California Privacy Notice

This notice describes how BuyLow handles personal information of California residents, under the California Consumer Privacy Act as amended by the California Privacy Rights Act. It sits alongside the Privacy Policy, which is the full version; this is the California-specific summary.

We do not collect sensitive personal information. We do not collect or infer your precise geolocation, your health, your biometric identifiers, your government identifiers, your religious or philosophical beliefs, your sex life or sexual orientation, your union membership, or the contents of your mail, email or text messages. We do not use sensitive personal information to infer characteristics about you.

Each category is collected for a specific business purpose rather than for anything we can do with it afterwards:

• Identifiers — to create and secure your account, and to sign you in.
• Customer records — to deliver your order.
• Commercial information — to place and track orders, handle refunds, and keep the accounting record.
• Internet activity — to keep you signed in and to count product views per day so sellers can see interest in a listing.
• Professional information — to publish and run your storefront.
• Audio, visual information — to show the images you chose to publish.
• Inferences — to restrict a review to a real purchase.

All of it comes from you, or is generated by your own use of the site. The exception is delivery information: the carrier the seller chooses generates the tracking number and delivery scan events we attach to the order.

To service providers who process it for us: Stripe and PayPal for payment, Resend for transactional email, Cloudflare for hosting and delivery, and our infrastructure providers for the database, queue, cache and image storage. To the seller of the item you bought, for the delivery details of that order, and nowhere else. To authorities, where the law requires it.

We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not run advertising or retargeting pixels, and we do not allow a seller to export a list of buyers. Because there is nothing to opt out of, the opt-out control in this policy is shown as not applicable.

• Right to know — to ask what personal information we hold about you, the categories of it, and the sources and purposes.
• Right to delete — to ask us to delete personal information we collected from you, subject to exceptions such as completing a transaction or meeting a legal obligation.
• Right to correct — to ask us to correct inaccurate personal information.
• Right to portability — to ask for your personal information in a portable, machine-readable format.
• Right to opt out of sale or sharing — not applicable, because we do not sell or share personal information as described above.
• Right to limit use of sensitive personal information — not applicable, because we do not collect sensitive personal information.
• Right to non-discrimination — we do not deny you a service, charge a different price, or provide a different level of service because you exercised a right under this notice.

Some things you can do yourself today: delete a review, cancel an order, change your profile details, or delete your account. For a formal request — access, correction or portability, or deletion if you can no longer sign in — the request has to reach us at an address we verify.

We update this notice when what we collect changes. The date at the top shows the version you are reading, and a material change is announced by email before it takes effect.