Privacy Policy

1. Who we are

Alchemy Auctions provides the online bidding experience for auctions held at festival events. It is operated by Kevin Rabinowitz, an individual, referred to here as "we", "us", and "Alchemy Auctions".

This policy explains what we hold about you, why, who else sees it, and what you can ask us to do with it. It covers the Alchemy Auctions website and platform. It does not cover the events themselves, which decide their own practices.

2. What we collect

What you give us. Your name, your email address, and a mobile number if you choose to give one. A mobile number is optional.

What you agree to. When you accept our terms we keep the exact words you were shown and the moment you accepted them. We keep those so that if anyone ever asks what you agreed to, the answer is the sentence that was actually on your screen rather than our recollection of it.

What we create. A public bidder handle in the form "Bidder N", which is what other bidders see instead of your name. You get one for each auction you join, so your number can differ between auctions. Your bids. The pieces you follow. Whether you have chosen to hear from us by email or text. And a record of any moderation action on your account, including the reason a member of staff recorded.

Your card. We keep a reference to a card held by our payment processor, never the card number. We check that the card is valid without charging it. Our records include the card's brand, its last four digits, and its expiry.

Messages we have sent you. A record of the emails and texts we sent, when, and what happened to them, including whether they bounced or were marked as spam. We keep it so we can tell whether a notice actually reached you.

How you use the site. Our diagnostic records note which pages were requested and how long they took, linked to your account while you are signed in, so we can find and fix faults. We write them to leave out your email address, your phone number, sign-in codes, and the detail of your bids.

Your IP address. We record the IP address your device is using, alongside the action, when you sign in, when you join an auction, when you add or change a card, and when you change your contact details. We keep it to investigate abuse of those paths.

If you sign in but never finish. Asking for a sign-in code stores your email address and the page you were on, briefly, so the code works and so we can bring you back where you were. Those records clear themselves.

3. What we do not collect

We do not ask for or store your postal address. We do not link social media accounts. We run no advertising service and no analytics service, so there is no tracking cookie anywhere on this site and nothing following you between sites.

We do not track your location. We record the IP address you sign in from, as section 2 explains, but we never turn it into a location or use it to work out where you are.

There is one script on this site that is not ours. On the pages where you enter a card, our payment processor's own code runs so it can take the card safely without us ever seeing the number. That code also checks the device for signs of fraud, which is part of how a card gets accepted. It runs only on those pages.

4. How we use it

To let you sign in, which we do by emailing you a one-time code rather than storing a password. To run the auction: accepting your bids, telling you when you are outbid, and telling you when you win. To reach you about a piece you have won. To keep a record of what you agreed to. To investigate abuse of the platform. To find and fix faults. And to meet legal obligations where we have them.

We do not use what we hold to advertise to you, and we do not build a profile of you.

5. Cookies

Two cookies do the work. One remembers that you are signed in. The other lasts half an hour while you are signing in, and holds the email address you typed and the page you came from, so the code takes you back where you were. If you run an auction on our admin console, a third remembers which auction you were last looking at.

We set no advertising or analytics cookies, because we use no advertising or analytics service. Our payment processor's code sets its own storage on the pages where you enter a card, as section 3 explains.

The site also keeps a few things in your browser's own temporary storage, such as a half-finished form, so a stray tap does not lose your work. That never leaves your device.

6. Who else sees it

Our email provider receives your email address and the content of the messages we send, so it can deliver them, and reports back whether each one arrived.

Our payment processor receives your card details directly, and its code runs on the pages where you enter a card. We never see the number.

Our text-message provider would receive your mobile number and the message, if you have opted in to texts and the event you are bidding in sends them.

Our hosting and diagnostics provider, which is one company, stores our data, runs our software, and receives the technical records described in section 2. As the operator of the infrastructure it holds everything described there.

An event's organizer. Running an auction means using our admin console, and it shows an organizer the name, email address and phone number of people registered on this platform, the card's brand and last four digits, how many bids someone has placed and what they are following, and any moderation action on the account. That is standing access rather than something released when you win. If the same platform hosts more than one event, each organizer with a login sees the same list.

Anyone the law requires. If we are legally compelled, we comply.

We name these by what they do rather than by who they are, so that changing a supplier does not require rewriting this policy. We can tell you which companies they are if you ask.

We do not sell your personal information, and we never have.

7. How long we keep it

We keep your account and its records for as long as the account exists. Sign-in records clear themselves within minutes.

Some records are deliberately permanent, because their purpose is to be reliable later: what you agreed to and when, the bids that decided an auction, and moderation history. Section 8 explains what that means for a deletion request.

8. Your choices, and what you can ask us

Email. Our announcements carry an unsubscribe link, and you can opt out of them at any time. Sign-in codes, and messages about an active bid or an unsettled purchase, have no opt-out, because you need them to use your account and to complete a purchase.

Text messages. Reply STOP to any message to stop them.

Seeing or correcting what we hold. Ask us through our contact page and we will show you or fix it. We will reply within 30 days, and usually much sooner. So we never act on someone else's behalf by mistake, we may ask you to confirm the request from the email address on your account.

Deleting what we hold. Ask us the same way. We will close your account and remove your name, email address, phone number and card reference. We will keep a minimal record of completed auction activity, meaning the bids that decided a sale, what you agreed to, and any moderation action, because other people's purchases and our own obligations depend on them. What we keep is no longer tied to your name or contact details.

Depending on where you live you may have further rights, and we will honor those too.

9. How we protect it

Signing in uses a one-time code sent to your email, so there is no bidder password for us to lose. An organizer signing in to the admin console does have a password, and we store only a scrambled form of it that cannot be read back.

The sign-in cookie is locked to our own site. Your card is held by our payment processor rather than by us. Our diagnostic records are written to exclude emails, phone numbers, sign-in codes and bid details.

No system is perfectly secure.

10. Artists

If your work is in an auction on this platform, we hold your name. It comes from the name typed on the piece's listing, and it appears on that piece's page for anyone to see. We hold nothing else about you.

You can ask us to see, correct or remove it, the same way anyone else can, through our contact page.

11. Children

The Services are for people aged 18 and over. We do not knowingly collect information from anyone younger. If you believe we have, contact us and we will delete it.

12. Changes to this policy

We may update this policy. We will tell you about material changes by email or by a notice on the platform, and the effective date above will change.

13. Contact

Questions about this policy, or a request about your information, can go to the address on our contact page.