Privacy Policy

1. Information We Collect

1.1 Information You Provide

When you use Cruz Trade, you directly provide:

• Account information — name, email address, username, neighborhood, and profile photo when you sign up
• Listing content — titles, descriptions, photos, pricing, and category when posting a listing
• Messages — messages you send to other users through the platform
• Transaction data — booking details, payment amounts, and transaction status
• Agreement records — when you accept our Terms and Conditions, we record your user ID, timestamp, T&C version number, and IP address as a record of your agreement

1.2 Information Collected Automatically

When you access or use the Platform, we automatically collect:

• Device information — device type, operating system, browser type and version
• Log data — IP address, pages visited, features used, referring URLs, and timestamps
• Usage patterns — general interaction patterns, clicks, and session duration
• Cookies and local storage — session tokens and preference data (see Section 8)

1.3 Information from Third Parties

We may receive information from third-party services we use to operate the platform, including payment processors and authentication providers, consistent with their own privacy policies.

2. How We Use Your Information

We use the information we collect to:

• Operate the platform and process transactions
• Connect buyers, sellers, and traders within Santa Cruz County
• Send notifications about messages, bookings, and account activity
• Maintain records of user agreements to our Terms and Conditions
• Improve the platform and develop new features
• Detect, prevent, and investigate fraud, abuse, and violations of our Terms of Service
• Comply with legal obligations and respond to lawful requests from public authorities
• Communicate platform updates, policy changes, and service announcements

3. Information Sharing

We do not sell your personal information. We share your information only in the following circumstances:

3.1 With Other Users

Your public profile — including name, photo, neighborhood, listings, and reviews — is visible to other Cruz Trade users. Your contact information is never shared publicly.

3.2 With Service Providers

We share data with trusted third-party vendors who help us operate the platform, including:

• Stripe — payment processing. We do not store card numbers or payment credentials.
• Supabase — database and backend infrastructure, hosted on AWS
• Email and notification providers — for transactional emails and alerts
• Analytics providers — for aggregated, anonymized usage data

All service providers are contractually required to protect your data and use it only for the purposes we specify.

3.3 As Required by Law

We may disclose your information when required by law, court order, or government request, or when we believe disclosure is necessary to protect the rights, property, or safety of Cruz Trade, our users, or the public.

3.4 Business Transfers

If Cruz Trade is acquired, merged, or sold, your information may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

4. Data Storage and Security

Your data is stored securely using Supabase, hosted on AWS infrastructure in the United States. We implement industry-standard security measures including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Row-level security on all database tables
• Access controls limiting employee access to user data
• Regular security reviews and monitoring

No system is perfectly secure. We cannot guarantee absolute security of your data and are not responsible for unauthorized access beyond our reasonable control. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Specifically:

• Active account data — retained for the life of your account
• Transaction records — retained for 7 years for tax and legal compliance purposes
• Agreement records (T&C acceptance logs) — retained for 7 years
• Messages — retained for 2 years from the date of the conversation
• Deleted account data — most personal data is deleted within 30 days of account deletion; anonymized transaction records may be retained longer for legal and financial compliance

You may request early deletion of your data subject to our legal retention obligations (see Section 6).

6. Your Rights

You have the following rights regarding your personal information:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete information
• Deletion — request deletion of your account and associated personal data, subject to retention requirements
• Portability — request your data in a portable format
• Opt-out — opt out of non-essential communications at any time

To exercise any of these rights, email us at hello@cruztrade.com. We will respond within 30 days.

7. California Privacy Rights (CCPA)

As a California-based platform serving California residents, we recognize rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

7.1 Right to Know

You have the right to request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for which we use it, and any third parties with whom we share it.

7.2 Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions (such as legal retention requirements and fraud prevention).

7.3 Right to Correct

You have the right to request correction of inaccurate personal information we maintain about you.

7.4 Right to Opt Out of Sale or Sharing

Cruz Trade does not sell or share personal information for cross-context behavioral advertising. You have the right to opt out of any future sale or sharing should our practices change, and we will notify you before doing so.

7.5 Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. We will not deny services, charge different prices, or provide a different level of service based on your exercise of privacy rights.

7.6 How to Submit a Request

To submit a California privacy rights request, email hello@cruztrade.com with the subject line "CA Privacy Request." We will verify your identity and respond within 45 days as required by law.

8. Cookies and Tracking

Cruz Trade uses cookies and local storage to:

• Maintain your login session
• Remember your preferences and settings
• Understand how the platform is used (aggregated, anonymized analytics)

We do not use third-party advertising cookies or cross-site tracking cookies. You can control cookie settings through your browser, though disabling cookies may affect platform functionality.

9. Children's Privacy

Cruz Trade is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has created an account, please contact us at hello@cruztrade.com and we will promptly delete the account and associated data.

10. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies before providing any personal information.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by posting a notice on the platform and, where required by law, by email. The "Last Updated" date at the top of this policy reflects the most recent revision. Your continued use of Cruz Trade after changes are posted constitutes your acceptance of the revised policy.

12. Contact

Questions, concerns, or requests regarding this Privacy Policy:

• Email: hello@cruztrade.com
• Subject line for privacy requests: "Privacy Request"
• Response time: within 30 days (45 days for CCPA requests)
• Mailing address: Cruz Trade, LLC — Santa Cruz, California