Effective Date: July 1, 2026 Last Updated: October 3, 2026 (marketing consent, notifications and account deletion clarified)
This Privacy Policy is issued by OVA Stock LLC, an Ohio limited liability company with its principal place of business at 210 Hayes Dr, Suite C, Brooklyn Heights, Ohio 44131 ("OVA Stock," "we," "us," or "our"), which owns and operates OVA Bids, its own online auction platform, consisting of the OVA Bids website at ovabids.com, the mobile applications for iOS and Android through which OVA Bids is offered (published under the OVA Stock name), and all related services, features, and content (collectively, the "Platform"). This Privacy Policy also applies to Personal Information collected through OVA Stock's corporate website at ovastock.com.
This Privacy Policy describes how we collect, use, disclose, retain, and protect information about you when you access or use the Platform, create an account, participate in auctions, make purchases, communicate with us, or otherwise interact with OVA Stock, and the rights and choices available to you.
By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Platform. This Privacy Policy is incorporated into and forms part of the OVA Bids Terms of Service.
Summary of key practices: We sell our own inventory through online auctions. We collect the information needed to register you, verify your identity, run fair auctions, charge your saved payment method when you win, ship or release your items, and protect the Platform against fraud. We do not sell your personal information, and we do not place third-party advertising pixels or cookies on the Platform. When you reach us from one of our ads on Meta (Facebook or Instagram), we send Meta limited event information so we can measure that advertising (Section 6.2).
1. SCOPE AND DEFINITIONS
1.1 Scope. This Privacy Policy applies to information we collect through the Platform, in email and other electronic communications sent through or in connection with the Platform, and when you interact with our customer support. It does not apply to information collected by third parties through websites, applications, or services that we do not control, even if linked from the Platform.
1.2 "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. Personal Information does not include information that has been de-identified or aggregated such that it can no longer reasonably be linked to you.
1.3 "Bidder Account" means a registered user account on the Platform.
1.4 "Official Support Address" means contact@ovastock.com, OVA Stock's sole official email address for support requests, privacy requests, and customer correspondence, as defined in the Terms of Service.
2. INFORMATION WE COLLECT
We collect information in three ways: (a) information you provide directly; (b) information collected automatically when you use the Platform; and (c) information we receive from third-party sources.
2.1 Information You Provide Directly
(a) Account and Registration Information. When you create a Bidder Account, we collect your name, email address, mobile telephone number, username, password (stored in hashed form), age confirmation, and billing and shipping addresses. We verify your email address and mobile phone number as part of registration. Business accounts additionally provide business name and, where applicable, tax exemption or resale certificate information.
(b) Identity Verification Information. To maintain auction integrity, prevent fraud, and comply with legal obligations, we may request additional verification at any time, which may include a government-issued photo identification, proof of address, or confirmation of payment method ownership. Where verification is performed by a third-party provider, we will identify that provider at the point of collection.
(c) Payment Information. A valid payment method is required before you may bid. Payment card information is collected and processed by our payment processor, Stripe, Inc.; card numbers are transmitted directly to Stripe, and OVA Stock does not store full payment card numbers or card security codes on its own systems. We receive and retain tokenized payment credentials and limited payment information such as card brand, the last four digits, expiration date, billing address, authorization results, and transaction records.
(d) Transaction and Auction Activity. We collect records of your bids (including bid amounts, timestamps, and maximum proxy bid limits), watchlists, auctions won, invoices, purchases, payments, refunds, promotional and store credit balances and usage, pickup and shipping selections, pickup completion records (including confirmation that identification was presented, and the identity of any authorized representative who collects an Item), serial numbers and identifying markings of Items that we record for fraud prevention and claim verification, and misdescription or damage claims (including photographs you submit with a claim).
(e) Communications. We collect the contents of communications you send to us or through the Platform, including customer support inquiries, emails, chat messages, dispute submissions, and survey responses. We do not currently record telephone calls; if we begin doing so, we will provide any legally required notice at the time of the call.
2.2 Information Collected Automatically
When you access the Platform, we and our service providers automatically collect certain information using cookies, software development kits ("SDKs"), log files, and similar technologies:
(a) Device and Technical Information. IP address, browser type and version, operating system, device type and model, screen resolution, language settings, time zone, mobile carrier (for apps), and unique device or installation identifiers, subject to your device-level permissions and choices.
(b) Usage Information. Pages and screens viewed, auctions viewed, search queries, bids placed, clicks, session duration, referring and exit pages, crash logs, diagnostic data, and the dates and times of access.
