Privacy Policy

Welcome to reLocal ("we," "our," or "us"). We are committed to protecting your privacy and handling your personal information with care and transparency. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our marketplace platform located at relocal.app (the "Platform").

By accessing or using our Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Platform.

2.1 Information You Provide to Us

We collect information that you voluntarily provide when using our Platform:

• Account Information: When you create an account, we collect your name, email address, password (encrypted), and account preferences.
• Seller Application Data: If you apply to become a seller, we collect business name, phone number, experience details, and any other information you provide in your application.
• Profile Information: Optional information such as profile pictures, seller slugs, business descriptions, and tier preferences (buyer, seller, admin).
• Listing Information: For sellers, we collect information about homes and items you list, including descriptions, prices, images, pickup locations, and availability.
• Transaction Data: When you make purchases, we collect order details, item selections, pickup preferences, and communication preferences.
• Communication Data: Messages, inquiries, offers, and other communications you send through our Platform.

2.2 Payment Information

We use Stripe as our third-party payment processor. When you make a purchase, Stripe collects and processes your payment card information, billing address, and other payment details. We do not store complete payment card numbers on our servers. We receive only limited information from Stripe, such as transaction IDs, payment status, and the last four digits of your card for record-keeping purposes.

2.3 Automatically Collected Information

• Usage Data: We collect information about your interactions with the Platform, including pages viewed, time spent, clicks, search queries, and browsing patterns.
• Device Information: We collect device type, operating system, browser type, IP address, unique device identifiers, and general location data (city/region based on IP).
• Cookies and Similar Technologies: We use cookies, web beacons, and similar tracking technologies to collect information about your browsing behavior. See our Cookie Policy for more details.
• Analytics Data: We use Vercel Analytics and Google Analytics to collect aggregated usage statistics, performance metrics, and demographic information to improve our Platform.

2.4 Information from Third Parties

We may receive information about you from third-party services you connect to your account, authentication providers, or public databases to verify information you provide.

We use the information we collect for the following purposes:

• Platform Operation: To provide, maintain, and improve our marketplace services, including account creation, seller approvals, listing management, and transaction processing.
• Communication: To send you transactional emails (order confirmations, account notifications, password resets), respond to inquiries, and provide customer support.
• Personalization: To customize your experience, display relevant listings, remember your preferences, and provide location-based services.
• Marketing: To send promotional emails, newsletters, and updates about new features or offerings (you can opt out at any time).
• Analytics and Improvement: To analyze usage patterns, measure Platform performance, conduct research, and develop new features.
• Security and Fraud Prevention: To detect, prevent, and address fraud, security vulnerabilities, abuse, and technical issues.
• Legal Compliance: To comply with legal obligations, enforce our Terms of Service, resolve disputes, and protect our rights and the rights of our users.
• Seller Verification: To review seller applications, verify business information, and maintain marketplace quality.

We do not sell your personal information. We share your information only in the following circumstances:

4.1 With Other Users

When you create listings or make purchases, certain information becomes visible to other users:

• Sellers can see buyer names and contact information for orders placed on their listings.
• Buyers can see seller business names, listing information, and pickup location details.
• Public profiles may display seller slugs, business names, and listing information.

4.2 Service Providers

We share information with third-party service providers who perform services on our behalf:

• Supabase: Our database and authentication provider (stores user accounts, listings, orders, and application data)
• Stripe: Payment processing and transaction management
• Vercel: Platform hosting, analytics, and content delivery
• Google Analytics: Usage analytics and performance monitoring
• Email Service Providers: Transactional and marketing email delivery

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal processes (subpoenas, court orders, search warrants)
• Government or regulatory requests
• Protection of our rights, property, or safety, or that of our users or the public
• Investigation of fraud, security issues, or violations of our Terms of Service

4.4 Business Transfers

If reLocal is involved in a merger, acquisition, asset sale, bankruptcy, or other business transaction, your information may be transferred as part of that transaction. We will notify you of any such change and provide choices regarding your information.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent or at your direction.

5.1 Data Storage

Your information is stored using Supabase, which provides enterprise-grade PostgreSQL databases with built-in security features. Data is stored on servers located in the United States and may be processed in other countries where our service providers operate.

5.2 Security Measures

We implement industry-standard security measures to protect your information:

• Encryption in transit using TLS/SSL protocols
• Encryption at rest for sensitive data
• Row Level Security (RLS) policies to isolate user data
• Regular security audits and vulnerability assessments
• Access controls and authentication requirements for staff
• Secure password hashing using industry-standard algorithms
• Monitoring and logging of suspicious activities

5.3 Data Retention

We retain your information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Account data is retained while your account is active and for 3 years after account closure
• Transaction records are retained for 7 years for accounting and legal compliance
• Marketing communications data is retained until you opt out
• Analytics data may be retained in aggregated, anonymized form indefinitely

5.4 Security Limitations

While we use reasonable security measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your information. You are responsible for maintaining the confidentiality of your account credentials.

Depending on your location, you may have the following rights regarding your personal information:

6.1 Access and Portability

You have the right to access your personal information and receive a copy in a structured, commonly used format. You can access most of your information through your account settings.

6.2 Correction and Update

You can update your account information, profile details, and preferences at any time through your account settings. Contact us if you need assistance correcting inaccurate information.

6.3 Deletion

You have the right to request deletion of your personal information, subject to certain exceptions (e.g., legal retention requirements, pending transactions). To delete your account, visit your account settings or contact us. Note that:

• Some information may be retained in backups for a limited period
• Transaction records may be retained for legal and accounting purposes
• Anonymized data may be retained for analytics
• Cached or archived copies may take time to delete

6.4 Opt-Out of Marketing

You can opt out of marketing emails by clicking the "unsubscribe" link in any marketing email or updating your communication preferences in account settings. You will continue to receive transactional emails necessary for Platform operation.

6.5 Cookie Controls

You can control cookies through your browser settings. See our Cookie Policy for detailed information about the cookies we use and how to manage them.

6.6 Do Not Track

Our Platform does not currently respond to "Do Not Track" signals from browsers. You can control tracking through cookie settings and opt-out mechanisms described in our Cookie Policy.

6.7 Exercising Your Rights

To exercise any of these rights, contact us at privacy@relocal.app. We will respond to your request within 30 days (or as required by applicable law). We may require verification of your identity before processing your request.

reLocal is based in the United States. If you access our Platform from outside the United States, your information will be transferred to, stored, and processed in the United States and other countries where our service providers operate.

These countries may have data protection laws that differ from your country of residence. By using our Platform, you consent to the transfer of your information to the United States and other countries. We implement appropriate safeguards to protect your information in accordance with this Privacy Policy and applicable law.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses or other legally approved transfer mechanisms when transferring data outside these regions.

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:

8.1 Right to Know

You have the right to request disclosure of:

• Categories of personal information we collected about you
• Categories of sources from which the information was collected
• Business or commercial purpose for collecting or selling personal information
• Categories of third parties with whom we share personal information
• Specific pieces of personal information we collected about you

8.2 Right to Delete

You have the right to request deletion of personal information we collected from you, subject to certain exceptions.

8.3 Right to Correct

You have the right to request correction of inaccurate personal information we maintain about you.

8.4 Right to Opt-Out of Sale/Sharing

We do not sell your personal information for monetary consideration. However, some data sharing for analytics and advertising purposes may be considered "sharing" under California law. You have the right to opt out of such sharing.

8.5 Right to Limit Use of Sensitive Personal Information

If we use or disclose sensitive personal information for purposes beyond those permitted by CPRA, you have the right to limit such use or disclosure.

8.6 Non-Discrimination

We will not discriminate against you for exercising your California privacy rights. You have the right to receive equal service and pricing.

8.7 Authorized Agents

You may designate an authorized agent to make requests on your behalf. We may require verification of the agent's authority.

8.8 California Information Sharing Disclosure

California residents may request a list of third parties to whom we have disclosed personal information for direct marketing purposes. We do not currently share information for such purposes.

To exercise your California privacy rights, contact us at privacy@relocal.app or use the contact information in Section 13.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) provides you with additional rights:

9.1 Legal Basis for Processing

We process your personal information based on the following legal grounds:

• Contract Performance: Processing necessary to provide our Platform services and fulfill our contractual obligations to you
• Legitimate Interests: Processing necessary for our legitimate business interests (fraud prevention, security, analytics, improving services)
• Consent: Processing based on your explicit consent (marketing communications, optional features)
• Legal Obligation: Processing required to comply with legal or regulatory requirements

9.2 Your GDPR Rights

Under GDPR, you have the right to:

• Access: Obtain confirmation of whether we process your data and receive a copy
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Restriction: Request restriction of processing in certain circumstances
• Data Portability: Receive your data in a structured, machine-readable format and transmit it to another controller
• Object: Object to processing based on legitimate interests or for direct marketing
• Withdraw Consent: Withdraw consent at any time (where processing is based on consent)
• Lodge a Complaint: File a complaint with your local data protection authority

9.3 Data Protection Officer

For GDPR-related inquiries, you may contact our Data Protection Officer at dpo@relocal.app.

9.4 EU Representative

If required under GDPR, we will appoint an EU representative. Contact information will be provided here when applicable.

Our Platform is not intended for children under the age of 18. We do not knowingly collect personal information from children under 18. If you are under 18, do not use our Platform or provide any information to us.

If we learn that we have collected personal information from a child under 18, we will delete that information promptly. If you believe we have collected information from a child under 18, please contact us immediately at privacy@relocal.app.

Our Platform may contain links to third-party websites, services, or applications (e.g., Stripe payment pages, social media platforms). This Privacy Policy applies only to our Platform. We are not responsible for the privacy practices of third parties.

We encourage you to read the privacy policies of any third-party services you access through our Platform. Third-party services may collect information independently and have their own privacy practices.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated Privacy Policy on this page with a new "Last Updated" date
• Sending an email notification to the address associated with your account
• Displaying a prominent notice on our Platform

Your continued use of the Platform after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with the updated Privacy Policy, you should discontinue use of the Platform and close your account.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

We will respond to your inquiry within a reasonable timeframe, typically within 30 days or as required by applicable law.

14.1 Virginia, Colorado, Connecticut, and Utah Residents

If you are a resident of Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA), or Utah (UCPA), you have similar rights to those described in the California section, including rights to access, correct, delete, and opt out of targeted advertising and sales of personal information.

14.2 Nevada Residents

Nevada residents have the right to opt out of the sale of their personal information. We do not currently sell personal information as defined by Nevada law.

14.3 Canadian Residents (PIPEDA)

If you are a Canadian resident, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), including rights to access and correct your personal information. Contact us using the information in Section 13 to exercise these rights.

14.4 Brazilian Residents (LGPD)

If you are a Brazilian resident, the Lei Geral de Proteção de Dados (LGPD) provides you with rights similar to GDPR, including rights to access, correction, deletion, portability, and information about data sharing.