Privacy Policy

Who we are

BoughtForMe helps you buy used vehicles at dealer-only auctions: you bid yourself through our access, or we source and bid for you. This policy explains what information we collect to do that, how we use and protect it, and the choices you have. Questions and requests: privacy@boughtforme.com.

What we collect

Account information: name, email, phone number, and address, provided when you create an account.
Identity verification: before your first funding, a dedicated verification provider checks your identity as the law requires; we store the result and a reference, not your documents.
Financial information: when you connect a bank account we use Plaid. Your bank credentials go to Plaid, never to us; we store only secure tokens and the transaction records of your activity with us (funding, bids, holds, purchases, refunds). Card payments go directly to our payment processor.
Activity and device information: your requests, bids, support messages, app and device data, crash reports, and recordings of some app sessions, used for security and troubleshooting. Each time you open a bidding session from the app, and when you come back from one, we also record the date and time, your IP address, your device model, operating system and app version, and when you last entered an authenticator code. We keep this record so we can tell who opened a bidding session if a bid is ever disputed.

How we use it

To run the service: verifying identity, funding your bid ceiling, placing and settling auction purchases, sourcing vehicles you request, sending transactional notices, and providing support. To meet legal obligations as a licensed dealer and in financial recordkeeping. To keep the platform safe: fraud prevention, security monitoring, and enforcing our terms. We do not sell your personal information.

Who we share it with

Service providers who process data for us: Supabase (database and authentication), Vercel (web hosting), Sentry (crash reports, app logs, and recordings of some app sessions, used to find and fix problems), Plaid (bank connectivity), our payment processor, our identity-verification provider, BidManager (the bidding platform you bid through, which receives your name, your bid limit, and whether your account may bid), and the auctions and transport partners needed to complete your purchase. Each receives only what its role requires. We also disclose information when the law requires it.

By connecting a bank account through Plaid, you also agree to Plaid's End User Privacy Policy.

Consent

You accept our Terms of Service and Buyer Agreement at signup, and acknowledge how the service works before first use. When one of these changes, we ask you in the app to accept the new version. Every acceptance is recorded against the exact document version, with the date and time, and those records are retained.

How we protect it

All connections use TLS 1.2 or better; data is encrypted at rest. Access inside the company is role-based and least privilege, with customer contact details and bidding session records additionally restricted, and every privileged action is logged. Client funds are held in a segregated account, separate from our operating money. Signing in to your account requires your password plus a code from your authenticator app, every time.

How long we keep it, and deletion

We keep personal data only as long as it serves the service or the law requires. You can request deletion in-app or by emailing privacy@boughtforme.com; we complete requests within 30 days. Financial transaction records, identity-verification results, and consent records must be retained for five years after account closure under financial-services recordkeeping rules; they are minimized and not used for anything else. Our record of your bidding sessions is kept for the same period, in case a bid is disputed. Bank credentials are never stored, and bank connections are revoked when your account closes.

Your rights

You can access and correct your information in the app, request a copy of it, request deletion, and opt out of non-essential notifications at any time. We do not discriminate for exercising any of these rights. Depending on your state, you may have additional rights; contact us and we will honor the ones that apply.

Age requirement

BoughtForMe is for adults. You must be 18 or older to create an account, and we do not knowingly collect information from anyone under 18.

Changes

When this policy changes materially we will notify you in the app or by email before the change takes effect, and this page always shows the current effective date.