Gavelist ("Gavelist," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information in connection with the Gavelist platform, website (www.gavelist.com), application programming interfaces, and related services (collectively, the "Service").

This Privacy Policy is incorporated into and subject to the Gavelist Terms of Service. Capitalized terms not defined here have the meanings given to them in the Terms of Service. By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Scope and Your Role

The Service is designed for estate auctioneers and auction professionals, and may also include publicly accessible listing, marketplace, bidding, and alert features used by members of the public. This Policy distinguishes among three categories of information:

(a) Information about you, our Client. This is information relating to you and your business as the account holder and user of the Service.

(b) Information contained in Client Content. When you upload photographs, item descriptions, catalog data, and other materials to the Service, those materials may incidentally contain personal information relating to third parties (for example, information appearing in a photographed document, or information about a consignor or estate). You are responsible for that information as described in Section 8 and in the Terms of Service. With respect to such information, you act as the controller (or the equivalent under applicable law) and Gavelist acts as a processor or service provider that processes it on your behalf and under your instructions.

(c) Information about End Users. Where Gavelist offers public listing, marketplace, bidding, registration, item-alert, or similar end-user-facing features, individuals such as bidders, buyers, alert subscribers, and site visitors ("End Users") may create accounts with, and provide information directly to, Gavelist. With respect to End User account information collected through Gavelist-operated surfaces, Gavelist acts as an independent controller. Where Gavelist processes End User information solely on behalf of and at the direction of a Client (for example, generating and sending an invoice to a Client's buyer), Gavelist acts as that Client's processor or service provider.

2. Information We Collect

2.1. Information You Provide Directly

Account information: name, business name, email address, phone number, mailing address, username, and password.
Billing information: payment method details, billing address, and transaction history. Payment card details are processed by our third-party payment processor and are not stored by Gavelist in full.
Communications: the contents of messages, support requests, and other communications you send to us.
Preferences and settings: description profiles, categorization preferences, workflow settings, and other configuration choices.

2.2. Client Content

We collect and process the Client Content you upload to or generate through the Service, including photographs, images, item information, catalog data, lot groupings, and AI-generated descriptions and outputs. Client Content may contain personal information as described in Section 1(b).

2.3. Information Collected Automatically

When you use the Service, we automatically collect certain information, including:

Usage data: features used, actions taken, volume of photographs and lots processed, processing quality metrics, edits and corrections made to AI Outputs, timestamps, and other interactions with the Service.
Device and technical data: IP address, browser type, operating system, device identifiers, and similar technical information.
Log data: server logs, error reports, and diagnostic information.
Cookies and similar technologies: as described in Section 6.

2.4. Information From Third Parties

We may receive information about you from third parties, such as payment processors (transaction confirmations), authentication or single sign-on providers (if you use them), and analytics providers.

2.5. End User Information

If you interact with Gavelist-operated public listings, marketplace, bidding, registration, or alert features as an End User, we collect information you provide and information generated by your activity, which may include: name, email address, phone number, and mailing address; account credentials; bidder registration and verification information (which may include identity verification and payment-card verification or authorization performed by our payment processor — full card details are not stored by Gavelist); bidding activity, bids, maximum bids, watchlists, saved searches, and alert preferences; transaction, invoice, and payment history relating to your purchases; shipping and pickup information; and communications with us or with auction clients through the Service. We also collect the automatic information described in Section 2.3 from End Users.

3. How We Use Information

We use the information we collect to:

provide, operate, maintain, and secure the Service, including processing Client Content to generate AI Outputs you request;
create and manage your account and authenticate your access;
process payments, billing, and subscription management;
respond to your inquiries, provide customer support, and communicate with you about your account and the Service;
monitor, analyze, and improve the Service, including quality assurance, error identification and resolution, system performance and capacity monitoring, and feature development, as further described in Section 4;
generate anonymized and aggregated data ("Aggregate Data") for lawful business purposes, including service improvement, product development, benchmarking, and industry analysis, as described in the Terms of Service;
detect, prevent, investigate, and address fraud, security incidents, prohibited uses, and violations of our Terms of Service, including through automated and AI-assisted systems;
comply with legal obligations and enforce our agreements;
send you administrative and, where permitted, promotional communications, from which you may opt out as described in Section 7;
operate public listing, marketplace, directory, bidding, and item-alert features, including publicly displaying Client listings and sale results where the applicable Client has enabled such features, and permitting search engines and similar services to index them;
facilitate transactions between Clients and End Users, including bidder registration and verification, bidding, invoicing, payment processing (through our payment processors), settlement, and fulfillment and pickup communications; and
provide End Users with service communications relating to their activity and preferences, such as registration confirmations, outbid notices, invoices and receipts, item alerts, saved-search results, and notices of upcoming auctions (which may include auctions conducted by multiple Gavelist clients), subject to the End User's communication preferences and applicable law.

