Privacy Policy

Effective 18 August 2026 Version 1.0 Kingdom Creatives LLC

This explains what we collect, why, who we share it with, and how to get it deleted. It covers garagesalebiz.com and every operator site hosted on a subdomain of it.

The short version

✗We never sell your personal information. Not to anyone, for any purpose.
✗No advertising trackers, no ad networks, no third-party analytics beyond basic page counts.
✗We do not see or store card details. Stripe handles all of that.
✗No marketing email unless you ask for it. Buying a territory does not put you on a list.
🔒An operator's client list is walled off from our support tools — see section 4 for exactly what that does and does not mean.
✉Email info@kingdom-creatives.com to see, correct, or delete what we hold.

The sections below are the full detail.

1. What we collect

If you just visit the site

Very little. Our host records standard server information — IP address, browser type, the page requested, and a timestamp — as part of delivering the page and protecting against abuse. We do not build a profile from it and we do not use it for advertising.

If you use the availability checker

The city and state you type are sent to our database to check whether that city is taken. We do not store what you searched for.

If you join the waitlist

Your email address, your name if you give it, and the city you asked about. That is all, and it is used only to contact you if that city opens up.

If you buy a territory

Your details: name, email, phone, and business name.
Your territory: the cities you selected.
Your branding: your chosen colour, tagline, preferred web address, and your logo file if you upload one.
Your account credentials: your email and a securely hashed password. We never see your password in readable form.
A record of what you agreed to: the exact wording of the acceptance terms you confirmed, a cryptographic fingerprint of that text, which documents were in force, the time you confirmed it, and your browser's user-agent string. This is kept as evidence of the agreement, and section 9 explains why it outlives your account.
Payment records: the Stripe payment identifier, the amount, the currency, and the email on the payment. Never the card number, expiry, or security code — those go directly to Stripe and never reach us.

If you are an operator using the dashboard

The business data you enter: your sales, item listings and prices, photographs you upload, your client list, and the agreements you generate. This is your data — we hold it so the platform works. Section 4 covers the client list specifically.

2. What we deliberately do not collect

Stating this explicitly because "we don't collect it" is a commitment, and adding any of it later would require updating this page first:

Card numbers, expiry dates, or security codes. Ever. Stripe handles payment entirely.
Your IP address in our own database. Our host sees it in server logs, but we do not record it against your account or your acceptance record. That was a deliberate choice when the acceptance record was designed.
Precise location. We never ask for device location.
Advertising or cross-site tracking identifiers. No pixels, no ad networks, no third-party trackers.
Anything about a shopper browsing an operator's site. No account, no newsletter signup, no tracking.

3. Why we collect it

What	Why
Name, email, phone	To create your account, contact you about your purchase, and provide support
Business name, logo, colour, tagline	To build and brand your public site — this is published by your choice
Cities you selected	To record your territory and stop anyone else buying it
Payment record	To confirm your purchase, prevent one payment being used twice, handle refunds, and keep accounts
Acceptance record	To evidence what you agreed to, if it is ever questioned
Your business data	To run the dashboard and publish what you choose to publish
Server logs	To deliver pages, diagnose faults, and prevent abuse

We do not use your information for automated decision-making or profiling, and we do not use it to train machine-learning models.

4. Operator client lists

An operator's client list is walled off from our support tools.

It holds the names, phone numbers, email addresses, home addresses, and private notes of homeowners who have a relationship with the operator and no relationship with us. They never agreed to anything with GarageSaleBiz, and were never asked to.

Every other table an operator uses grants our support account read access, so we can help diagnose a problem with a sale or a listing. The client list deliberately grants us nothing. Our support account simply has no read permission on it — that is an access rule enforced by the database, not a habit we promise to keep.

To be precise rather than reassuring: we are the operators of the database, so the underlying administrative credentials can technically reach any table in it, exactly as is true of every hosted service you use. What we have removed is the routine path — the one our support tools use and the one someone would reach for out of convenience. We do not look at client lists, and there is no feature anywhere in our systems that displays one to us.

The operator is the controller of that data and is responsible for handling it lawfully. If you are a homeowner who has dealt with a GarageSaleBiz operator and want your details corrected or removed, contact that operator directly — their details are on their site. If you cannot reach them, tell us and we will pass your request on, but we cannot read or edit those records ourselves.

We hold that data as a processor on the operator's behalf: we store and back it up so their dashboard works, and we do nothing else with it.

5. Content published on operator sites

Operators choose what appears on their public site: sale dates, item listings, photographs, and — where they have the homeowner's agreement — the sale address.

Anything published there is public and may be seen, copied, cached, or indexed by search engines. Removing it later does not remove it from third-party caches.

The dashboard includes a control for withholding a sale's exact street address, and the address is then removed from the published data entirely rather than merely hidden from view. Operators are responsible for having permission to publish a client's address and photographs of their possessions.

If content about you or your property is published without your permission, email us at info@kingdom-creatives.com and we will act promptly.

6. Who we share it with

We never sell personal information, and we do not share it for anyone else's marketing.

We share only with the service providers the platform runs on, and only what each needs:

Who	What they get
Stripe payments	Your name, email, and payment details, which you provide directly to them. We receive back only a payment identifier, an amount, and the email used.
Supabase database, login, files	Everything stored in your account, including uploaded photographs and logos.
Vercel hosting	Standard request data — IP address, browser, page requested — as part of serving pages.
Brevo email	Your email address and the content of transactional emails we send you.
Google Fonts typefaces	Your browser requests font files from Google, which involves your IP address. No account data is sent.

Each is bound by its own agreement and privacy terms. We may also disclose information where we are legally required to, or where necessary to protect someone's safety or our legal rights — and we will tell you if that happens unless we are prohibited from doing so.

If the business is ever sold or merged, your information may transfer as part of it. You would be told, and the acquirer would be bound by this policy or by terms no less protective.

7. Cookies and tracking

No advertising cookies, no cross-site tracking, no ad networks.

What we do use:

A login session token, stored in your browser so you stay signed in to the dashboard. Strictly necessary — the dashboard cannot work without it. Signing out removes it.
Local storage for your course progress, which tick marks you have made. It never leaves your browser and is not sent to us.
Basic page counts from our host, which tell us how many people visited a page. Not tied to your identity and not used for advertising.

Because we do not use tracking or advertising cookies, there is no consent banner to click. That is not an oversight.

8. Email

We send operators transactional email only — the kind you need:

Your welcome email, with your web address and how to sign in.
Password reset emails, when you ask for one.
Notices about your account, a refund, or a material change to our terms.

Buying a territory does not add you to any marketing list. If we ever want to send you something promotional we will ask first, and you can say no without it affecting anything.

If you join the waitlist, we email you about the city you asked about and nothing else. Every such email has an unsubscribe link.

We cannot unsubscribe you from password resets or notices about your own account while you have one — those are how the account works.

9. How long we keep it

While your account is active: as long as you have it.
If you started checkout and never paid: your details are kept for 90 days, then deleted automatically. The logo you uploaded is deleted much sooner — within about two hours of the checkout expiring — because it is the largest and most identifying thing in that record and there is no reason to hold it. Nothing was reserved for you and nothing was charged; the record exists only because you filled in the form, and you can ask us to delete it immediately at any point.
The login itself, if you started checkout and never paid: kept. Creating your account is the first step of checkout, so an abandoned purchase leaves a working login with no territory behind it. We keep it deliberately — if you come back next week you sign straight back in rather than being told your email is already registered — and it holds only your email address and a hashed password. Ask us and we will delete it.
After termination or a refund: 90 days, so your data can be restored if it was a mistake or exported by you, then deleted.
Payment records: as long as tax and accounting rules require, typically seven years. We cannot delete these on request while that obligation runs.
Acceptance records: kept indefinitely, and deliberately not deleted when an account is. This one deserves an explanation rather than a line in a table: it is the record of what you agreed to when you paid, and it is the evidence both of us would rely on if that were ever disputed. A record that disappears when the account does would be worth nothing at precisely the moment it mattered. It contains the agreed wording, its fingerprint, the timestamp, and your user-agent — no card details and no IP address.
Waitlist entries: until the city is allocated, or two years, whichever comes first.
Server logs: retained by our host on their own schedule, typically weeks rather than months.

10. Security

What we actually do:

All traffic is encrypted in transit (HTTPS), and data is encrypted at rest by our database provider.
Passwords are stored only as salted hashes. We cannot read them and neither can an attacker who obtains the database.
Every table enforces row-level access rules in the database itself, so one operator cannot read another's sales, items, photographs, or clients — the isolation does not depend on the application code getting a check right.
Uploaded files are similarly isolated per operator, at the storage layer.
Revenue and payment records are unreachable with the public key that ships in the website.
Acceptance records are append-only: no one — including an operator, and including us through the ordinary application path — can edit or delete one.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal information we will tell you and any required authority promptly, describing what happened, what was affected, and what we are doing about it.

Found a vulnerability? Please tell us at info@kingdom-creatives.com before disclosing it publicly. We will respond, and we will not pursue anyone who reports in good faith and does not access other people's data.

11. Your rights

Wherever you live, you can ask us to:

Tell you what we hold about you, and get a copy of it.
Correct anything inaccurate.
Delete your account and data, subject to the retention rules in section 9.
Export your business data in a portable format.
Stop any non-essential email.

Email info@kingdom-creatives.com from the address on your account and we will respond within 30 days. There is no charge, and asking will never count against you.

If you are in California

You have the rights above, plus the right not to be discriminated against for exercising them. We do not sell or share personal information for cross-context behavioural advertising, and we never have, so there is no "Do Not Sell" mechanism to use — there is nothing to opt out of. We do not knowingly collect sensitive personal information.

If you are outside the United States

Our systems are hosted in the United States, so using the platform involves your information being transferred and processed there. Where local law gives you additional rights, we will honour them; email us and say which jurisdiction you are in.

12. Children

GarageSaleBiz is not intended for anyone under 18 and we do not knowingly collect information from children. Purchasing a territory requires being 18 or over. If you believe a child has given us information, tell us and we will delete it.

13. Changes

We may update this policy. The effective date at the top changes when we do.

If a change is material — particularly if we begin collecting something section 2 currently says we do not — we will email operators at least 30 days beforehand. We will not start collecting a new category of information and disclose it afterwards.

14. Contact

Kingdom Creatives LLC
info@kingdom-creatives.com

This address reaches a person, not a ticket queue, and it is the right place for any privacy question or request.