(c) Approximate Location Information. We derive approximate (city- or region-level) location from your IP address to provide localized content (such as sales tax estimates, pickup availability, and shipping options), to detect fraud, and to enforce our United States-only service area. Our mobile applications will request your permission before collecting precise device location, and precise location is collected only if you grant that permission; you may withdraw it at any time in your device settings.
(d) Cookies and Similar Technologies. See Section 6.
2.3 Information from Third-Party Sources
We may receive information about you from: (a) our payment processor and financial institutions (payment confirmation, fraud and risk signals, dispute and chargeback notices); (b) identity verification and fraud prevention providers, if engaged; (c) shipping carriers (delivery status, address correction data, claims information); (d) analytics providers acting on our behalf; and (e) publicly available sources and government watchlists, including sanctions lists maintained by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"), where screening is required or appropriate.
2.4 Sensitive Information
We do not seek to collect sensitive Personal Information (such as government identifiers or precise geolocation) except as reasonably necessary for identity verification, fraud prevention, security, shipping, or legal compliance, and we do not use or disclose sensitive Personal Information to infer characteristics about you.
3. HOW WE USE INFORMATION
3.1 Providing and Operating the Platform. To create, verify, and maintain your Bidder Account; authenticate logins; display auctions; record and process bids (including proxy bids); determine winning bidders; generate invoices; charge your saved payment method(s) as authorized in Section 7.3 of the Terms of Service; issue, apply, and administer promotional and store credits; arrange shipping and local pickup, including verifying the identity of persons collecting Items; process claims and refunds; and provide customer support.
3.2 Auction Integrity and Fraud Prevention. To verify bidder identities; enforce new-bidder limits and account holds; detect, investigate, and prevent shill bidding, bid manipulation, collusion, use of bots or automated bidding tools, payment fraud, chargeback abuse, claim abuse, account takeover, and other prohibited conduct; maintain audit logs of bidding and account activity; and protect the fairness and integrity of every auction. These activities are essential to operating a fair auction platform and are a core part of the services you request when you register.
3.3 Security. To monitor, detect, and defend against security incidents, malicious activity, unauthorized access, denial-of-service attacks, scraping, and other threats to the Platform, our systems, and our users.
3.4 Communications. To send transactional and relationship communications, including verification codes, bid confirmations, outbid notices, auction-ending alerts, winning-bid notices, invoices and payment-failure notices, pickup deadline notices and reminders (including by push notification, as described in Section 8.3 of the Terms of Service), shipping notifications, claim status updates, account and security alerts, and changes to our terms or policies. You may not opt out of these service communications while you maintain an active Bidder Account, except as required by law.
3.5 Marketing. To send marketing emails and push notifications about upcoming auctions, featured inventory, and promotions, only if you opt in to marketing in your account's notification preferences (or as otherwise permitted by law). Marketing is separate from the transactional and security messages described in Section 9.2, which we send to operate your account whatever your marketing choices. Allowing push notifications on your device does not by itself opt you in to marketing. You do not need to agree to marketing to bid, buy, or use the Platform, and you may withdraw your marketing consent at any time as described in Section 9. We do not currently send marketing text messages; Section 9.3 describes what will apply if we introduce SMS in the future.
3.6 Improvement, Analytics, and Development. To understand how users interact with the Platform; measure performance; diagnose and fix errors; test and develop new features; conduct internal research and analysis; and improve the design, content, inventory selection, and functionality of the Platform. Where feasible, we use de-identified or aggregated data for these purposes.
3.7 Personalization. To remember your preferences and surface relevant auctions and categories within the Platform. Apart from the limited advertising measurement described in Section 6.2, we do not use your information for advertising on third-party services.
3.8 Legal Compliance. To comply with applicable laws, regulations, legal process, and governmental requests; to satisfy tax, accounting, unclaimed-property, record-retention, and reporting obligations; to conduct sanctions screening; to cooperate with law enforcement as described in Section 4.5; and to establish, exercise, or defend legal claims.
3.9 Business Transactions. To evaluate and carry out a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, in which Personal Information may be among the assets reviewed or transferred, subject to appropriate confidentiality protections.
3.10 Legal Bases (Where Applicable). Where a legal basis for processing is required by applicable law, we process Personal Information: (a) to perform our contract with you (Sections 3.1, 3.4); (b) for our legitimate interests, including fraud prevention, security, auction integrity, and Platform improvement (Sections 3.2, 3.3, 3.6, 3.7, 3.9), balanced against your rights and interests; (c) to comply with legal obligations (Section 3.8); and (d) with your consent, where required, which you may withdraw at any time without affecting prior processing.
