Privacy Policy

Section 1Information We Collect

Personal Information You Provide

We collect personal information that you provide directly to us when you register for an account, place bids, make purchases, list consignments, communicate with us, or otherwise interact with the Platform. This includes:

• Contact Information: Name, email address, mailing address, phone number
• Account Information: Username, password, account preferences, account history
• Identity Verification Information: Government-issued identification, date of birth, photographs for identity verification
• Payment-Related Information: Payment instrument identifiers (Zelle, Venmo, Apple Pay handles), payment history, invoice records, and amounts received or paid (Pennyworth does not store full credit card or bank account numbers)
• Tax Information: Tax identification numbers where required for consignor settlement or regulatory compliance
• Transaction Information: Bidding history, purchase history, items viewed, items consigned, settlement records
• Communications: Customer service interactions, emails, text messages, chat logs, voicemails, and call records
• Business Documentation: For business or entity accounts, business registration documents and authorized representative information

Information We Collect Automatically

When you visit or use the Platform, we automatically collect certain information about your device and your interaction with the Platform, including:

• Device and Technical Information: IP address, browser type and version, operating system, device type, unique device identifiers, screen resolution, language preferences
• Log Data: Pages visited, time spent on pages, referring sites, click activity, session timestamps
• Location Data: General location based on IP address, and more precise location when expressly permitted by your device settings
• Behavioral Information: Bidding patterns, login frequency, navigation paths, and other behavioral data used for account security, fraud prevention, and operational analysis
• Cookies and Similar Technologies: Information collected through cookies, web beacons, pixels, local storage, and similar technologies (see Section 6)

Information from Third Parties

We may receive information about you from third parties, including:

• Identity-verification services and fraud-prevention services
• Payment processors and financial institutions
• Service providers and operational partners
• Public records and publicly available information sources
• Other third parties where lawful and consistent with this Policy

Section 2How We Use Your Information

We use your personal information for the following purposes:

• Service Delivery: Process registrations, bids, transactions, settlements, pickups, and account activity
• Account Management: Authenticate users, maintain account records, manage credentials, and administer account standing
• Customer Communication: Respond to inquiries, provide support, send transactional notices, deliver invoices, and manage pickup logistics
• Identity and Age Verification: Verify user identity, confirm age eligibility, prevent fraud, and detect duplicate or circumvention accounts
• Security and Fraud Prevention: Detect and prevent unauthorized access, fraud, abuse, shill bidding, bid manipulation, and other prohibited conduct
• Marketing and Promotions: Send promotional communications, auction announcements, and Pennyworth Plus offers, where consistent with applicable law and your communication preferences
• Legal Compliance and Enforcement: Comply with legal obligations, respond to lawful requests, enforce our agreements, resolve disputes, and protect our legal rights
• Analytics and Improvement: Analyze usage patterns, improve user experience, develop new features, and inform business decisions
• Debt Collection and Account Reinstatement: Pursue outstanding obligations, manage account suspensions, and process reinstatement requests

Section 3Information Sharing and Disclosure

We may share your personal information in the following circumstances:

• Service Providers: With third parties that perform services on our behalf, including payment processors, identity-verification services, email and SMS providers, hosting and IT providers, and operational partners — under contractual obligations of confidentiality and data protection
• Legal Requirements: When required by law, regulation, court order, subpoena, or governmental request, including to comply with sales tax obligations, regulatory inquiries, or law enforcement matters
• Protection of Rights: To protect our rights, property, safety, users, or third parties; to enforce our agreements; or to detect or prevent fraud, security incidents, or other harmful conduct
• Collection Activities: With collection agencies, legal counsel, or arbitration providers in connection with the recovery of outstanding obligations or the resolution of disputes
• Business Transfers: In connection with a merger, acquisition, financing, sale of assets, restructuring, bankruptcy, or other corporate transaction, in which case the recipient will be bound by terms substantially similar to this Policy
• With Your Consent: When you have given consent or directed us to share information

Section 4Data Security

We implement commercially reasonable technical, administrative, and organizational measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Security measures include:

• Encryption of sensitive information in transit and at rest where appropriate
• Secure network infrastructure and access controls
• Authentication requirements for account access
• Internal access restrictions on a need-to-know basis
• Regular security assessments and staff training

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot and do not guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for any consequences of unauthorized use of your account.

Section 5Your Rights and Choices

Depending on your jurisdiction and applicable law, you may have certain rights regarding your personal information. These rights may include:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your personal information in certain circumstances, subject to legal and contractual retention requirements
• Restriction: Request restriction of certain processing of your personal information
• Portability: Request transfer of your personal information to you or a third party in a portable format
• Objection: Object to certain processing of your personal information
• Withdrawal of Consent: Withdraw consent where processing is based on consent

To exercise any of these rights, please contact us using the information in Section 18. We may require verification of your identity before fulfilling certain requests. Some rights are not absolute and may be limited by legal, contractual, or operational requirements, including our obligation to retain records related to outstanding transactions, disputes, regulatory compliance, and the enforcement of our agreements.

