Privacy Policy
This page describes what data Instrument Marketplace ("we", "the Platform") collects and why, kept in sync with the features actually implemented on the Platform. It is only available in English — other languages link here. Placeholder version; does not replace legal review before going live.
1. Who is responsible
The data controller for this Platform is the operator of Instrument Marketplace (legal entity details to be added to the imprint before going live). For any privacy question, contact support@example.com or use the contact form.
2. Cookies we use
| Cookie | Purpose | Duration | Requires consent? |
|---|---|---|---|
better-auth.session_token | Keeps you signed in. | 7 days | No — strictly necessary |
NEXT_LOCALE | Remembers your chosen language. | 1 year | No — strictly necessary |
cookie_consent | Remembers your cookie choice so we don't ask again. | 1 year | No — strictly necessary |
visitor_id | Anonymous ID used only to avoid double-counting a listing "view" from the same visitor, so dealers see accurate impression/view statistics for their own listings. | 1 year | Yes — only set if you accept "all" in the cookie banner |
Your dark/light theme preference is stored in your browser's localStorage, not in a cookie, and never leaves your device.
3. Data we collect and why
- Account data — email address, optional display name, preferred language, notification preferences. Used to run your account and, if you opt in, to send you email notifications.
- Dealer data — company name, description, certificates, locations (address, city, country, coordinates) if you register as a dealer.
- Listings — instrument details, images, and documents you upload as a dealer.
- Messages — content of messages exchanged between buyers and dealers through the Platform, and any attachments.
- Favorites, collections & saved searches — the instruments you save, the collections you build, and search criteria you choose to save.
- Travel planner— a start address/coordinates you provide is sent to OpenStreetMap's Nominatim service to resolve it to map coordinates (see §4), and used to compute an itinerary and hotel suggestions.
- Reports & moderation — content of any report you file about a listing or dealer.
- Anonymous analytics (only with consent) — listing impression/view counts tied to the anonymous
visitor_idcookie, used solely to show dealers aggregate statistics about their own listings. - Technical/audit data — IP address and user-agent may be logged transiently for security and abuse prevention (e.g. with tracking events, or in the admin audit log for administrative actions).
- Push notification subscriptions (only if you enable push notifications) — a browser-generated subscription endpoint and encryption keys, used solely to deliver notifications you opted into. You can disable this at any time in your account settings, which removes the subscription.
- Dealer social media connections — if a dealer connects a Facebook Page, we store the Page ID and an access token the dealer generates themselves, used only to post listings the dealer chooses to share to that Page.
4. Third parties we use
- Stripe — processes payments for dealer premium subscriptions. We never see or store your card details; see Stripe's privacy policy.
- Our email provider (SMTP) — sends transactional emails (sign-in links, notifications). We do not use marketing email tools.
- Google, Apple, LinkedIn & Facebook — only if you choose to sign in with one of these providers instead of a magic link.
- OpenStreetMap— the Nominatim service resolves addresses you enter (dealer locations, travel planner) to map coordinates; map tiles for the travel planner map are loaded directly from OpenStreetMap's tile servers, which see your IP address like any image request.
- Facebook Pages— if a dealer connects a Facebook Page and chooses to post a listing to it, limited listing information (title, category, city, and a link back to the listing — never the price) is sent to Facebook's Graph API and published on that Page; see Facebook's privacy policy.
- Push notification services— if you enable push notifications, your browser's push service (operated by your browser vendor, e.g. Google or Mozilla) delivers the notification to your device.
- Hosting/infrastructure providers — our server and database provider process data as necessary to run the Platform.
5. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact support@example.com. Deleting your account removes your profile, favorites, collections, and saved searches; messages you sent may remain visible to the other party in a conversation.
6. Data retention
We keep account data for as long as your account is active. Anonymous analytics tied to visitor_id are kept only in aggregate form for dealer statistics. Audit logs of administrative actions are kept for accountability purposes.
7. Children
The Platform is not directed at children and is not knowingly used by anyone under the age required by local law to consent to data processing.
8. Changes to this policy
We update this page whenever we add a feature that changes what data we collect or which third parties we use — most recently to reflect push notification subscriptions, sign-in with Apple/ LinkedIn/Facebook, and dealers posting listings to a connected Facebook Page.