Privacy Policy

1.Information we collect

Account information: your name, email, and phone number when you register.

Identity verification: sellers complete government-ID verification through our provider, Didit. The verification result and limited confirmation data are returned to Hagglefy; the underlying identity documents are handled by the provider under its own privacy terms.

Risk signals: at signup we use a fraud-scoring provider (IPQS) that assesses signals such as IP and device reputation to deter fraud and abuse.

Listings and messages: vehicle details you post, and the messages you exchange through anonymous negotiation (which our systems scan to mask contact information until identities are revealed).

Payment information: when a seller fee is charged, our processor (Stripe) collects and processes card details. Hagglefy does not store full card numbers.

Usage data: searches, saved cars, device and log data used to operate and improve the service.

2.Why we use it

To operate the marketplace: create accounts, verify sellers, publish listings, power search, enable negotiation, reveal identities on agreement, and charge the seller fee.

To keep the platform safe: prevent fraud, curbsiding, scams, and abuse, and enforce our Terms and Acceptable Use rules.

To communicate with you: transactional emails (login, alerts) and service notices.

We rely on your consent and on our legitimate interest in operating a safe marketplace; you can withdraw consent subject to the limits below.

3.How we share it

With the other party at reveal: when you and a counterparty agree on a price, your identity and contact details are revealed to that counterparty so you can complete the sale.

With service providers who process data on our behalf: identity verification (Didit), fraud scoring (IPQS), payments (Stripe), email (Resend), hosting and storage (Railway, Vercel, Cloudflare). These providers are bound to use the data only to provide their service.

For legal reasons: to comply with law, respond to lawful requests, or protect rights and safety. We do not sell your personal information.

4.International processing

Some providers may process data outside Canada (for example, in the United States). Where that happens, the data may be subject to the laws of those jurisdictions. [COUNSEL: confirm cross-border transfer disclosures and any provincial requirements, including Quebec Law 25 transfer-assessment obligations.]

5.Retention and security

We keep personal information only as long as needed for the purposes above or as required by law, then delete or de-identify it. We use technical and organizational safeguards to protect it, though no system is perfectly secure.

6.Your rights

You may request access to, or correction of, your personal information, and may ask questions or complain about our handling of it. Contact us and we will respond as required by law. You also have the right to complain to the Office of the Privacy Commissioner of Canada. [COUNSEL: add designated privacy officer contact and provincial complaint bodies.]

7.Cookies and changes

We use cookies and similar technologies to keep you logged in and to operate the site. We may update this policy; material changes will be posted with a new “last updated” date.