Privacy Policy

It matters which one you are in, because it decides who you ask about your data.

If you run a buyback business and have an account with us, BuybackOS decides how your account information is handled. Ask us.

If you sold something to a business that uses BuybackOS, that business decides what happens to your information. We store and process it for them, under contract, and we do not use it for our own purposes. Ask them — and if you can't reach them, tell us and we will pass the request on.

From people selling items: name, email address, phone number, and a mailing or pickup address; what you offered to sell and the photos you uploaded of it; the messages exchanged about the sale; the amount you were paid, the method used, and the confirmation reference for it.

From in-person purchases: the same sale details, plus a record that a rep checked an identity document and what kind it was — a driver's licence, a passport, and so on. The number on the document is deliberately not recorded. There is no column in the database that could hold one.

Voice notes: when a rep records a note at a pickup, the recording is transcribed and both the audio and the text are kept with that purchase. Reps are told to describe the goods, not the person.

From business users: name, work email, the organisation you belong to, your role, and a log of the actions you take in the system. Billing is handled by Stripe; we see the plan and the invoice, not your card.

Automatically: IP address, browser and device type, and pages visited, for security and to work out what to fix next.

A buyback business can connect its own Facebook Pages so that the people messaging those Pages are answered from inside BuybackOS instead of from several separate Facebook inboxes. Connecting is done by a Page administrator signing in to Facebook and choosing which of their Pages to connect, and it can be undone at any time.

While a Page is connected we receive and store, for each conversation on it: the name Facebook shows for the person, the identifier Facebook issues for them on that Page, the text of the messages in both directions, the time of each one, and any photographs they send — those are copied and kept with the conversation, because a seller photographing a box is how the business knows what is being offered. Where the business has been granted it, comments left on the Page's own posts are read the same way, so that a question asked in public reaches somebody.

Replies are written by a member of that business's staff and sent back through Facebook under the Page's name. Nothing is sent automatically unless the business turns that on itself.

This information belongs to the business whose Page it is, not to us. It is used to answer that person, price what they are selling and pay them, and for nothing else. It is never used for advertising, never sold, never shared with another business using BuybackOS, and never used to train anybody's models. It is deleted on the same terms as everything else on this page, and disconnecting a Page stops any further messages being received from it.

No Social Security numbers, no identity-document numbers, no bank account or card numbers, and no medical records. Some of what passes through the system concerns health-related supplies, and a list of what someone sold can imply something about their health. It is treated with that in mind: access is restricted to the business that bought the items, and changes to purchase records are logged and cannot be quietly rewritten.

To complete and pay for a sale; to send you the messages you would expect about it; to spot fraud and duplicate submissions; to meet record-keeping obligations that apply to businesses buying and reselling regulated goods; to keep the service running, secure, and improving.

It is not sold. It is not shared with advertisers, and it is not used to build profiles for anyone outside the business you dealt with.

The service runs on other companies' infrastructure. Each one is bound by contract to use the data only to provide their service:

• Supabase — the database and file storage where records and photos live.
• Vercel — hosting for the application itself.
• Stripe — subscription billing for business accounts. Card details go to Stripe directly and never reach our servers.
• Twilio — text messages about pickups and payments.
• Resend — transactional email.
• OpenAI — reads uploaded photos to identify products, and transcribes rep voice notes. Under OpenAI's API terms this content is not used to train their models.
• PostHog — product analytics on the application, so we can see which screens are slow or confusing.
• Meta — where a business has connected its Facebook Pages, messages and comments are received from and sent back through Facebook. Meta holds that conversation on its own side under its own terms as well.

Beyond those, information is disclosed only where the law requires it, or to protect someone from harm or fraud. If the business is ever sold, data may transfer with it; you would be told before that happened.

Purchase and payment records are kept for as long as the business that made them needs to keep them, which for regulated goods is usually several years, and audit logs are kept for the same period. Marketing contact details are deleted when you unsubscribe. Account records are deleted within 90 days of an account closing, apart from anything we are required to retain.

Some records are deliberately append-only — audit logs, signed agreements, completed purchases. They can be deleted wholesale when the retention period ends, but they cannot be edited after the fact. That is the point of them.

Wherever you live, you can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, and ask us to stop sending you marketing. Depending on where you live you may also have the right to object to certain processing, or to receive your data in a portable form. We do not charge for any of this and we will not treat you differently for asking.

We do not sell personal information or share it for cross-context behavioural advertising, as those terms are defined under California law.

To make a request, use the contact form. If you sold to a business using BuybackOS, we will route it to them and follow up.

Every business's data is separated at the database level: the isolation rules are enforced by the database itself rather than by application code, so a bug in a screen cannot show one business another business's records. Traffic is encrypted in transit, data is encrypted at rest, and access to production is limited to the people who need it.

No system is perfectly secure. If a breach affects your information, you will be told promptly and told what to do about it.

The service is not for anyone under 18, and accounts are not knowingly created for them. If a child's information has ended up here, tell us and it will be removed.

When this policy changes materially, the date at the top changes and account holders are notified before the change takes effect. Continuing to use the service afterwards means the new version applies.

Privacy questions and requests go through the contact form, which reaches a person rather than a queue.