Privacy policy

Effective Date: September 15, 2025

This Privacy Policy describes how Bijective Markets, Inc. ("Company," "we," "us," "our"), which operates Block Market (the "Platform," "Service"), collects, uses, and protects information when you use the Platform. We are committed to protecting your privacy and ensuring transparency about our data practices.

1. INFORMATION WE COLLECT

1.1 Account Information

We collect information you provide when creating and managing your account:

• Full name and university email address
• User ID (automatically generated from email)
• Phone number (optional, for SMS notifications)
• Account type preferences (buyer, seller, or both)
• Profile information and preferences

1.2 Financial Information

We collect payment and financial data to facilitate transactions:

• Connected bank account information (processed by Stripe)
• Payment method details (Stripe payment methods)
• Transaction history and payment records
• Account balances and site credit amounts
• Withdrawal requests and payout information

1.3 Usage Information

We collect information about how you use our Platform:

• Order history and transaction details
• Restaurant preferences and order patterns
• Platform navigation and feature usage
• Communication preferences and settings
• Referral activities and relationship data

1.4 Technical Information

We automatically collect certain technical information:

• Device information and browser type
• IP address and general location data
• Platform access logs and usage analytics
• Error reports and performance data
• Security event logs

1.5 Communication Data

We collect information from your communications:

• Messages sent through Platform support channels
• SMS notification preferences and delivery status
• Email communication records
• Dispute submissions and resolution correspondence

2. HOW WE USE YOUR INFORMATION

2.1 Platform Operations

We use your information to operate and improve our Platform:

• Creating and maintaining user accounts
• Processing orders and facilitating transactions
• Matching buyers with sellers
• Managing payment processing and withdrawals
• Providing customer support and resolving disputes

2.2 Communication and Notifications

We use your information to communicate with you:

• Sending transactional notifications about orders and payments
• Providing SMS updates for order status (when enabled)
• Delivering important Platform updates and security alerts
• Responding to support inquiries and dispute submissions

2.3 Security and Fraud Prevention

We use your information to maintain Platform security:

• Verifying user identity and preventing fraud
• Detecting suspicious account activity
• Investigating policy violations and disputes
• Maintaining audit trails for financial transactions

2.4 Platform Improvement

We use aggregated, anonymized data to improve our Platform:

• Analyzing usage patterns and user preferences
• Optimizing Platform performance and features
• Developing new services and enhancements
• Conducting internal research and analytics

3. INFORMATION SHARING AND DISCLOSURE

3.1 University Independence

CRITICAL: We do not share any user information with universities. The Platform operates independently to protect user privacy from institutional oversight.

3.2 Service Providers

We share information with trusted service providers who assist with Platform operations:

• Stripe: Payment processing and financial services
• Venmo: Payment processing and financial services
• Twilio: SMS notification services
• Supabase: Database and authentication services
• Cloudflare: Privacy and hosting protections

3.3 Legal Requirements

We may disclose information when required by law:

• Compliance with valid legal process (subpoenas, court orders)
• Protection of our legal rights and property
• Prevention of fraud or illegal activity
• Response to government investigations or regulatory requests

3.4 Business Transfers

In the event of a business sale, merger, or acquisition:

• User information may be transferred to the acquiring entity
• Users will be notified of any ownership changes
• Privacy protections will be maintained during transitions

3.5 User Consent

We may share information with your explicit consent:

• When you authorize specific data sharing
• For features that require third-party integration
• When participating in surveys or research studies

4. DATA SECURITY

4.1 Security Measures

We implement comprehensive security measures to protect your information:

• Encryption of data in transit and at rest
• Secure payment processing through PCI-compliant providers
• Regular security audits and vulnerability assessments

4.2 Financial Data Protection

Special protections apply to financial information:

• Payment data is processed securely through Stripe
• We do not store complete payment method details
• Financial transactions are encrypted and logged
• Regular monitoring for fraudulent activity

4.3 Account Security

We provide tools to help you protect your account:

• Secure password requirements
• Account activity monitoring
• Suspicious activity alerts
• Two-factor authentication options (when available)

4.4 Data Breach Response

In the event of a data security incident:

• Immediate investigation and containment procedures
• Notification to affected users as required by law
• Cooperation with law enforcement when appropriate
• Implementation of additional security measures

5. YOUR PRIVACY RIGHTS

5.1 Access and Correction

You have the right to:

• Access your personal information stored on our Platform
• Correct inaccurate or outdated information relating to your account
• Update your account preferences and settings
• Request information about data processing activities

5.2 Communication Preferences

You can control how we communicate with you:

• Opt out of marketing emails (transactional emails required)
• Disable SMS notifications through profile settings
• Update notification preferences at any time
• Manage communication frequency settings

5.3 Account Management

You have control over your account:

• Deactivate or delete your account
• Export your transaction history
• Modify privacy settings and preferences
• Manage connected payment methods

5.4 Data Portability

Upon request, we can provide:

• Electronic copies of your personal information
• Transaction history in standard formats
• Account data exports (subject to technical limitations)

6. DATA RETENTION

6.1 Account Data

We retain account information as follows:

• Active accounts: Data retained while account is active
• Inactive accounts: Data may be retained for legal compliance
• Deleted accounts: Most data deleted within reasonable timeframe
• Legal hold: Data retained longer when required by law

6.2 Transaction Records

Financial and transaction data retention:

• Transaction records retained for 7 years for tax compliance
• Payment processing records managed by Stripe per their policies
• Dispute records retained for audit and legal purposes
• Aggregated analytics data retained indefinitely (anonymized)

6.3 Communication Records

Communication data retention:

• Support communications retained for customer service purposes
• SMS logs retained for delivery verification and billing
• Email records retained for legal compliance
• Marketing communication records managed per preferences

6.4 Account Deletion

6.4.1 Deletion Process

When you request account deletion:

• Immediate Effects: Account becomes inaccessible and inactive immediately
• User Session: You are immediately signed out and cannot access the Platform
• Profile Visibility: Your profile becomes hidden from other users
• New Activity: You cannot create new orders or transactions

6.4.2 Prerequisites for Deletion

Your account can only be deleted if:

• No active orders (pending, accepted, or in-progress) as buyer or seller
• Zero balance in your seller account (all funds must be withdrawn)
• No unresolved disputes or outstanding issues
• All payment methods will be automatically removed

6.4.3 Data Handling During Deletion

Immediately Anonymized or Removed:

• Profile information (name, email anonymized to deleted_user_[ID]@deleted.local)
• Phone number and personal contact information
• Payment method details (Venmo, bank account information)
• Personal notifications and preferences
• Direct communication history

Retained for Compliance (30-Day Recovery Period):

• Anonymized transaction records for financial audit compliance
• Order history with customer information anonymized
• User reputation and dispute records for platform integrity
• SMS communication logs with phone numbers anonymized

Permanently Retained (Legal/Regulatory Requirements):

• Transaction records for 7 years (federal financial regulations)
• Tax-related information as required by IRS regulations
• Dispute resolution records for legal compliance
• Anti-money laundering (AML) compliance data

6.4.4 30-Day Recovery Period

• Recovery Option: You can recover your account within 30 days of deletion
• Recovery Process: Contact support with your original email address
• Identity Verification: Verification process required for account recovery
• Data Restoration: Basic profile information restored, payment methods must be re-added
• Limitations: Some data may not be recoverable after anonymization

6.4.5 Permanent Deletion (After 30 Days)

After 30 days, permanent deletion occurs automatically:

• Complete Removal: All recoverable personal information is permanently deleted
• Irreversible: Account cannot be recovered after permanent deletion
• Audit Compliance: Only anonymized financial records retained for regulatory compliance
• Platform Integrity: Dispute and reputation data may remain anonymized for platform safety

6.4.6 Financial Compliance Requirements

Some data must be retained longer for legal compliance:

• Financial Records: 7 years for tax and audit purposes
• AML Compliance: Transaction patterns for anti-money laundering compliance
• Dispute Records: Legal requirements for dispute resolution history
• Regulatory Reporting: Data needed for university partnership compliance

6.4.7 Data Subject Rights During Deletion

During the deletion process, you retain rights to:

• Request confirmation of deletion status
• Request information about what data is retained and why
• Contact support for deletion-related questions
• Request account recovery within 30-day window

7. THIRD-PARTY SERVICES

7.1 Payment Processing

Stripe processes all payment transactions:

• Stripe Privacy Policy governs payment data handling
• Stripe maintains PCI DSS compliance standards
• Payment method details are stored securely by Stripe
• We receive limited transaction information from Stripe

7.2 SMS Services

Twilio provides SMS notification services:

• Phone numbers and message content are processed by Twilio
• Twilio Privacy Policy governs SMS data handling
• SMS logs are maintained for delivery verification
• Users can opt out of SMS services at any time

7.3 Infrastructure Services

Supabase provides database and authentication services:

• User account data is stored securely through Supabase
• Supabase maintains security and privacy compliance
• Data processing agreements are in place with all providers
• Regular security reviews are conducted

8. COOKIES AND TRACKING

8.1 Essential Cookies

We use necessary cookies for Platform functionality:

• Authentication and session management
• Shopping cart and order processing
• Security and fraud prevention
• Platform preference storage

8.2 Analytics

IMPORTANT: We do not use third-party analytics services:

• No Google Analytics or similar tracking
• No cross-site tracking or advertising cookies
• No behavioral tracking for marketing purposes
• Internal usage analytics only for Platform improvement

8.3 Cookie Management

You can manage cookies through your browser:

• Browser settings allow cookie blocking or deletion
• Essential cookies are required for Platform functionality
• Cookie preferences can be updated at any time

9. CHILDREN'S PRIVACY

9.1 Age Requirements

Our Platform is designed for users 18 years and older:

• Age verification through university email addresses
• Parental consent may be required for certain features
• Special privacy protections for minor users

10. CALIFORNIA PRIVACY RIGHTS

10.1 CCPA Rights

California residents have additional rights under the California Consumer Privacy Act:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of personal information sales (we do not sell data)
• Right to non-discrimination for exercising privacy rights

10.2 CCPA Disclosures

Categories of personal information we collect:

• Identifiers: Name, email, phone number
• Commercial information: Transaction history, preferences
• Internet activity: Platform usage, log data
• Financial information: Payment methods, account balances

10.3 Data Sales

We do not sell personal information to third parties and have not sold personal information in the preceding 12 months.

11. INTERNATIONAL USERS

11.1 Data Transfers

For users outside the United States:

• Data may be transferred to and processed in the United States
• Appropriate safeguards are implemented for international transfers
• Data processing agreements comply with applicable privacy laws

11.2 European Users

Additional protections for users in the European Union:

• GDPR compliance for data processing activities
• Legal basis for data processing clearly established
• Data protection rights as required by European law
• Data Protection Officer contact available upon request

12. CHANGES TO THIS PRIVACY POLICY

12.1 Policy Updates

We may update this Privacy Policy periodically:

• Material changes will be prominently communicated
• Email notification for significant privacy changes
• Effective date will be updated with each revision
• Continued Platform use constitutes acceptance of updates

12.2 Review Recommendations

We recommend regularly reviewing this Privacy Policy:

• Check for updates during Platform use
• Review privacy settings periodically
• Stay informed about your privacy rights
• Contact us with any privacy questions or concerns

13. CONTACT INFORMATION

13.1 Privacy Questions

For questions about this Privacy Policy or our privacy practices:

• Email: [email protected]
• Subject Line: Privacy Policy Inquiry
• Response time: Within 5 business days for most inquiries

13.2 Data Rights Requests

To exercise your privacy rights:

• Submit requests through Platform settings when available
• Email requests to [email protected] with "Privacy Rights Request" in subject line
• Include verification information to protect account security
• Response time: Within 30 days as required by applicable law

13.3 Privacy Complaints

If you have concerns about our privacy practices:

• Contact us first to resolve issues directly
• File complaints with appropriate regulatory authorities
• Seek legal counsel for privacy-related disputes
• We are committed to addressing all legitimate privacy concerns

14. EFFECTIVE DATE

This Privacy Policy is effective as of the date posted above and will remain in effect until superseded by a new version. Your continued use of the Platform after any changes indicates your acceptance of the updated Privacy Policy.