4. Artificial Intelligence and Machine Learning Processing

The Service uses artificial intelligence and machine learning models to process Client Content and generate AI Outputs. In connection with this processing:

4.1. Model improvement. As described in the Terms of Service, we may use patterns, structures, and learnings derived from the processing of Client Content—including learning from the manual corrections and edits you make to AI Outputs—to train, improve, and refine the AI models underlying the Service. We will not use your identifiable Client Content (including specific photographs or proprietary catalog information) for training in a manner that would make such content available to other clients.

4.2. Third-party AI providers. Certain AI and machine learning processing may be performed by trusted third-party providers acting as our subprocessors. These providers process Client Content on our behalf and are subject to confidentiality and data protection obligations. See Section 5.

4.3. Analytics and monitoring. We maintain internal analytics and monitoring systems that track and analyze metadata about items processed through the platform (for example, item categories, estimated value ranges, processing quality scores, and category distribution trends) for service optimization, quality assurance, and business intelligence, as described in the Terms of Service.

4.4. Automated operations. We may use automated systems, including artificial intelligence, to support fraud detection and prevention, bidder verification, dispute and chargeback processing, customer support, and content moderation. Where required by applicable law, decisions producing legal or similarly significant effects will include appropriate human involvement, and you may contact us to request human review of such a decision.

5. How We Share Information

We do not sell your personal information. We share information only as described below:

5.1. Service providers and subprocessors. We share information with third-party vendors who perform services on our behalf and under our instructions. Categories of subprocessors include:

cloud hosting and infrastructure providers;
artificial intelligence and machine learning processing providers;
payment processors;
email, messaging, and communications providers; and
analytics, monitoring, and security providers.

These providers are authorized to use your information only as necessary to provide services to us.

5.2. Compliance and protection. We may disclose information if required to do so by law or in the good-faith belief that such disclosure is reasonably necessary to: (a) comply with a legal obligation, subpoena, or governmental request; (b) enforce our Terms of Service; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of Gavelist, our clients, or others.

5.3. Business transfers. If Gavelist is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, information may be transferred as part of that transaction, subject to the commitments in this Policy.

5.4. With your direction or consent. We may share information when you direct us to do so (for example, when you export Client Content to a third-party auction platform, or when you enable public listing or syndication features) or when you otherwise consent.

5.5. Aggregate and de-identified data. We may share Aggregate Data and de-identified data that cannot reasonably be used to identify you, your clients, or any specific auction item, for any lawful purpose.

5.6. Confidentiality of client-specific data. Consistent with the Terms of Service, we will not disclose your specific, identifiable Client Content to any third party (other than subprocessors necessary for Service delivery) without your prior written consent, and we will not provide your client-specific catalog data, item photographs, or proprietary auction information to your competitors — in each case except as and to the extent you have enabled or authorized publication, display, syndication, or sharing under the public-listing, market-data, or marketplace and transaction features described in the Terms of Service (see Sections 5.7 and 5.8 below). We maintain strict data segregation between client accounts.

5.7. Public display at Client direction. Where a Client enables public listing or syndication features, the applicable Client Content and AI Outputs — which may include item photographs, titles, descriptions, lot data, sale dates and locations, the auction house's identity and branding, estimates the Client elects to display, and, where enabled, realized prices — are displayed publicly on Gavelist-operated websites and surfaces, may be indexed and cached by search engines and similar services, and may be viewed, copied, or redistributed by anyone. Public display under this Section occurs at the direction of the applicable Client, and requests concerning such content should generally be directed to that Client; we will assist as required by applicable law.

5.8. Sharing between Clients and End Users. In connection with marketplace, bidding, invoicing, and transaction features, we share relevant information between the parties to a transaction. For example, we provide a Client with the identity, contact information, registration status, and bidding and payment information of End Users participating in that Client's sales, as reasonably necessary for the Client to conduct, settle, and service the sale; and we provide End Users with the identity and contact details of the auction Client conducting a sale, along with invoices and transaction communications relating to their purchases. Each Client is responsible for its own use of End User information received through the Service, which may be subject to the Client's own privacy practices.

6. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and secure the Service, remember your preferences, authenticate your session, and analyze usage. You can control cookies through your browser settings, but disabling certain cookies may affect the functionality of the Service. If we use analytics providers that set cookies, their processing is governed by their own privacy policies.

7. Your Rights and Choices

7.1. Account information. You may access and update your account information at any time through the Service or by contacting us.

7.2. Client Content export and deletion. Upon termination of your account, you will have thirty (30) days to export your Client Content, after which we may delete it in accordance with our data retention practices, as described in the Terms of Service.

7.3. Marketing communications. You may opt out of promotional communications by following the unsubscribe instructions in those messages or by contacting us. We may still send you non-promotional messages about your account or the Service.

7.4. Rights under applicable law. Depending on where you or the relevant data subjects are located, you or they may have rights to request access to, correction of, deletion of, or restriction of the processing of personal information, to object to certain processing, and to data portability. We will honor such requests as required by applicable law. Because much of the personal information we process in Client Content is processed on your behalf, requests relating to such information should generally be directed to you as the controller; we will assist you in responding to such requests as required by law and our agreement.

7.5. California residents. If you are a California resident, you may have rights under the California Consumer Privacy Act (as amended), including the right to know what personal information we collect and how we use and disclose it, the right to request deletion, the right to correct inaccurate information, and the right not to be discriminated against for exercising your rights. We do not sell or share personal information for cross-context behavioral advertising. To exercise these rights, contact us using the information in Section 12.

7.6. EU/UK data subjects. Where the EU General Data Protection Regulation or UK GDPR applies, our processing is based on one or more lawful bases, including performance of a contract, our legitimate interests, compliance with legal obligations, and consent where required. Data subjects have the rights described in Section 7.4 and may lodge a complaint with a supervisory authority.

7.7. End User choices. End Users may manage item alerts, saved searches, watchlists, and communication preferences through their account settings or the unsubscribe or preference links included in our messages. Transactional communications relating to an active registration, bid, invoice, or purchase (such as outbid notices, invoices, and receipts) are a condition of using the applicable features and may continue while the transaction is pending. Requests concerning information that an auction client holds about you as its customer should be directed to that client; we will assist as required by applicable law.

8. Your Responsibilities

As set forth in the Terms of Service, you represent and warrant that you have obtained all necessary consents and authorizations required under applicable privacy and data protection laws before uploading any personal information to the Service, including personal information contained in photographs or item descriptions. You are responsible for providing any privacy notices to, and obtaining any consents from, the individuals whose personal information may be included in your Client Content. If you receive End User information through marketplace, bidding, or transaction features, you are responsible for your own handling of that information in compliance with applicable law and your own privacy practices.

9. Data Retention

We retain personal information and Client Content for as long as your account is active or as needed to provide the Service, and thereafter as necessary to comply with our legal obligations, resolve disputes, enforce our agreements, and for legitimate business purposes. Client Content is retained and deleted in accordance with the export and deletion timelines described in the Terms of Service and Section 7.2. End User account information is retained while the End User account is active and thereafter as necessary for the purposes described above, including fraud prevention and transaction records. Aggregate and de-identified data may be retained indefinitely.

10. Data Security

We implement commercially reasonable administrative, technical, and physical safeguards designed to protect personal information and Client Content from unauthorized access, use, alteration, or disclosure. However, no method of electronic storage or transmission over the Internet is completely secure, and we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify you in accordance with applicable law.

11. Children's Privacy

The Service is intended for use by businesses, professionals, and adults. We do not knowingly collect personal information from children under the age of 13 (or the applicable age in your jurisdiction), and End Users must be of legal age to enter binding contracts in order to register or bid. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

12. International Data Transfers

Gavelist is based in the United States, and we process and store information in the United States and potentially in other countries where our subprocessors operate. If you access the Service from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. Where required by applicable law, we implement appropriate safeguards for international transfers.

13. Third-Party Links and Platforms

The Service may contain links to, or integrations with, third-party websites and platforms (including third-party auction platforms and payment processors). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing them with your information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the Service prior to the effective date of the changes. Your continued use of the Service after the effective date of the revised Privacy Policy constitutes your acceptance of the changes.

15. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at:

Gavelist — Pittsburgh, Pennsylvania Email: support@gavelist.com Website: www.gavelist.com