Section 6Cookies and Tracking Technologies

We use cookies, web beacons, pixels, local storage, and similar technologies to collect information about your browsing activities, manage your preferences, and improve the Platform.

Types of Cookies We Use

• Essential Cookies: Required for the operation of the Platform (authentication, security, session management)
• Analytical/Performance Cookies: Help us understand how visitors interact with the Platform
• Functionality Cookies: Remember your preferences and personalize your experience
• Targeting Cookies: Used to deliver relevant advertising and measure marketing effectiveness, where applicable

You can manage cookie settings through your browser. Disabling cookies may limit some features and functionality of the Platform, including the ability to remain logged in, place bids, or complete transactions.

Section 7Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Policy, unless a longer retention period is required or permitted by law. Retention periods may vary based on:

• The nature of the information and the purpose of processing
• Legal, regulatory, accounting, and tax requirements
• Pending or anticipated disputes, claims, or arbitration proceedings
• Outstanding contractual obligations
• Fraud prevention and account security needs

When personal information is no longer required, we will securely delete or anonymize it consistent with our retention schedule and applicable law.

Section 8Children's Privacy

The Platform is not directed to children under the age of 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact us using the information in Section 18, and we will take prompt steps to remove that information from our systems and terminate any associated account.

Section 9California Privacy Rights

California residents may have additional rights under the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and other California privacy laws, including:

• The right to know what personal information is collected, used, shared, or sold
• The right to request deletion of personal information
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of personal information
• The right to limit the use of sensitive personal information
• The right to non-discrimination for exercising privacy rights

As stated in Section 3, we do not sell personal information for independent third-party marketing. To exercise your California privacy rights, contact us using the information in Section 18.

Section 10Texas Privacy Rights

Texas residents may have rights under the Texas Data Privacy and Security Act ("TDPSA") and other applicable Texas law, including the rights to access, correct, delete, port, and opt out of certain processing of personal information. Where TDPSA or other applicable law applies to a request, we will respond consistent with the timelines and procedures required by that law. To exercise your Texas privacy rights, contact us using the information in Section 18.

Section 11International Data Transfers

Your information may be transferred to and processed in the United States and other countries where the privacy laws may differ from those in your country of residence. By using the Platform, you consent to the transfer of your information to countries outside your country of residence, including the United States. We take commercially reasonable steps to ensure that your information receives an adequate level of protection wherever it is processed.

Section 12Third-Party Links and Services

The Platform may contain links to third-party websites, services, or platforms (including but not limited to payment platforms such as Zelle, Venmo, and Apple Pay; identity-verification providers; and shipping or logistics partners). This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third party before providing personal information.

Section 13Communications and Marketing

By creating an account, you consent to receive electronic communications from Pennyworth, including emails, text messages, SMS, push notifications, voicemails, telephone calls, and in-platform messages. These communications may relate to your account, bids, invoices, pickups, payments, suspensions, marketing (where permitted), and Platform operations. You consent to be contacted at any contact information you provide, including phone numbers listed on any "Do Not Call" registry. Standard message and data rates may apply.

You may opt out of marketing communications at any time by following the unsubscribe instructions in the relevant communication or by contacting us. You may not opt out of administrative, transactional, account-related, or legal communications while you maintain an active account or have any outstanding obligations.

Section 14Data Breach Notification

In the event of a data security incident affecting your personal information, we will notify you and applicable regulatory authorities consistent with applicable law. Notice will be provided through email, in-platform notice, or other reasonable means. Pennyworth is not liable for delays, failures, or limitations in notification caused by events beyond our reasonable control.

Section 15Changes to This Policy

We may update this Policy from time to time at our sole discretion. The version number and effective date at the top of this Policy will reflect the most recent revision. For material changes, we will provide additional notice through email, in-platform messaging, or by requiring re-acceptance on next login. Continued use of the Platform after the effective date of an updated Policy constitutes acceptance of the revised Policy. We encourage you to review this Policy periodically.

Section 16Governing Law and Disputes

This Policy is governed by the laws of the State of Texas, without regard to conflict-of-law principles. Disputes arising out of or relating to this Policy are subject to the mandatory arbitration, class-action waiver, governing law, and venue provisions set forth in the Pennyworth LLC Platform Sign-Up Terms and Conditions and Auction Terms and Conditions, which require binding arbitration administered by the American Arbitration Association in Hays County, Texas.

Section 17Severability

If any provision of this Policy is found to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this Policy shall otherwise remain in full force and effect and enforceable. The invalidity of any single provision shall not affect the validity of the Policy as a whole.

Section 18Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices — including to exercise any of your privacy rights — please contact us: