Your data, on the record.

This Privacy Policy (the “Policy”) applies to all products, services, websites, mobile experiences, and live auction marketplaces operated under the Bidorah brand (collectively, the “Service”). It explains how Bidorah collects, uses, stores, shares, and protects personal information from visitors, registered buyers, sellers, wholesale accounts, and admins who interact with Bidorah.

By creating a Bidorah account, applying to sell on Bidorah, or otherwise using the Service, you acknowledge the data practices described here. If you do not agree, do not use Bidorah.

Bidorah collects three categories of information:

2.1 Information you provide directly

• Account details: name, email, password (hashed), account type (retail buyer, retail seller, wholesale buyer, wholesale seller).
• Profile content: display picture, bio, stream titles, stream descriptions, chat messages, tips, and listings posted to Bidorah.
• Government-issued US photo ID (required for Bidorah’s mandatory identity verification).
• For wholesale buyers: Registered Business Entity, Federal/State TIN (EIN), and Reseller’s Permit documentation.
• Payment and payout credentials you provide to Bidorah’s payment processors.

2.2 Information Bidorah collects automatically

• Device and browser data: IP address, user agent, OS, browser type, device identifiers, referrer URLs.
• Usage data: pages visited on Bidorah, features used, listings viewed, bids placed, tips sent, watch-time on live streams.
• Technical logs: timestamps, error traces, performance metrics, and WebRTC/LiveKit signalling metadata for live streaming.

2.3 Information from third parties

• Google OAuth profile when you choose “Sign in with Google” on Bidorah.
• Payment-status webhooks from Stripe and PayPal.
• Compliance data from identity-verification providers when Bidorah reviews government ID.
• Referral metadata when another Bidorah user refers you.

2.4 Mobile app permissions (Android & iOS)

The Bidorah mobile apps ask for the following device permissions only when the matching feature is used. None of these run in the background:

• Camera — when you upload your government photo ID for verification, list an item, or go live as a seller. The camera turns off as soon as you close the screen.
• Microphone — only while you are an active broadcaster or co-host on a live Bidorah stream.
• Photos & media — only when you tap the gallery picker to attach a listing photo or profile picture.
• Notifications — only after you opt in. Used for outbid alerts, auction-ending reminders, stream-starts, and order updates. You can revoke this any time in your device settings.
• Bidorah does not request precise GPS location, contacts, calendar, or SMS access.

Bidorah uses the information it collects strictly to operate, protect, and improve the Service:

• Authenticating your Bidorah account and securing the session.
• Processing your bids, purchases, tips, and payouts.
• Enforcing Bidorah’s retail-vs-wholesale market segregation at every buy/bid/checkout call.
• Running Bidorah’s compliance gate for wholesale buyers and Founder Seller applicants.
• Delivering real-time chat, presence, tips, and live-stream video.
• Fraud detection, abuse prevention, and account security.
• Building aggregate, non-identifying analytics to improve Bidorah’s product.
• Sending transactional emails and notifications you have opted into.

Bidorah does not sell your personal information to data brokers, and Bidorah does not use your information to train third-party advertising profiles.

Wholesale buyers on Bidorah must submit a Reseller’s Permit, Federal/State TIN, and registered business entity before they can bid or purchase in the wholesale marketplace. Bidorah treats this information as “sensitive” data:

• TIN values are stored encrypted at rest; only the last four digits are exposed in any Bidorah admin surface by default.
• Access to the full TIN is restricted to Bidorah’s compliance operators and only for reviewing the original application.
• Uploaded permit documents are scoped to the submitting user’s object-storage path; Bidorah never surfaces them publicly.
• Revocation or denial of wholesale status immediately blocks the buyer’s ability to transact in the wholesale segment.

Bidorah operates public live streams. When you join a stream as a viewer, your public display name, profile picture, and presence (joined / left) are broadcast to other viewers in the room. Bidorah admins are visually flagged on every stream with an “ADMIN” badge.

