Privacy Policy

Last updated 10 November 2026

This policy explains what personal information MVCollect ("MV") collects, why, who it's shared with and how long it's kept. MV never sells personal information. MV follows the Australian Privacy Principles, even though, as a small business with turnover under $3 million, it isn't yet required to by the Privacy Act 1988 (Cth).

1. What we collect

• Account information: your display name, email address and password. Passwords are handled by our authentication provider; MV never sees your password in plain text.
• What you post and do on MV: listings, photos and video, bids, offers, orders, messages, ratings, disputes and support requests.
• Seller billing: if you sell, our payment processor (Stripe) stores your card and gives MV a reference to it, plus the card's brand, last 4 digits and expiry so we can show which card is on file. MV never sees or stores your full card number. Paying for an item happens directly between buyer and seller through PayPal and never passes through MV.
• Getting paid and paying: if you sell, the email address of your PayPal account, which we show to the buyer of each of your orders so they can pay you. If you ask a seller for a PayPal invoice, the email you give for it, which we show to that seller on that order.
• Device and fraud-prevention information: our hosting providers log basic technical data such as IP address and browser type to run the site. When you're signed in, MV also stores a random identifier for your browser or app (it isn't linked to anything else on your device) and your IP address, and Stripe gives MV a fingerprint of a seller's card (it identifies the card without revealing its number). We use these only to spot two accounts run by the same person, to protect auctions, rewards and the Market Value guide from fake bidding and fake sales.
• Launch waitlist: if you join the waitlist, your email, first name (optional), whether you want to buy or sell, what you collect, your state, and a scrambled (one-way) form of your IP address to stop mass sign-ups. We use it only to email you about MVCollect's opening and launch offers, and you can unsubscribe from any of those emails.
• Alerts: if you turn on instant alerts, your browser gives MV a delivery address for that device, which we use only to send you MV alerts.

What MV doesn't collect: your date of birth, postal address or phone number. When you buy something, your delivery details reach the seller through PayPal, not through MV.

2. How we use it

To run the marketplace: showing listings, running auctions, working out and billing MV's fees, sending order, account and alert notifications, preventing fraud and abuse, keeping the Market Value guide accurate, and handling support requests and disputes. We don't use your information for advertising and we don't sell it.

3. Who we share it with

MV uses a small number of service providers to run the site, and each one receives only what it needs to do its job:

• Supabase: our database, sign-in and file storage. Your data is stored in Australia (Sydney).
• Vercel: hosts the website and counts page visits for us. Its visit statistics use no cookies and do not identify you.
• Cloudflare: the "verify you are human" check when creating an account.
• Stripe: seller card billing.
• PayPal: when a seller chooses to pay MV's fees by PayPal.
• Resend: sends MV's emails.
• Browser push services (such as Google's and Apple's): deliver instant alerts to devices that have turned them on.
• jsDelivr: delivers some of the code the site runs on (including the sign-in library) and the spelling dictionary used when writing a description. It receives your IP address when the page loads, but nothing you type.
• Google Fonts: delivers the site's fonts. It receives your IP address when the page loads, but nothing you type.

Some of these providers store or process data overseas, including in the United States and Japan (where MV's emails are sent from). MV doesn't pass your personal information to PayPal for item payments: you and the other party deal with PayPal directly. The one thing MV shares between the two people in a sale is the PayPal email needed to pay: the seller's to their buyer, and the buyer's invoice email (if they ask for an invoice) to their seller, each on that order only. MV may also share information with police or other authorities where the law requires or allows it, for example to help an investigation into stolen goods or fraud, or to deal with a serious threat to someone's safety. MV does not sell your personal information to anyone.

4. Cookies and local storage

MV uses your browser's storage to keep you signed in, remember basic preferences (like filters), and hold the random device identifier described above. MV doesn't use advertising or tracking cookies.

5. Emails

Emails about your account, orders, invoices, security, sales and offers are part of using MV. Other emails, such as bidding alerts, saved-search matches and news, are optional: every one includes an unsubscribe link that works without signing in, and you can change your choices in Settings at any time.

6. How long we keep it

We aim to delete messages and listing photos and video around 180 days after a listing closes. For anything that sold, we keep them for at least 240 days after payment, which covers the time in which a PayPal Goods & Services dispute can be opened and escalated. Anything involved in a dispute (on MV, or a PayPal dispute reported to us) is kept until 180 days after the dispute is resolved. Account information is kept while your account is open. Automatic deletion doesn't yet cover every type of data; if you'd like something deleted sooner, contact us and we'll do it by hand.

7. Your choices and rights

You can update your display name, email and password yourself in Account → Settings at any time. To ask for a copy of your data, a correction, or full deletion of your account, email support@mvcollect.com.au. We'll respond within 30 days. Some records may need to be kept longer where the law requires it (for example tax records of fees we've charged).

8. Security

We take the security of your information seriously. Data travels over encrypted connections and is encrypted at rest by our database provider. The database enforces per-member access rules, so an account can only read what it's entitled to. We never store full card numbers (Stripe does). Direct messages are screened for contact and payment details to reduce scams, and you can turn on two-factor sign-in in Settings. No online service can guarantee perfect security, so please use a strong, unique password. MV will never ask for your password or card details by email.

If a data breach is likely to cause you serious harm, we'll tell you as soon as we can, explain what happened and what you can do, and report it to the relevant authorities.

9. Under 18s

MV is not for anyone under 18, and we don't knowingly collect information from them. If you believe someone under 18 has an account, please tell us and we'll close it.

10. International users

MV only accepts sellers based in Australia but welcomes buyers from anywhere. If you're outside Australia, your information is handled as described here: your account and listing data is stored in Australia (Sydney), and the providers listed in section 3 may process some of it overseas.

11. Changes to this policy

We may update this policy from time to time. We'll email you before a significant change, and the "Last updated" date shows the latest version.

12. Questions and complaints

Questions or complaints about privacy can be sent to support@mvcollect.com.au. We'll respond within 30 days. If you're not happy with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).