TaraFindTaraFind

Legal

Privacy Policy

Effective: 22 August 2026

TaraFind ("we", "us") respects your privacy. This notice explains what personal data we collect, why we collect it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

1. Who is the data controller

TaraFind is the controller of the personal data described in this notice. Contact: support@tarafind.com. Sellers are independent merchants and are separate controllers for the data they process to fulfil their own sales.

2. What we collect

  • Account data: email address, password (hashed), display name, and role (buyer or seller).
  • Seller data: business or trading name, legal identity details and company/CRO number used for verification, seller profile, logo and location.
  • Listing data: parts you list, photos, descriptions, shipping bands and your sealed reserve price (never shown publicly).
  • Bidding data: the bids you place, bid attempts used, and reservation status. Bid and final sale values are kept confidential between the parties involved.
  • Order and delivery data: amount, currency, shipping charge, status, delivery address and Stripe checkout/payment identifiers. We never see or store your card number — Stripe handles that directly.
  • Technical data: limited request logs (IP, user-agent, timestamps) used for security and abuse prevention.
  • Cookies & local storage: see our Cookie Policy.

3. Why we use it (legal bases)

  • Contract (Art. 6(1)(b)) — to create your account, run listings and sealed bidding, process payments, and pass delivery details to the seller so your part can be shipped.
  • Legal obligation (Art. 6(1)(c)) — tax, accounting, anti-money-laundering and seller identity checks, and responding to lawful requests.
  • Legitimate interests (Art. 6(1)(f)) — fraud prevention, bid integrity, platform security, and improving the service.
  • Consent (Art. 6(1)(a)) — non-essential cookies and optional marketing; you can withdraw consent at any time.

4. Who we share data with

  • Sellers — when you buy or win a bid, the seller receives your name, delivery address and order details so they can dispatch the part.
  • Lovable Cloud — hosting, database, authentication and storage for the platform.
  • Stripe — payment processing and seller payout onboarding (Stripe Connect). Stripe is a separate controller for the payment and identity data it collects directly; see Stripe's privacy notice.
  • Email delivery — transactional emails such as sign-in, bid and order notifications.
  • We do not sell your personal data.

5. International transfers

Your account, listings, bids, orders and addresses — and their backups — are stored in Dublin, Ireland. Some processors (email delivery, AI photo reading, website edge network) may process data outside the EEA; those transfers are protected by Standard Contractual Clauses or the EU-US Data Privacy Framework.

For a full service-by-service breakdown, see our Data Residency & Processors page.

6. How long we keep it

  • Account, profile and listing data: while your account is active. Deletion requests are honoured after a 30-day grace period during which you can cancel.
  • Transaction and bidding records: kept for the period required by Irish tax and accounting law (currently 6 years) and to resolve disputes.
  • Request logs: a short rolling window for security purposes.

7. Your rights

Under GDPR you have the right to:

  • access the personal data we hold about you;
  • correct inaccurate data;
  • erase your data (subject to legal obligations and open orders);
  • restrict or object to certain processing;
  • data portability;
  • withdraw consent at any time where processing is based on consent.

You can delete your account from your account page, or email support@tarafind.com. You also have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie).

8. Automated decision-making and AI

  • AI listing assistance. If you use SmartList, the photos and text you upload for a listing are sent to an AI model to suggest a title, description and part attributes. Suggestions are only ever drafts — you review and confirm every field before publishing.
  • Automatic bid outcomes. A bid that meets or exceeds the seller's sealed reserve, or a Buy It Now purchase, is accepted automatically by fixed rules you can read in How it works. This is a contractual mechanism you choose to enter, not profiling.
  • Payment risk checks. Stripe applies its own automated fraud and risk screening as a separate controller, and a payment may be declined by those checks.
  • No AI training on your data. We do not sell your personal data and we do not provide it to third parties to train AI models.

9. Children

TaraFind is not for under-18s. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

10. Changes

We may update this notice. Material changes will be highlighted on the site.