Privacy Policy

Effective Date: November 10, 2026 (this version updates the Policy of March 13, 2026)

1. Data We Collect

We collect data you actively provide (name, email, listings, messages, payment info) as well as data collected automatically (device identifiers, usage data, session data, IP-based location, cookies). We also receive limited data from third parties like Stripe and analytics providers.

2. Legal Bases for Processing (GDPR)

For EU/UK/EEA users: Performance of contract (account operation), Legitimate interests (fraud prevention, security), Legal obligation (law enforcement, tax reporting), and Consent (analytics cookies, marketing).

3. How We Use Your Data

We use your data to: operate your account and listings, facilitate buyer-seller communication, process transactions, operate your campus selection, detect and prevent fraud, send required notifications, and improve the platform. We do not sell your personal data to advertisers or third parties.

4. Data Sharing

We share data with other users (only what is necessary for the transaction), with service providers bound by Data Processing Agreements (our hosting and infrastructure provider Base44, Stripe for payment processing, Google for analytics and support email, and Notion for internal records), with law enforcement when required by valid legal process, and in the event of a business acquisition.

5. International Data Transfers

CampusMarket is based in the United States. For EU/UK/EEA users, we transfer data under standard contractual clauses (SCCs) approved by the European Commission.

6. Data Retention

Active account data is retained for the life of your account. Listing data for 2 years, messages for 2 years, transaction records for 7 years, IP logs for 12 months. Most deleted account data is removed within 30 days.

7. Your Rights

All users: access, correction, deletion, opt-out of marketing, data portability. California (CCPA/CPRA): right to know, delete, correct, opt-out of sale (we do not sell data), non-discrimination. EU/UK (GDPR): access, rectification, erasure, restriction, portability, objection. Contact support@campusmrkt.com.

8. Cookies

Essential cookies cannot be disabled (required for login/security). Analytics cookies require opt-in for EU/UK/California users. We do not use advertising or retargeting cookies. You can manage preferences by contacting support@campusmrkt.com.

9. Children's Privacy (COPPA)

CampusMarket is not directed at children under 18 and accounts for users under 18 are not permitted. We do not knowingly collect data from children. If we discover that a minor has registered, such accounts are immediately deleted. Contact support@campusmrkt.com if you believe a minor has registered.

10. Data Security

All data in transit is encrypted using TLS 1.2+. Passwords are hashed. Payment data is processed by Stripe under PCI-DSS Level 1. We conduct regular security reviews and vulnerability assessments.

11. Changes to This Policy

We will notify you of material changes via email and Platform notice at least 14 days before they take effect.

12. Contact

Privacy requests / DPO: support@campusmrkt.com | Security: support@campusmrkt.com | Legal: support@campusmrkt.com