Chat messages, bids, and tips you send on a Bidorah live stream are public to all other viewers of that stream and are retained in Bidorah’s transcript history for moderation and audit. Tips processed through Stripe include metadata identifying the tipper and recipient seller; Bidorah does not expose tipper payment card details to the seller.

Payments on Bidorah are processed by regulated third-party providers — currently Stripe and PayPal. Bidorah never stores full card numbers or bank routing details on Bidorah’s own servers; only tokenised references, last-four digits, and high-level transaction metadata (amount, currency, order ID, fee split) are retained for accounting, dispute resolution, and payout reconciliation.

Bidorah maintains a platform-revenue ledger that records the fee split for every order, tip, and payout. That ledger is accessible only to Bidorah admins and is never sold or shared externally.

Bidorah uses a minimal set of cookies and browser storage to deliver the Service:

• Strictly-necessary cookies for authentication and session security — these cannot be disabled without breaking Bidorah.
• Functional storage (e.g. selected account type during signup, terms-acceptance flag) to carry context across pages.
• Aggregate analytics: Bidorah tracks usage metrics to improve product quality. These are measured in aggregate and are not combined with third-party ad profiles.

Bidorah does not participate in cross-site behavioural advertising. If you enable “Do Not Track” in your browser, Bidorah treats that as a signal to avoid optional analytics instrumentation.

Bidorah shares personal information only in these narrow cases:

• Service providers acting on Bidorah’s behalf: Stripe, PayPal, LiveKit, object-storage providers, email deliverability vendors — each contractually bound to use the data only to deliver their service to Bidorah.
• Other Bidorah users, limited to the public profile, listings, stream content, and chat you intentionally post.
• Legal and safety disclosures when Bidorah believes in good faith that disclosure is required to comply with law, enforce Bidorah’s Terms, or protect Bidorah, Bidorah users, or the public.
• Business transitions: if Bidorah is involved in a merger, acquisition, or asset sale, user information may transfer as part of that transaction, with notice to affected users.

Bidorah applies industry-standard protections: TLS in transit, encrypted storage at rest for sensitive fields, bcrypt-hashed passwords with per-user salts, strict market segregation middleware on every wholesale endpoint, and continuous monitoring. No system is perfectly secure; Bidorah will notify affected users if a breach materially compromises their personal data, as required by law.

Bidorah retains personal information only as long as needed to deliver the Service, satisfy legal/accounting obligations, or resolve disputes. When you delete your Bidorah account, Bidorah removes or anonymises personal identifiers within 90 days, except where retention is required by law (e.g. tax records, fraud investigations).

Depending on your jurisdiction (including California, the EEA, and the UK), you may have the right to:

• Access the personal information Bidorah holds about you.
• Correct inaccurate or incomplete information.
• Delete your account and associated personal information (subject to legal retention obligations).
• Portability — receive an export of your data in a structured, machine-readable format.
• Object to or restrict specific processing activities.
• Withdraw consent you previously granted, e.g. marketing emails.
• Complain to your local data-protection regulator.

To exercise any of these rights, email privacy@bidorah.com. Bidorah will respond within the timeframes required by applicable law (typically 30 days).

Bidorah is not intended for anyone under 18. Bidorah does not knowingly collect personal information from minors. If Bidorah learns it has inadvertently collected data from a user under 18, Bidorah will promptly delete it. Parents or guardians who believe a minor has registered on Bidorah may contact privacy@bidorah.com.

Bidorah is operated from the United States. If you access Bidorah from outside the US, your information will be transferred to, stored, and processed in the US, which may have data-protection rules different from those in your country. Where required, Bidorah implements contractual safeguards (such as Standard Contractual Clauses) to protect cross-border transfers.

Bidorah may update this Policy as the Service evolves. When Bidorah makes a material change, Bidorah will update the “Last updated” date, post the revised Policy on the Bidorah website, and — for changes that meaningfully affect your rights — notify you by email or in-product banner before the change takes effect.

Questions, requests, or concerns about Bidorah’s privacy practices? Reach the Bidorah privacy team at privacy@bidorah.com. For legal or compliance inquiries, contact legal@bidorah.com.

© 2026 Bidorah. All rights reserved.