3.11 Automated Systems and AI. We may use automated systems, including machine-learning and artificial-intelligence tools, to support the purposes above — in particular fraud detection, security monitoring, content and account moderation, identity and payment verification, bidding-pattern analysis, and customer support routing and assistance. Automated and AI-generated outputs may contain errors and are reviewed by personnel where appropriate. Consequential adverse account decisions (such as permanent bans) are subject to human review, and we do not use these tools to make decisions producing legal or similarly significant effects without such review.
3.12 No Sale of Personal Information; Advertising Measurement. We do not sell Personal Information. The only information we provide to an advertising platform is the limited Meta advertising-measurement data described in Section 6.2, which is sent only for visitors who arrive from one of our Meta ads and never includes your name, email address, phone number, postal address, account number, or payment details. We honor the Global Privacy Control signal for that measurement (Section 6.4). If we later adopt advertising or remarketing technologies that involve 'selling' or 'sharing' Personal Information as those terms are defined by applicable state privacy laws, we will first update this Privacy Policy, provide the required notices and opt-out mechanisms (including a 'Do Not Sell or Share My Personal Information' option where required), and honor universal opt-out preference signals where legally mandated.
4. HOW WE DISCLOSE INFORMATION
We disclose Personal Information only as described below. Service providers are permitted to use Personal Information solely to perform services for us and must protect it consistent with this Privacy Policy and applicable law.
4.1 Service Providers. We disclose Personal Information to service providers that perform services on our behalf, limited to the following categories:
(a) payment processors (see Section 5); (b) cloud hosting, database, infrastructure, and content delivery/security providers; (c) email delivery providers; (d) analytics and crash reporting providers, configured for our own first-party analytics only; (e) push notification providers, including the notification services operated by Apple and Google for their respective platforms; (f) mapping and address validation providers; (g) identity verification and fraud prevention providers, if and when engaged; (h) customer support and communications tooling providers; (i) shipping carriers (name, delivery address, phone number, email, and shipment details reasonably necessary to deliver Items and process claims; carriers process delivery data under their own privacy policies); and (j) professional advisors, including attorneys, accountants, auditors, and insurers, where reasonably necessary.
These categories describe the full scope of permitted service-provider disclosures regardless of which specific vendor we engage from time to time. You may request information about our current principal service providers by contacting the Official Support Address.
4.2 Tax Authorities and Compliance Recipients. We disclose transaction information as required to calculate, collect, and remit sales and use taxes (including to the Ohio Department of Taxation and, upon our Florida expansion, the Florida Department of Revenue), to validate resale and exemption certificates, and to comply with reporting and unclaimed-property obligations.
4.3 Corporate Transactions. In connection with a merger, acquisition, financing, reorganization, bankruptcy, receivership, or sale of some or all of our assets, Personal Information may be disclosed to counterparties and their advisors under confidentiality obligations and may be transferred as a business asset. If a transfer results in a material change to this Privacy Policy, we will provide notice as described in Section 13.
4.4 Affiliates. We may share Personal Information among OVA Stock LLC and any current or future parent, subsidiary, or commonly owned entity, for purposes consistent with this Privacy Policy.
4.5 Legal Process, Law Enforcement, and Protection of Rights. We may disclose Personal Information: (a) in response to subpoenas, court orders, warrants, or other legal process; (b) to law enforcement or governmental authorities where we believe in good faith that disclosure is required or permitted by law, including in connection with investigations of fraud, stolen property, or other unlawful activity; (c) to enforce our Terms of Service, including investigating potential violations; (d) to detect, prevent, or address fraud, security, or technical issues; and (e) to protect the rights, property, or safety of OVA Stock, our users, or the public. Where permitted by law and consistent with the request, we may notify you of legal demands for your information.
4.6 With Your Direction or Consent. We may disclose your Personal Information to third parties when you direct us to do so or otherwise provide your consent, and such disclosures are governed by the terms of your direction or consent.
4.7 De-Identified and Aggregated Data. We may use and disclose de-identified or aggregated data (for example, auction performance statistics) for any lawful purpose. We maintain de-identified data in de-identified form and do not attempt to re-identify it, except to test our de-identification processes.
4.8 Other Bidders. Bidding is displayed using anonymized or masked bidder identifiers. We do not display your legal name or contact information to other bidders, except as reasonably necessary to administer a specific auction or resolve a dispute.
