Privacy policy

Version 1 • Last Updated: September 3, 2026 • Effective: September 3, 2026

1. Who This Policy Covers

This Privacy Policy describes how TAA collects, uses, discloses, and protects personal information when you use theauctionapp.com, theauctionapp.net, our mobile applications, our bidder, host, consigner, sponsor, volunteer, and staff consoles, our big-screen displays, and related services (together, the "Platform"). It applies to everyone who uses the Platform: bidders, donors, event attendees, Host Organization staff and volunteers, auctioneers, consigners, sponsors, and website visitors.

This Policy is part of our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms.

1.1. TAA and Host Organizations have different roles

When you register for an Event, both TAA and the Host Organization receive your information. TAA is responsible for the information it collects to operate the Platform and its own business. The Host Organization is responsible for its own use of your information after it receives it, including its marketing, donor records, and tax acknowledgments, under its own privacy notice. Where TAA processes information only on the Host Organization's instructions, TAA acts as the Host Organization's service provider. If you have a question about how a Host Organization uses your information, contact the Host Organization directly.

2. Information We Collect

2.1. Information you give us

• Account and registration: name, email address, mobile number, mailing address, password, paddle number, table or seat assignment, and any profile details you add.
• Payment information: your payment card is collected directly by our payment processor (currently Stripe, Inc.) through a secure form. TAA receives a token, the card brand, the last four digits, and the expiration date, but never the full card number or security code.
• Bidding and transaction information: bids, proxy bid maximums, purchases, donations, pledges, raffle entries, ticket purchases, shipping or pickup choices, and receipts.
• Tax acknowledgment information: the details needed for the Host Organization to issue a charitable contribution acknowledgment, such as the amount you paid and the fair market value of what you received.
• Communications: messages you send to us or to a Host Organization through the Platform, support requests, survey responses, and feedback.
• Consigner, sponsor, and Host Organization business information: business name, tax identification details, bank or payout account information (collected by our payment processor), logos, and contact persons.
• Age and identity verification: date of birth or a government identification check when required for age-restricted Lots such as alcohol, or to verify your identity for fraud prevention.

2.2. Information collected automatically

• Device and usage information: IP address, device type and identifiers, operating system, browser, app version, language, time zone, pages and screens viewed, features used, bid timing, and error logs.
• Cookies and similar technologies: we use strictly necessary cookies to keep you signed in and keep bidding secure, and analytics cookies to understand how the Platform is used. See Section 7.
• Approximate location: derived from your IP address, and from device location only if you turn it on for a feature such as venue check-in or directions.

2.3. Information from other sources

• Host Organizations: guest lists, seating assignments, sponsorship packages, and attendee details they upload to set up an Event.
• Payment processor and fraud-prevention services: payment confirmations, chargeback notices, and risk signals.
• Public and government sources: tax-exempt status and good-standing records used to verify Host Organizations, and sales tax rate data.

2.4. Sensitive personal information

We collect limited sensitive personal information: account log-in credentials, and (through our payment processor) payment card details. We use it only to provide the Platform, process payments, prevent fraud, and meet legal obligations. We do not use sensitive personal information to infer characteristics about you, and we do not collect precise geolocation, government ID numbers, racial or ethnic origin, religious beliefs, health, or biometric information except where you choose to provide it or the law requires an identity check for a specific Lot.

3. How We Use Information

We use personal information to:

• create and manage your account and verify your identity;
• run Events: register you, assign paddle numbers, display bids, execute proxy bids, close Lots, and record results;
• process bids, purchases, donations, and payouts, and issue receipts;
• send transactional notices you request, such as outbid alerts, closing reminders, receipts, pickup instructions, and tax acknowledgments on behalf of Host Organizations;
• calculate, collect, and remit sales tax where required;
• provide customer support to you and to Host Organizations;
• detect and prevent fraud, shill bidding, collusion, chargeback abuse, and security incidents;
• analyze how the Platform is used so we can improve it, including through our proprietary bidding analytics, which use aggregated or de-identified data wherever possible;
• comply with legal obligations, including charitable fundraising platform laws, tax laws, and lawful requests from authorities; and
• send you marketing about TAA only with your consent or as otherwise permitted by law, with an easy way to opt out.

