, to correct it, or to explain what we hold, by emailing support@e-airbags.com; we verify the request through your account email and answer within 30 days (45 where the law allows). Residents of states with consumer-privacy laws (such as California, Colorado, Connecticut, Virginia and others) have the rights those laws provide, including to know, delete, correct and not be discriminated against for exercising them. We do not sell or share personal information for cross-context behavioral advertising. Transactional emails cannot be turned off while you have open orders; other notifications can be adjusted in your account.

10. Children

The Marketplace is for adults and businesses. We do not knowingly collect information from anyone under 18; if you believe we have, contact us and we will delete it.

11. Changes

We will post changes here with a new date and, for material changes, notify account holders by email or on the site.

12. Contact

[legal entity name — to be completed before launch], operator of e-airbags.com — support@e-airbags.com, [business address — to be completed before launch]. See also the Terms of Use.