Our position in one sentence: we use personal data to provide and protect CoinDealerPro; we do not sell it or use it for cross-context behavioral advertising.

1. Scope and roles

This policy applies to the public website, account and onboarding flows, hosted service, support communications, and related business operations.

We act as a data controller for account, billing, website, and direct relationship data. When a customer enters information about its contacts, personnel, consignors, customers, vendors, or other people, the customer generally determines why that data is used and we process it on the customer’s behalf.

2. Information we collect

Information you provide

Account and identity: name, email address, authentication information, organization, role, workspace, invitation, and account preferences.
Business records: inventory and certification details, photographs, contacts, addresses, phone numbers, notes, documents, transactions, grading submissions, and financial workflow records entered by authorized users.
Billing: plan, subscription status, billing contact, Stripe customer and subscription identifiers, and limited transaction metadata. Stripe receives payment-card details directly.
Communications: support requests, sales inquiries, private access requests (first name, last name, work email, and optional business name), security reports, provider-review correspondence, and feedback.

Information collected automatically

IP address, device and browser information, timestamps, requested pages, error and diagnostic data, session and security events, and activity necessary to operate and protect the service.
Authentication and preference cookies needed to keep users signed in, remember settings, and prevent abuse. The public marketing site does not currently use advertising cookies.

Information from third parties

Subscription and payment status from Stripe.
Certification, coin, image, population, or reference information returned by approved grading-data providers in response to a user lookup.
Precious-metals reference rates from a market-data provider. These requests are designed not to include customer personal data.

3. How we use information

Provide, personalize, maintain, and support the service.
Authenticate users, apply permissions, isolate organizations and workspaces, and detect misuse.
Process subscriptions and administer customer accounts.
Send requested transactional messages, including confirmations, password resets, invitations, account notices, and user-directed business documents.
Perform user-requested certification and reference-data lookups through authorized provider connections.
Monitor reliability, investigate incidents, preserve audit evidence, and, where deployed controls provide it, back up data and test recovery.
Comply with law, enforce agreements, prevent fraud, and protect rights and safety.
Communicate about the service where permitted. We do not use the application’s customer-contact database for our own marketing.

4. Legal bases

Where law requires a legal basis, we rely on performance of a contract, legitimate interests in operating and securing a business service, compliance with legal obligations, and consent where specifically requested. You may withdraw consent without affecting processing that occurred before withdrawal.

5. How we disclose information

We disclose information only as reasonably necessary:

Within your organization: according to membership, workspace, role, permission, and connected-account settings configured by authorized users.
Service providers: hosting, storage, email delivery, payment, website delivery, security, and provider integrations listed on our Subprocessors page.
At your direction: when users email a document, connect an account, initiate checkout, perform a provider lookup, or export information.
Legal and safety: when required by law or reasonably necessary to protect customers, the service, providers, or others.
Business transfers: in a merger, financing, acquisition, reorganization, or sale, subject to appropriate confidentiality and notice requirements.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We do not knowingly disclose Customer Data to data brokers.

6. Provider integrations

Certification lookups are designed to send only the identifier and parameters needed to fulfill an authorized request. Provider credentials remain server-side. We do not intentionally send customer contact lists, transaction documents, payment details, or private notes to certification or market-data providers.

Returned provider facts may be shown transiently for review; information a user confirms can become part of the customer’s inventory or grading record. Provider terms, entitlements, retention limits, and availability also apply.

7. Retention

We retain information while an account is active and as needed to provide the service, maintain audit and financial evidence, resolve disputes, comply with law and contracts, and protect the service. Retention varies by record type and customer instruction.

After a valid deletion or termination request, information is deleted, de-identified, or isolated unless it must be retained. Where backups are enabled for a deployed service, their schedule, expiration, restoration behavior, and handling of deletion requests are governed by the then-current operating controls and customer terms.

8. Security

Application controls include protected transport configuration, server-side authorization, role-based permissions, tenant boundaries, audit evidence, restricted secret handling, and signed billing webhooks. Production infrastructure, monitoring, backup, and recovery controls are verified separately before launch and are described as current practices only when operating evidence exists. See Security for more.

No system is completely secure. Customers are responsible for user administration, credential protection, secure devices, correct permissions, and lawful handling of exports.

9. International data transfers

CoinDealerPro and its service providers may process information in the United States and other countries. Where required, we use contractual or other recognized safeguards for cross-border transfers.

10. Your privacy rights

Depending on where you live, you may request access, correction, deletion, portability, restriction, or objection; withdraw consent; or appeal a denied request. You may also have the right to lodge a complaint with a privacy regulator. We will not discriminate against you for exercising a privacy right.

If your information was entered by a CoinDealerPro customer, contact that customer first because it controls the record. We will assist our customer as required. We may verify identity and authority before completing a request.

Because we do not sell personal data or use it for cross-context behavioral advertising, we do not offer a sale/share opt-out. If our practices change, we will update this policy and provide required choices.

11. Cookies and browser signals

See our Cookie Policy. Because the public website does not currently engage in sale, sharing, or targeted advertising, it does not respond differently to Global Privacy Control or “Do Not Track” signals. Authenticated-service security and preference cookies remain necessary for requested functionality.

12. Children

The service is for business users 18 and older. We do not knowingly collect personal data from children. Contact us if you believe a child provided data directly to us.

13. Changes and contact

We may update this policy as the service, providers, or law changes. We will post the effective date and provide additional notice when required.

For privacy questions or requests, email sales@coindealerpro.com. Include your relationship to the relevant CoinDealerPro organization and the nature of the request, but do not email passwords, complete payment-card details, government IDs, or other unnecessary sensitive data.