This Privacy Policy explains how PartsMeet ("we," "us," or "our") collects, uses, shares, and protects your personal information when you use our website at partsmeet.com and related services (the "Platform"). PartsMeet is a global peer-to-peer marketplace for car parts, serving JDM, Euro, and USDM enthusiasts worldwide.
We believe in plain language. This policy tells you exactly what data we collect, why we collect it, who we share it with, and what rights you have over it.
When you join our waitlist, we collect:
Waitlist data is collected through Formspree, a third-party form processing service.
When you create an account on the Platform, we collect:
When you buy or sell parts, we collect:
Payment processing is handled entirely by Stripe. We never receive, process, or store your credit card numbers, bank account numbers, or other sensitive financial data. Stripe may collect additional identity verification information (via Stripe Identity) when you register as a seller. See Stripe's Privacy Policy for details.
Listing photos you upload are stored on Cloudflare R2, a cloud object storage service. Images may include metadata (EXIF data) embedded by your camera or phone. We do not actively extract or use EXIF metadata, but it may be stored as part of the image file.
When you visit the Platform, we may automatically collect:
We use your information to:
If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:
| Legal Basis | Processing Activity |
|---|---|
| Contract | Processing necessary to provide the Platform, manage your account, facilitate transactions, escrow, and shipping |
| Consent | Joining the waitlist, submitting survey responses, receiving marketing emails |
| Legitimate interest | Fraud prevention, platform security, analytics to improve the service, enforcing our Terms of Service |
| Legal obligation | Tax reporting, responding to lawful government requests, maintaining transaction records as required by law |
Where we rely on consent, you can withdraw it at any time by contacting us at hello@partsmeet.com. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
We do not sell your personal information. We share data only in these situations:
We use the following third-party services to operate the Platform. Each has its own privacy policy governing how they handle your data:
| Service | Purpose | Data Shared |
|---|---|---|
| Formspree | Waitlist form processing | Email, country, survey responses |
| Stripe Connect | Payment processing, seller verification (Stripe Identity), escrow, payouts | Name, email, payment details, identity documents (for sellers) |
| EasyPost | Shipping label generation, rate calculation, package tracking | Shipping addresses, package dimensions, tracking events |
| Cloudflare R2 | Image storage | Listing photos |
| Google OAuth | Account authentication | Name, email, profile picture (only if you choose Google sign-in) |
| Pusher | Real-time messaging | Message content, user identifiers |
| Railway | Application hosting, database hosting | All application data is processed on Railway infrastructure |
PartsMeet is a global marketplace, and your data may be processed and stored in multiple countries:
If you are located in the EEA, UK, or Switzerland, your personal data may be transferred to the United States or other countries that may not provide the same level of data protection as your home country. When we transfer data internationally, we rely on:
We keep your data only as long as necessary for the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| Waitlist data | Until the Platform launches publicly, or until you request deletion |
| Account information | As long as your account is active, plus 30 days after deletion request |
| Listing data | Listings are soft-deleted (hidden but retained) for 90 days after removal, then permanently deleted |
| Transaction records | 7 years after the transaction date (required for tax and legal compliance) |
| Messages | As long as both users' accounts are active; deleted 90 days after both accounts are closed |
| Listing images | Deleted from Cloudflare R2 within 30 days of listing deletion |
| Server logs | 90 days |
When data is no longer needed, we delete or anonymize it. Some data may be retained longer if required by law or to resolve disputes.
We use a minimal number of cookies to operate the Platform:
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| Session cookie | Essential | Keeps you signed in and maintains your session | Until browser is closed or session expires |
| Next.js preview bypass | Essential | Used during development to bypass draft content caching | Session |
| CSRF token | Essential | Prevents cross-site request forgery attacks on forms | Session |
No tracking cookies. We do not currently use any analytics, advertising, or tracking cookies. We do not use Google Analytics, Facebook Pixel, or similar tracking tools. If this changes in the future, we will update this policy and provide you with the ability to opt out.
Third-party services we integrate with (such as Stripe) may set their own cookies when you interact with their features (for example, during checkout). These cookies are governed by those services' own cookie policies.
Regardless of where you live, you can:
To exercise any of these rights, email us at hello@partsmeet.com. We will respond within 30 days.
If you are located in the European Economic Area, United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) provides you with additional rights:
To exercise these rights, contact us at hello@partsmeet.com. We will respond within 30 days. If we need more time (up to 60 additional days for complex requests), we will let you know.
If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.
Data Protection Officer: For GDPR-related inquiries, contact our data protection team at hello@partsmeet.com with the subject line "GDPR Request."
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you specific rights regarding your personal information:
Categories of personal information we collect (as defined by the CCPA):
To make a request, email hello@partsmeet.com with the subject line "CCPA Request." We will verify your identity before processing your request. You may also designate an authorized agent to make a request on your behalf.
We will respond to verifiable consumer requests within 45 days. If we need additional time (up to 45 more days), we will notify you.
We do not sell your personal information. We have not sold personal information in the preceding 12 months, and we have no plans to do so.
We do not share your personal information for cross-context behavioral advertising. We do not use tracking technologies for targeted advertising purposes.
We share data with third-party service providers (listed in Section 5) only as necessary to operate the Platform. These providers act on our behalf and are contractually prohibited from using your data for their own purposes.
If our practices change in the future, we will update this policy and provide a clear "Do Not Sell or Share My Personal Information" opt-out mechanism on our website.
We comply with the CAN-SPAM Act. When we send you emails:
How to unsubscribe:
We will process your opt-out request within 10 business days. Note that even if you opt out of marketing emails, we will still send you transactional emails related to your account and orders (such as order confirmations, shipping updates, and escrow notifications).
PartsMeet is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are under 13, do not use the Platform or provide any information to us.
If we learn that we have collected personal information from a child under 13, we will delete that information as quickly as possible. If you believe a child under 13 has provided us with personal information, please contact us immediately at hello@partsmeet.com.
Users between 13 and 18 may use the Platform only with the involvement and consent of a parent or guardian.
We take reasonable measures to protect your personal information, including:
No method of transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. If we become aware of a data breach that affects your personal information, we will notify you and any applicable regulatory authorities as required by law.
We may update this Privacy Policy from time to time. When we make changes:
We encourage you to review this policy periodically. Your continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.
If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about how we handle your data, contact us:
For GDPR-related requests, use the subject line "GDPR Request." For CCPA-related requests, use the subject line "CCPA Request." We aim to respond to all privacy inquiries within 30 days.