The short version
We collect what a store needs to sell you something and get it to you: your account details, your order, and the address it goes to. Payments run through Stripe. We never store your full card number.
We use cookieless product analytics to see how the store is used so we can make it better, and we may run advertising measurement tags so we can tell which of our own ads work. We do not sell your information.
Want a copy of your data, a correction, or your account deleted? Email [email protected] and we will take care of it.
Who we are
Bidvana is an online store for retail returns and overstock. We buy inventory in bulk from major retailers, open and inspect it by hand in Waxhaw, NC, photograph and score every unit, then sell it one item at a time.
This policy is issued by Bidvana, LLC, operating as Bidvana (“Bidvana”, “we”, “us”). It covers our online store, your account and checkout, together the “Services”.
Information we collect
We collect what a store needs to sell you something and get it to you:
- Account information. Your account lives on our own systems. It holds your email address, and your name and phone number when you give them to us. You sign in with a single-use code we email you, or with a password if you set one; a password is stored only as a one-way hash, so we cannot read it back. There is no third-party sign-in service.
- Order and shipping details. What you bought, the price you paid, the email address we send order messages to, and a phone number so the carrier can reach you about a delivery.
- Shipping addresses. The address you give us at checkout, and the addresses you save to your account so you do not have to type them again. A ZIP code or address you enter while browsing, to see shipping estimates before checkout, is kept in your browser rather than on your account.
- Payment information. Payments are processed by Stripe, which receives your card or payment account details directly. We never store full payment card numbers. What we keep is what is needed to recognize a card or a transaction: the card brand, the last four digits, the expiry, and the Stripe reference. Cards you save for next time are stored by Stripe, not by us.
- Store credit. A ledger of credit added to your account, held for a checkout in progress, spent on an order, or refunded, with the order each entry relates to.
- Bidvana Rewards points. A ledger of every point you earn, lose to a return, redeem for store credit, or are given by our team, with the order and the reason behind each entry. Entries are added and never edited, so the record of how a balance was reached stays intact.
- Saved items. The items you save, so they are waiting in your account next time you sign in.
- Order history. Your past orders, their status, refunds and returns, so you can see them in your account and so we can service them.
- Inspection requests. When you ask us to inspect a coming-soon item, or to inspect an item you are buying before it ships, we keep the request, anything you asked us to check, the email address you gave us so we can send the report, and the report itself. Asking does not need an account, so a request may be the only thing we hold about you, and in that case it is your email address and what you asked us to inspect.
- Customer support messages. Emails and messages you send us, and our replies, so we have the history of your issue.
- Usage and analytics data. How the store is used: which product pages are viewed, what people search for, and how a visit moves through browsing, saving items and checking out. See Product analytics and advertising for what we record and what we do with it.
- Technical and log data. Our servers automatically record standard information such as IP address, browser and device type, pages requested and timestamps. This is how we keep the store up, debug problems and detect abuse.
We do not intentionally collect sensitive categories of personal information, such as health, biometric or precise geolocation data, and we ask that you not send them to us.
How we use information
We use the information above to:
- Fulfil your order: take payment, hold the unit while you check out, pack it, and ship it to you by carrier.
- Run your account: sign you in, show your order history and saved addresses, keep your saved items and inspection requests, and maintain your store credit balance.
- Send the messages a store owes you: order confirmations, shipping and delivery updates, inspection reports and the inspection-complete notices you asked for, refund and store credit notices, and changes to our terms or this policy.
- Answer your questions and handle returns, refunds and price adjustments.
- Understand how the store is used, so we can fix what is confusing and list more of the inventory people are looking for, and measure which of our own ads bring people here. See Product analytics and advertising.
- Operate and secure the Services, including preventing fraud, abuse and unauthorized access.
- Comply with our legal obligations, including tax and accounting record-keeping, and enforce our Terms of Service.
Product analytics and advertising
The store keeps its own small log of demand: when a product page is viewed and when a search runs, with the search words and how many results came back. The only identifier on those rows is a one-way hash of the cart cookie, used to count one person’s repeat views of the same unit within an hour once. No IP address, browser details or account id is stored with them. That log is what orders the shop’s Recommended sort and tells us which searches find nothing.
We also use PostHog for product analytics: which pages and products get viewed, what people search for, and how a visit moves through browsing, adding to a cart and checking out. We read that to improve the experience and to show more of the inventory people are actually looking for.
PostHog runs here in its cookieless mode. It sets no analytics cookie and stores no identifier in your browser; a visit is recognized from a short-lived value derived from your IP address and browser details, which rotates daily, so analytics cannot follow you from one day to the next. When you are signed in, that activity may be associated with your account, so that one person on a phone and a laptop is not counted as two.
We use Sentry to catch errors. When something breaks, Sentry receives the error itself, the page you were on, your browser and device details and the actions that led to it. It never receives your card details, and we do not send it your password or the contents of your account.
Advertising measurement. We may run advertising measurement tags, for example from Meta or Google, through Google Tag Manager. Their purpose is to tell us which of our own ads brought someone to the store and which led to an order. Those tags can set their own cookies or identifiers and report the page you viewed or the fact that an order was placed back to the advertising platform, which may also use it for its own purposes under its own terms. We do not sell your personal information, and we do not run ads for anyone else on the store.
This is used for our own product decisions and our own advertising. We do not sell your information, and there are no data brokers on the store.
Limiting it. Your browser can block or delete cookies, and a tracker blocker or a browser that blocks third-party tags will stop the advertising tags described above from loading. Because our product analytics is cookieless, clearing cookies does not switch it off; a blocker that blocks the PostHog script does. The advertising platforms also publish their own ad settings, such as Google’s Ads Settings and Meta’s ad preferences, where you can limit how your activity is used for advertising. We honour browser privacy signals where a tool supports them. Opting out does not change your price, your access to the store, or how we handle your order.
We keep analytics data for as long as we need it for that purpose, and then aggregate or delete it.
What we do not do
Three commitments, stated plainly:
- We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are used under California law.
- We do not run other companies’ ads on the store. There are no ad networks selling space here and no data brokers. The advertising tags described above measure our own ads and nothing else.
- We do not rent or trade our email lists. The address on your account is used for Bidvana messages only.
How long we keep information
We keep personal information for as long as we need it for the purpose we collected it, and then for as long as the law requires:
- Account information: while your account is open, and for a short period afterwards in case you come back or a dispute arises.
- Order, payment, store credit and tax records: for the period required by tax and accounting law, which is typically several years. These records are why closing an account does not delete everything.
- Saved items and inspection requests: until you remove or withdraw them, or close your account. A request made without an account is kept until you withdraw it with the link in its email.
- Support correspondence and inspection requests: while they are useful for servicing your account and resolving disputes.
- Analytics data: as long as needed for the purpose, then aggregated or deleted.
- Server logs: for a limited period for security and debugging, then discarded or aggregated.
How we protect information
Traffic to and from the store is encrypted in transit. Data is stored on managed cloud infrastructure with access limited to the people at Bidvana who need it to do their jobs. A password you set is stored only as a one-way hash, and card numbers are held by Stripe rather than by us.
No system is perfectly secure, and we cannot guarantee absolute security. If you believe your account has been compromised, email us at [email protected] and we will act on it.
Your rights and choices
Wherever you live, you can ask us to do the following, and we will honour the request to the extent the law allows:
- Access: get a copy of the personal information we hold about you.
- Correct: fix information that is wrong or out of date. Your name, email, addresses and saved cards can also be changed from your account.
- Delete: close your account and delete your personal information, except records we must keep, such as completed order and tax records.
- Opt out of optional email: the inspection-complete notice is the thing an inspection request asks for, so it is sent because you asked for it and nothing else is sent with it. Every one of those emails carries a link that withdraws the request, which works whether or not you have an account, and a signed-in shopper can also withdraw a request from their account. We do not send marketing email today; if we ever do, every message will carry an unsubscribe link. Order and service messages are not marketing and continue while you have an open order.
- Limit analytics and advertising measurement: block cookies and tags, or use the opt-outs described in Product analytics and advertising.
To make a request, email [email protected] from the address on your account, or tell us enough for us to verify you. We do not charge for this and we will not treat you differently for asking.
California residents
Under the California Consumer Privacy Act, as amended by the CPRA, you have the right to know what personal information we collect, use and disclose; to request deletion or correction; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising those rights. As stated above, we do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information for purposes that require an opt-out. You may use an authorized agent to submit a request; we will ask for proof of their authority. Send requests to [email protected].
Other states and jurisdictions
Residents of other states with comprehensive privacy laws have comparable rights of access, correction, deletion and portability. Use the same address and we will apply whichever protections your law provides.
Children
The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, email [email protected] and we will delete it. Accounts and purchases require you to meet the age requirements in our Terms of Service.
Changes to this policy
We may update this policy as the store changes: new features, new service providers, new legal requirements. When we do, we revise the effective date at the top of this page. If the change is significant, we will give notice through the Services or by email to account holders. Continuing to use the Services after an update means you accept the revised policy.
Contact us
Questions about privacy, or a request about your data? Email [email protected]. A person on our team reads it. Expect a reply within one business day.
Bidvana, LLC
Waxhaw, NC
[email protected]
See also our Terms of Service, how Bidvana works and how we rate condition.