5. PAYMENT INFORMATION AND PCI COMPLIANCE
Card transactions are processed by Stripe, which is certified as a PCI DSS Level 1 service provider. Card data you enter is transmitted directly to Stripe using encryption in transit; OVA Stock receives only tokenized payment credentials and limited transaction metadata, and we align our handling of payment-related data with the PCI DSS requirements applicable to merchants using tokenized payment solutions. You are responsible for the accuracy of the payment information you provide and for keeping it current — particularly because your saved payment method is charged automatically when you win an auction, as described in the Terms of Service.
6. COOKIES AND TRACKING TECHNOLOGIES
6.1 Categories. We use: (a) strictly necessary cookies and similar technologies — required for authentication, session management, bid placement, load balancing, and security, including our security provider's bot-mitigation cookies (these cannot be disabled because the Platform cannot function without them); (b) functional cookies — preferences such as saved searches, display settings, and region; and (c) analytics/performance cookies — first-party usage measurement through our analytics providers identified in Section 4.1(d).
6.2 Advertising Measurement; No Advertising Pixels. We do not place third-party advertising cookies, pixels, or tags on the Platform. We advertise on Meta (Facebook and Instagram). When you arrive at our website from one of those ads, our servers send Meta, through its Conversions API, limited information about what happened next so we can measure and improve those ads: the type of event (a page view, a visit to the auction site, account registration, a bid, or a purchase and its amount), when it happened, the page address, the click identifier Meta added to the ad link, a random browser identifier our website sets for visitors arriving from an ad, and your IP address and browser type, which Meta requires to accept an event. We do not send your name, email address, phone number, postal address, account number, or payment details, and we do not send events for visitors who did not arrive from a Meta ad. Meta processes this information under its own terms and privacy policy. Before adopting any further advertising or remarketing tool — for example from Google Ads, TikTok, Microsoft Advertising, or Pinterest — we will: (a) update this Privacy Policy and Section 3.12; (b) provide the notices required by applicable law; (c) provide an opt-out mechanism for targeted advertising and any 'sale' or 'sharing' of Personal Information as defined by applicable state privacy laws; and (d) honor universal opt-out preference signals such as the Global Privacy Control where required.
6.3 Your Controls. You can manage non-essential cookies through our cookie preference tool (where available), your browser settings, and your mobile device settings. Blocking strictly necessary cookies will impair Platform functionality, including your ability to bid.
6.4 Do Not Track and Preference Signals. Because no uniform standard has been adopted, the Platform does not respond to browser "Do Not Track" signals. If your browser sends a Global Privacy Control (GPC) signal, we do not send the advertising-measurement events described in Section 6.2 for that visit or, once your account records the signal, for your account.
7. DATA RETENTION
7.1 General Standard. We retain Personal Information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, unless a longer period is required or permitted by law. Criteria we use include: the duration of your Bidder Account; our need to maintain accurate transaction, tax, and accounting records; statutes of limitations applicable to potential claims; legal and record-keeping obligations; open disputes, chargebacks, or investigations; and fraud prevention and security needs.
7.2 Illustrative Periods. Transaction, invoice, and tax records are generally retained for at least seven (7) years; auction, bid, and transaction audit logs are retained for no less than seven (7) years, and longer where reasonably necessary to demonstrate auction integrity, resolve disputes, or comply with law; and fraud and security investigation records are retained for the duration of the investigation and any resulting enforcement or legal action.
7.3 Inactive Accounts. As described in Section 2.7 of the Terms of Service, accounts with no activity for three (3) years may be closed after reasonable advance notice to your account email. Personal Information associated with a closed inactive account is deleted or de-identified in accordance with Section 7.4.
7.4 Deletion and De-Identification. When retention is no longer necessary, we delete Personal Information or render it de-identified. If you delete your account (see Section 8.2), we will delete or de-identify your Personal Information except where retention is permitted or required by law, including for completing open transactions, security and fraud prevention, legal compliance, dispute resolution, enforcing agreements, and internal uses compatible with the context of collection.
8. YOUR RIGHTS
8.1 Rights We Provide to All Users. Regardless of your state of residence, you may: (a) access and review the Personal Information in your account; (b) correct inaccurate account information; (c) obtain a copy of your account and transaction data; and (d) delete your account. Depending on your state of residence, applicable state privacy laws may grant you additional or overlapping rights, including rights of access, correction, deletion, portability, and appeal; we honor such rights as required by the law that applies to you.
