Privacy policy
What we know about you, and for how long.
We collect what we need to price your bag, ship it, and pay you: your email, photos or video of the bag, a pickup address and phone number for the shipping label, and payment details for the payout. We share those only with the services that do that work for us, never sell them, and delete them on the schedule below. You can ask us at any time what we hold and to delete it.
What we collect, and why
| Data | When | Why |
|---|---|---|
| Brand, model, and your condition answers | Submission | To price the bag |
| Photos and video of the bag | Submission | To identify, price, and later authenticate it. They show the bag, not you; please keep faces and documents out of frame |
| Email address | Submission, or sign-in | To send your offer, label, arrival notice, and payment notice, and to let you see your submissions from another device |
| Messages you send to the desk | Whenever you write | To answer you |
| Pickup name, street address, phone | When you accept an offer | To create the prepaid shipping label. Phone is optional and used only for carrier updates |
| Account holder name, payment method, routing and account numbers | When you accept an offer | To pay you. Your full routing and account numbers are stored encrypted. They can be opened only by our payouts desk, only to send your payment, and every opening is recorded with who did it and when. The last four digits are kept in the clear so you and we can confirm which account was paid |
| Partners: business name, bio, avatar, shipping address, payout details | Application and profile | To run the partner program, ship purchases, and pay commissions |
| Technical: your browser type, approximate region from your IP address, and errors your browser reports | Automatically | To keep the site working and to tell a real fault from a bot. We do not run advertising or analytics trackers |
Who else sees it
We use a small number of providers to run the service. Each receives only what its job needs, under contract, and may not use it for its own purposes.
| Provider | Role | What they receive |
|---|---|---|
| Supabase | Database, file storage, sign-in email codes | Everything above, encrypted at rest, in US data centres |
| Vercel | Hosting | Requests to the site, including IP addresses in server logs |
| ShipStation and the carrier (UPS) | Shipping labels and tracking | Pickup name, address, phone, and the declared value |
| Resend | Sending email | Your email address and the contents of the emails we send you |
| Stripe | Partner payments and memberships | Partners' payment details, handled by Stripe directly; we never see full card or bank numbers |
| Anthropic | Photo identification | Photos of the bag, to suggest the brand, model, and condition. Not used to train their models under our agreement |
| Pushover | Alerts to our buying desk's phone | A one-line summary of a new submission: the bag, your estimate, and your email address |
| Google Cloud | Uptime monitoring | Nothing about you; it only checks the site is up |
We do not sell personal information, and we do not share it with data brokers or advertisers. We disclose it when the law requires, to enforce our terms, or to protect against fraud, including to law enforcement in a suspected stolen-goods case.
How long we keep it
| Data | Kept for |
|---|---|
| Drafts you never submitted | 30 days, then deleted |
| Submissions that were declined, expired, or that you passed on, including their photos | 12 months, then deleted |
| Pickup address, phone, and payout details for a completed sale | 90 days after payment, then deleted |
| Photos of a bag we bought | 24 months after purchase, for authenticity records, then deleted |
| The record of the sale itself: item, price, date, and the last four digits of the account paid | 7 years, as required for our financial records |
| Partner profile and ledger | For the life of the partnership, then the ledger for 7 years and the profile deleted within 30 days |
| Server logs and error reports | 90 days |
These periods are enforced by a daily job, and each run records what it deleted.
Your choices and rights
- See or delete. Email privacy@samedaid.com from the address on your submission and we will send you what we hold, or delete it, within 30 days, except records we must keep by law, which we explain when we reply.
- Correct. Tell us and we fix it.
- No account needed. You can sell without creating an account. Signing in only lets you see your own submissions from another device.
- Email. The emails we send about a submission are part of the service. We do not send marketing email unless you opt in, and any marketing email carries an unsubscribe link.
- State rights. If you live in California, Connecticut, or another state with a consumer privacy law, you have rights to access, delete, correct, and port your data and to opt out of sale or targeted advertising. We do neither of the latter. Use the email above to exercise any right; we will not treat you differently for doing so.
- Children. The service is for adults. We do not knowingly collect data from anyone under 18, and we delete it if we learn we have.
Security
Data is encrypted in transit and at rest. Access to our database is limited to our servers and named staff, and every action on a submission is logged. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.
Cookies and storage
The site sets no advertising or analytics cookies. It uses your browser’s session storage to remember the submission you are working on until you close the tab, and a sign-in token if you sign in. Staff use one cookie to stay signed in to the desk.
Changes
We will post any change here with a new effective date, and email you about material changes if we hold your address for an open submission.
Privacy questions: privacy@samedaid.com. Last updated September 22, 2026.