Privacy Policy
1. What we collect
Information you give us
- Contact details: your email address (used to send one-time sign-in codes and notifications), an optional phone number, your name, and for dealers your business name, locations, phone and website.
- Listing content: boat details, descriptions, prices, hull identification numbers (HINs) and photos you upload.
- Auction activity: bids, maximum bids, watch lists and auction outcomes.
- Messages: inquiries you send to sellers, including your name, email, phone and message text.
- Preferences: notification settings and channel (email or SMS).
Information collected automatically
- Usage data: pages viewed, listings viewed, searches run, and approximate timing. We count listing views in aggregate per day to power seller analytics; we do not build individual browsing profiles.
- Device and connection data: IP address, browser type and user agent, used for security (rate limiting, fraud prevention, abuse detection) and to keep server logs.
- Security logs: sign-in attempts, code requests and administrative actions, kept in an audit log.
We never ask for or store passwords. We do not collect payment card details — Keel & Hull does not process payments between buyers and sellers.
2. How we use it
- To create and secure your account and sign you in with one-time codes.
- To publish your listings and auctions, and to show them to buyers.
- To deliver inquiries from buyers to sellers and auction results to winners and sellers.
- To send service notifications you have enabled: new leads, listing view milestones, bids, outbid alerts, auction endings and account messages. You control these in Settings.
- To provide analytics to sellers about their own listings (aggregate view and lead counts).
- To prevent fraud, spam and abuse, and to comply with legal obligations.
- To improve the service. We may analyse usage in aggregate.
We do not sell personal information and we do not use your data for third-party advertising.
3. When we share it
- Between buyers and sellers. When you send an inquiry, your name, email, phone (if given) and message go to that seller. When you win an auction, your name and contact details are shared with the seller, and the seller's with you, so the sale can be completed. Bid history is shown publicly with bidder names masked (for example "J***S").
- Financing requests. If you ask a dealer about financing, the details you enter (contact information, state and ZIP, intended down payment, preferred term, self-reported credit range, employment type, co-applicant, trade-in and timeframe) go to that dealer only, as entered, with the time you consented. We deliberately do not collect Social Security numbers, dates of birth, income figures or bank details, we run no credit checks, and we are not a lender or broker; any application is made with the dealer or their lender under their own privacy terms.
- Best Offers. When you make an offer, your name and the offer go to the seller; when an offer is accepted, both parties receive each other's name, email and phone to complete the sale.
- AI listing drafts. If a seller uses the AI draft feature, the hull ID number, the facts they entered and reduced copies of their listing photos are sent to OpenAI to generate the text, under OpenAI's API data terms (not used to train their models). Drafts are reviewed by the seller before publishing. No buyer data is ever sent.
- Sign in with Google or Apple. If you use these, we receive your verified email address, a provider ID and (if you share it) your name, and we store the provider ID to recognise you next time. We never see your Google or Apple password.
- Service providers. We use Amazon Web Services (hosting, Amazon S3 for photo storage, Amazon SES for email, Amazon SNS for SMS) in the United States. These providers process data on our behalf under their own security commitments.
- Legal. We may disclose information if required by law, subpoena or to protect the rights, property or safety of Keel & Hull, our users or the public.
- Business transfers. If we are involved in a merger, acquisition or sale of assets, your information may be transferred, subject to this policy.
4. Cookies and sign-in codes
We use a small number of strictly necessary cookies: a session cookie, a "remember me" token so you stay signed in on your device for up to 30 days, a CSRF protection token and, if you switch it on, an accessibility-mode preference. We use Google Analytics 4 to understand how the site is used (pages viewed, searches, listing views, and whether a visit led to an inquiry, offer, bid or listing); IP addresses are not stored by GA4 and we send it no names, emails or phone numbers. You can block it with a browser setting or extension and the site works the same. We do not use advertising cookies. Sign-in codes are six digits, expire within 10 minutes, are stored only as hashes and are limited to a small number of attempts.
5. Where data is stored and how it is protected
Our servers and storage are located in the United States (AWS us-east-1). All traffic is encrypted with HTTPS. Photos are stored on Amazon S3. We apply access controls, firewalls, rate limiting, automatic security updates and daily backups. No method of transmission or storage is 100% secure, but we work to protect your information appropriately.
6. Retention
- Account and listing data: for as long as your account is active, and up to 24 months after closure for dispute resolution and legal compliance, unless you ask us to delete it sooner.
- Auction and bid records: retained for 7 years because they document a commitment between buyer and seller.
- Sign-in codes: deleted within 48 hours. Security logs: up to 12 months.
- Daily view counts are aggregate and are not tied to individuals.
7. Your choices and rights
- Notifications: turn email or SMS notifications on or off in Settings. Reply STOP to any SMS to opt out of texts.
- Access, correction, deletion: you can edit most information in your dashboard. To request a copy of your data or deletion of your account, email us. We respond within 30 days.
- California residents have rights under the CCPA/CPRA to know, delete and correct personal information and to opt out of sale or sharing — we do not sell or share personal information for cross-context advertising. We will not discriminate against you for exercising these rights.
- Other US states and regions may provide similar rights; contact us and we will honour applicable requests.
8. Children
Keel & Hull is for adults. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.
9. Changes to this policy
We'll post changes here and update the effective date. For material changes we will notify account holders by email or SMS. Continued use after changes means you accept the updated policy.