8.2 In-App Account Deletion. You may delete your Bidder Account directly within the mobile app or through your account settings on the web, or by emailing the Official Support Address. We may delay or decline deletion while anything remains to be settled between you and us — for example an unpaid order or payment obligation, goods you have paid for and not yet collected, a refund still being processed or reviewed, a billing discrepancy, a store credit balance, a payment dispute, or another transaction still in progress. The app lists anything outstanding, and we will help you settle it. Once nothing remains outstanding, we delete or de-identify your account information, subject to the retention exceptions in Section 7.4.
8.3 How to Exercise Other Rights; Verification. Submit requests through your account settings or to the Official Support Address. We will verify your request using information associated with your account and may request additional verification for sensitive requests. Where applicable law permits, an authorized agent may submit a request on your behalf with proof of authorization. We will respond within the time required by applicable law and will not discriminate against you for exercising your rights.
8.4 Appeals. If we deny your request, you may appeal by replying to our decision or emailing the Official Support Address with the subject line "Privacy Appeal." If your appeal is denied, you may contact your state Attorney General where applicable law so provides.
9. YOUR CHOICES: MARKETING, PUSH, EMAIL, AND SMS
9.1 Marketing Email. You may opt out of marketing emails via the "unsubscribe" link in any marketing email or your account communication preferences. We process opt-outs within the time required by the CAN-SPAM Act. Opting out of marketing does not stop transactional or account-related emails.
9.2 Push Notifications. You may enable or disable push notifications in your device settings or in-app preferences at any time. Enabling push notifications does not sign you up for marketing: offers and promotions are a separate choice in your in-app preferences, off unless you turn them on, and you can turn them off again at any time. Transactional and security notices — about your account, sign-in, bids, payments, orders, pickups, shipments and refunds — are part of the service and are sent whatever your marketing choices.
9.3 SMS/Text Messages (Not Currently Offered). We do not currently send SMS or text messages other than any phone-verification codes you request. If we introduce SMS programs in the future, marketing texts will be sent only with your prior express written consent as required by the Telephone Consumer Protection Act and applicable state telemarketing laws (including the Florida Telephone Solicitation Act); each program will disclose message frequency and that message and data rates may apply; you will be able to opt out at any time by replying STOP (and obtain help by replying HELP); and consent will not be a condition of purchase.
9.4 Analytics Choices. You may limit analytics collection through our cookie tools and device settings as described in Section 6.
10. CHILDREN'S PRIVACY
The Platform is a commercial auction service intended for adults. You must be at least eighteen (18) years of age (or the age of majority in your state, if higher) to register or bid. We do not knowingly collect Personal Information from children under thirteen (13), and the Platform is not directed to children within the meaning of the Children's Online Privacy Protection Act (COPPA). If we learn that we have collected Personal Information from a child under 13 — or registered an account for any user under 18 — we will delete that information and close the account promptly. If you believe a minor has provided us Personal Information, contact us at the Official Support Address.
11. SECURITY
We maintain administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, use, alteration, and destruction, appropriate to the nature of the information and the risks involved, including encryption of data in transit, hashed credential storage, access controls and least-privilege administration, network and application monitoring (including third-party content delivery and security services), logging and audit trails, vendor security requirements, and personnel practices. We periodically review and update our security safeguards to address evolving threats and changes in technology, law, and our operations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials and for all activity under your account; notify us immediately at the Official Support Address of any suspected unauthorized access. If a breach of security affecting your Personal Information occurs, we will notify you and applicable regulators as required by law, including Ohio Rev. Code § 1349.19 and, where applicable, Fla. Stat. § 501.171.
12. UNITED STATES ONLY; INTERNATIONAL VISITORS
The Platform is operated from Ohio and is offered only to users located in the United States. We do not ship internationally and do not direct the Platform to residents of any other jurisdiction. If you nonetheless access the Platform from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those of your jurisdiction.
13. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date and post the updated policy on the Platform. If we make material changes — including any decision to introduce further advertising technologies, SMS marketing, or new categories of data sharing — we will provide reasonable advance notice by email, in-app notice, or a prominent Platform notice. Your continued use of the Platform after the effective date constitutes acknowledgment of the revised policy. Where required by law, we will obtain your consent to material changes affecting previously collected Personal Information.
14. ACCESSIBILITY
If you need this Privacy Policy in an alternative format due to a disability, contact us using the information below and we will work to accommodate your request.
15. CONTACT US
OVA Stock LLC Attn: Privacy 210 Hayes Dr, Suite C Brooklyn Heights, OH 44131 Email: contact@ovastock.com
Please include "Privacy Request" in the subject line of privacy-related correspondence.