We do not use personal information for automated decisions that produce legal or similarly significant effects about you without human involvement.

4. How We Share Information

We share personal information only as described here. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

• Host Organizations. The Host Organization for an Event receives your name, contact details, paddle number, bids, purchases, donations, and fulfillment choices so it can run the Event, deliver Lots, issue tax acknowledgments, and keep its donor records. Host Organizations must use this information lawfully and may not sell it.
• Sponsors. Only if you affirmatively opt in at an Event, your contact information is shared with the Sponsor you choose. You can withdraw that consent by contacting the Sponsor or TAA.
• Consigners. A Consigner may receive the winning bidder's name and contact details when needed to deliver a consigned Lot.
• Service providers. Companies that work for us under contract and may use your information only to provide services to us: payment processing (Stripe), cloud hosting, email and SMS delivery, analytics, customer support tools, sales tax calculation, shipping, identity and fraud-prevention services, and professional advisors.
• Legal and safety. Courts, regulators, law enforcement, and others when required by law, to enforce our Terms, to protect the rights, property, or safety of TAA, Host Organizations, users, or the public, or to investigate fraud or security issues.
• Business transfers. A successor in a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction. Anyone else you ask us to share with.
• Aggregated or de-identified data. Statistics that do not identify you, such as average bid increases by Lot category. We commit to keep de-identified data de-identified and not to try to re-identify it.

5. Text Messages and Mobile Numbers

If you opt in to text messages, we use your mobile number to send transactional messages about the Events you have registered for, and we share it only with the SMS delivery providers that send those messages on our behalf. Mobile opt-in data and consent are not shared with any third party for marketing purposes. Reply STOP to any message to opt out and HELP for help. Message and data rates may apply. See the SMS Messaging Terms in our Terms of Service.

6. How Long We Keep Information

We keep personal information for as long as needed for the purposes described above. Typical retention periods are:

• Account information: while your account is open and for 24 months after it closes, unless a longer period is required below.
• Bidding, purchase, donation, and payout records: seven years after the Event, to meet tax, charitable-solicitation, and accounting requirements and to resolve disputes.
• Payment tokens: until you remove the payment method or your account closes, subject to our processor's rules.
• Support communications: three years.
• Device logs and analytics: 13 months, after which they are deleted or de-identified.
• Consent records for text messages, subscriptions, and privacy requests: five years, or as long as the law requires.

We may keep information longer to comply with a legal obligation, resolve a dispute, or enforce our agreements. When information is no longer needed we delete it or de-identify it.

7. Cookies, Analytics, and Do Not Track Signals

We use strictly necessary cookies (session, security, load balancing), preference cookies (language, notification settings), and analytics cookies that help us understand feature use. We do not use advertising or retargeting cookies. You can control cookies through your browser settings; blocking necessary cookies may prevent you from bidding. Because we do not track you across third-party websites, we do not respond differently to "Do Not Track" browser signals; however, we honor Global Privacy Control signals as a request to opt out of any sale or sharing, which we do not do in any event.

8. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, multi-factor authentication for staff and Host Organization consoles, logging, and vendor security reviews. Payment card data is handled by our PCI DSS–compliant payment processor and is never stored on TAA systems. No method of transmission or storage is completely secure; if we learn of a breach that affects your information we will notify you and the appropriate regulators as required by the laws of your state.

9. Children

The Platform is not directed to children under 18 and we do not knowingly collect personal information from anyone under 18, except limited contact information a Host Organization may record for a minor volunteer under adult supervision. We do not knowingly sell or share the personal information of anyone under 16. If you believe a child has provided information to us, contact privacy@theauctionapp.com and we will delete it.

10. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights. We extend these rights to all users in the United States, whether or not your state's law requires it.

• Know and access. Ask what personal information we have collected about you, the sources, the purposes, and the categories of third parties we have disclosed it to, and receive a copy in a portable format.
• Correct. Ask us to fix inaccurate information. You can update most account information yourself in your account settings.
• Delete. Ask us to delete personal information we collected from you, subject to exceptions (for example, we must keep transaction records for tax and charitable-solicitation compliance, and to complete a purchase you have made).
• Opt out of sale, sharing, and targeted advertising. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. If that ever changes, we will update this Policy and provide an opt-out link before doing so.
• Limit use of sensitive personal information. We use sensitive personal information only for the purposes permitted without an opt-out right, so there is nothing further to limit.
• Opt out of profiling. We do not use profiling to make decisions that produce legal or similarly significant effects.
• Non-discrimination. We will not deny you service, charge you a different price, or provide a different quality of service because you exercised a privacy right.
• Appeal. If we deny your request, you may appeal by replying to our decision. We will respond within 45 days. If we deny your appeal, you may contact your state attorney general.

10.1. How to exercise your rights

Submit a request by emailing privacy@theauctionapp.com, by using the privacy request form in your account settings, or by writing to The Auction App, LLC, Attn: Privacy, 700 North Colorado Boulevard, #249, Denver, Colorado 80206. We will confirm receipt within 10 business days and respond within 45 days, which we may extend once by 45 days if reasonably necessary. We will verify your identity by matching the information you provide with information in our records, and may ask you to confirm the request from the email address on your account. You may use an authorized agent; we will ask for written permission signed by you and may still verify your identity directly. Requests are free unless they are manifestly unfounded or excessive.

10.2. Requests about information held by a Host Organization

For information a Host Organization holds in its own records (its donor database, its mailing list), send your request to the Host Organization. Where TAA processes that information as a service provider, we will pass your request to the Host Organization and assist it in responding.

11. Notice at Collection for California Residents

This Section supplements this Policy for California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). In the past 12 months we have collected the categories of personal information in the table below. We collect them from the sources in Section 2, use them for the purposes in Section 3, and disclose them for business purposes to the categories of recipients in Section 4. We retain each category for the periods in Section 6. We have not sold or shared personal information in the past 12 months and have no actual knowledge that we sell or share the personal information of consumers under 16.

California residents may exercise the rights in Section 10 and may also request, under California's "Shine the Light" law (Civil Code § 1798.83), a list of third parties to whom we disclosed personal information for their own direct marketing; we do not make such disclosures. We do not offer financial incentives in exchange for personal information.

12. Notices for Residents of Other States

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and other states with comprehensive privacy laws have the rights described in Section 10, including the right to appeal, subject to the thresholds and exceptions of each state's law. Colorado residents: TAA is a Colorado company; you may contact the Colorado Attorney General at coag.gov if you have concerns about how we handle your request. Nevada residents: we do not sell covered information as defined by Nevada law. We process personal information in the United States.

13. Host Organizations, Consigners, and Sponsors as Businesses

If you use the Platform on behalf of a Host Organization, Consigner, or Sponsor, this Policy applies to your personal information as an individual user. Your organization's use of attendee data it receives from the Platform is governed by the Host Organization Agreement and by your organization's own privacy notice. TAA acts as a service provider or processor for attendee data it handles on the Host Organization's instructions, and the Host Organization Agreement contains the data processing terms required by state privacy laws.

14. Changes to This Policy

We will update this Policy when our practices change or the law requires. We will post the revised Policy with a new "Last Updated" date, and if the change is material we will notify you by email or in-app notice at least 30 days before it takes effect. If we ever intend to sell or share personal information, we will obtain any consent the law requires before doing so.

15. Contact Us

The Auction App, LLC, Attn: Privacy 700 North Colorado Boulevard, #249 Denver, Colorado 80206

privacy@theauctionapp.com

General support: info@theauctionapp.com