Privacy Policy | B&B Discs

1. Information We Collect

We collect information you provide directly to us when you create an account, list a disc, or make a purchase. This includes:

Account Information: Name, email address, username, and profile picture.
Transaction Data: For marketplace sales, we collect shipping addresses and transaction history.
Payment Info: We use Stripe for payment processing. We do not store your credit card details on our servers.
ZIP Code (optional): You may provide your ZIP code so we can show whether local pickup is possible for listings near you. We store only the ZIP code — never precise coordinates — and match it against a public U.S. Census dataset on our own servers; it is not sent to any third-party geocoding service. Other users only ever see a coarse distance range (for example, “within ~10 miles”), never your ZIP code or location. Your ZIP code is deleted along with your account.
Marketing Communications Preference (optional): At registration or in your account settings, you may opt in to receive occasional marketing emails about new listings, features, and promotions. We store this preference and the date you gave it. This is separate from transactional emails about your own orders, offers, and messages, which are not optional and are not governed by this preference.
Watchlist Criteria: If you save a disc mold (and optionally a plastic type, minimum condition, or maximum price) to your watchlist, we store those criteria so we can notify you by email and in-app when a matching listing is created. Removing a watchlist entry deletes those criteria.

2. How We Use Your Data

We use your data to facilitate transactions, improve our disc catalog, and personalize your experience. We do not sell or share your personal information with third parties for their own marketing purposes. We rely on the following legal bases for processing:

Performance of a Contract: Processing your name, email, shipping address, and transaction history is necessary to fulfill orders, process returns, and operate the marketplace on your behalf.
Legitimate Interests: We use anonymized usage data and analytics to detect fraud, prevent abuse, and improve the Platform, including first-party, cookieless page-view analytics to measure site traffic for internal reporting (described below).
Consent: We place optional analytics cookies only after you affirmatively accept via our Cookie Consent banner.

First-Party Analytics

We operate our own privacy-preserving traffic measurement, separate from Google Analytics. It uses no cookies and no client-side storage. For each page view we record: the page path (with any query parameters removed), the referring site’s address (with any query parameters removed), your browser and operating system family (for example “Chrome / Windows”), a timestamp, and a one-way hashed visitor identifier that rotates every 24 hours. Your raw IP address is never stored, the identifier cannot be used to recognize you across days or across other websites, and visits from B&B Discs personnel are excluded from reporting. This data is retained for 12 months and then deleted, is used solely for internal traffic reporting, and is never sold, shared, or used for advertising. This data is maintained in de-identified form; B&B Discs does not attempt to re-identify individual visitors from it and has implemented technical and administrative safeguards to prevent re-identification.

3. Third-Party Services

We share data with essential third-party service providers:

Stripe: To process payments, issue refunds, and handle seller payouts via Stripe Connect. Stripe receives your payment method details and, for sellers, identity and banking information. See Stripe’s Privacy Policy.
Cloudflare: To host and deliver images via Cloudflare R2 and to protect the Platform from security threats. Cloudflare processes IP addresses and request metadata.
Neon: To host our PostgreSQL database in the United States. Neon processes all structured personal data we store on your behalf.
Google Analytics (GA4): To analyze website traffic, session durations, and user flow metrics. Analytics cookies are only set after you accept via our Cookie Consent banner. See Google’s Privacy Policy.
Google Identity Services: To enable “Sign in with Google” and Google One Tap. When you sign in with Google, we receive your name, email address, and profile picture to create or access your account.
Apple: To enable “Sign in with Apple.” When you sign in with Apple, we receive your name and email address (or Apple’s relay address if you choose to hide your email) to create or access your account. See Apple’s Privacy Policy.
Resend: To send transactional emails (order confirmations, shipping notifications, account alerts). Resend receives your email address and the content of those messages.
Shippo: To generate prepaid shipping labels. Shippo receives the buyer’s and seller’s names and addresses for each marketplace transaction. See Shippo’s Privacy Policy.
Pusher: To power real-time in-app notifications and chat features. Pusher processes session identifiers and message payloads over an encrypted channel.
Anthropic: To power our AI disc identification feature. When you use the disc scanner while creating a listing, the photos you upload are sent to Anthropic (the maker of Claude) to identify the disc mold and manufacturer. We send only the image files — no name, email, or account information accompanies the request. Under Anthropic’s commercial API terms currently in effect, prompts and outputs sent through the API are not used to train Anthropic’s models by default. See Anthropic’s Privacy Policy.

4. Cookies

We use cookies to support platform functionality:

Essential Cookies: Used to maintain login sessions and remember system preferences. These are active by default.
Consent Preference Cookie: A first-party cookie that records your cookie consent choice so you are not shown the banner again on repeat visits. It contains no personal data and is set regardless of your selection. It expires after 12 months, after which we will ask again.
Staff Exclusion Cookie: A first-party cookie set only on devices used by B&B Discs personnel, so internal visits can be excluded from our traffic statistics. It contains a single flag, no personal data, applies only to our own staff, and expires after 12 months (renewed on staff sign-in).
Analytics Cookies: Placed by Google Analytics to help us evaluate site performance. These cookies are only set after you select "Accept All" on our Cookie Consent Banner. You can change your cookie preferences at any time.

5. Your Rights

Depending on where you live, you may have the following rights regarding your personal information. To exercise any of these rights, email us at privacy@bbdiscs.com. We will respond within 45 days (CCPA) or 30 days (GDPR) of a verifiable request.

Right to Know / Access: You may request a copy of the personal information we hold about you and information about how we use and share it.
Right to Correct: You may update inaccurate information directly in your account profile settings, or by contacting us.
Right to Delete / Erasure: You may request deletion of your account and personal information. We anonymize your identifying data (name, email, address, phone, and profile photo) and retain anonymized transaction records as required for tax compliance and dispute resolution. See the “Delete Account” section of your profile settings.
Right to Opt Out of Sale or Sharing: We do not sell your personal information to third parties, and we do not share it for cross-context behavioral advertising. No opt-out action is required.
Right to Limit Use of Sensitive Personal Information: We do not process sensitive personal information beyond what is necessary to provide the service.
Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.
Right to Data Portability (GDPR): You may request your data in a structured, commonly used, machine-readable format.
Right to Object / Restrict Processing (GDPR): You may object to or request restriction of processing based on legitimate interests.

Retention: We retain your personal information for as long as your account is active. After you delete your account, anonymized transaction records are retained for a minimum of seven years to satisfy federal and state tax obligations and for dispute resolution. Anonymized records contain no name, email, address, phone number, or other identifier.

Children’s Privacy: The Platform is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at privacy@bbdiscs.com and we will delete it promptly.

6. Security

We implement industry-standard security measures to protect your data, but no method of transmission over the internet is 100% secure.

7. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes — such as adding a new category of data we collect or a new third-party service provider — we will notify registered users by email and update the “Last Updated” date at the top of this page. Your continued use of the Platform after the effective date of a revised policy constitutes your acceptance of the changes.

8. Contact Us

The Platform is operated by B&B Discs LLC, a Texas limited liability company, which is the controller responsible for your personal information. If you have any questions or concerns about this Privacy Policy or our data practices, please contact our Privacy Team at privacy@bbdiscs.com.