Privacy Policy

The short version: we collect what we need to run an auction marketplace, no more. We don't sell your information. We share it only with the service providers who actually do the work — Stripe and PayPal for payments, Cloudflare for site delivery and image storage, netcup for hosting, ZeptoMail for emails — plus law enforcement if legally required. The longer version is below.

1. Who this applies to

This Privacy Policy describes how Trevul LLC ("Rumblebid", "we", "us") collects, uses, and shares information about you when you use the Rumblebid website at rumblebid.com or interact with us by email or other channels.

2. What we collect

We collect a few categories of information:

Information you give us directly

• Account info: username, email address, display name, password (stored as a hash, never the plaintext).
• Hardiness zone: your USDA zone, used to filter listings to plants that grow in your climate.
• Seller identity and location: if you sell on Rumblebid, your legal name, ship-from street address, city, state, and ZIP code, and (optionally) a phone number — collected before your first listing and re-confirmed periodically. We collect this because federal law (the INFORM Consumers Act, discussed below) requires marketplaces to keep it on file for sellers; your phone number is never shown publicly.
• Delivery details: if you buy on Rumblebid, the recipient's name, shipping address, and (optionally) a phone number for delivery questions — used for shipping labels, invoices, and sales-tax calculation. The phone number is never shown publicly.
• Listing content: photos, descriptions, prices, shipping details, and other information you provide when creating a listing.
• Communications: messages you send to support, dispute submissions, and similar.

Information collected by our payment processors

• Stripe (card method). For sellers: when you set up payouts, Stripe collects your full legal name, date of birth, address, government-issued ID, last 4 digits of SSN (full SSN may be required for verification or 1099-K issuance over IRS thresholds), and US bank account details. Rumblebid does not see, store, or have access to this information. Stripe holds it; we receive only the resulting capability flags ("ready to receive payouts"). For buyers: when you complete a card purchase, your card information is collected and stored by Stripe. We receive a token referencing it for future charges if you opt to save the card, plus the card's brand, last four digits, and expiry date so we can show you which card is on file — never the full card number or security code.
• PayPal (PayPal method). For sellers: when you connect PayPal via Partner Referrals, PayPal collects your PayPal Business account credentials and any KYC information PayPal requires for receiving payments. Rumblebid does not see, store, or have access to your PayPal login or balance. PayPal returns your merchant id and a few capability flags, and we store the email address of your PayPal account so we know where to send your payouts; that's all we keep. For buyers: when you save PayPal for one-click purchases, PayPal collects the consent and stores it as a Vault payment token. We receive a token id we use to capture future Orders.

Information collected automatically

• Technical data: IP address, browser type and version, device characteristics, pages viewed, referrer URL, timestamps.
• Cookies and similar: a session cookie (so you stay logged in), a CSRF token cookie (to prevent forgery attacks), and a signed two-factor cookie (so we don't challenge you for a code on every login from the same device for 24 hours). For anonymous visitors, we may store your selected hardiness zone in a session cookie. We don't use third-party advertising trackers.
• Email engagement (sparingly): ZeptoMail tracks whether transactional emails (verification codes, login codes, password reset links, sale notifications) were delivered. We don't open-track or click-track marketing because we don't currently send marketing.

3. Why we collect it

We use the information we collect to:

• Provide and operate the Service (let you log in, list, bid, buy, get paid),
• Verify your email address and protect against unauthorized account access (two-factor codes),
• Match listings to buyers' hardiness zones,
• Determine a seller's shipping origin for rate quotes, and verify and (where required) disclose seller identity under the INFORM Consumers Act,
• Process payments through Stripe (card method) or PayPal (PayPal method),
• Communicate with you about your account, transactions, support requests, and material changes to these Terms or this Policy,
• Detect, prevent, and respond to fraud, abuse, security incidents, or violations of our Terms,
• Comply with legal obligations (tax reporting, law enforcement requests, marketplace facilitator sales-tax rules).

We do not use your information to build advertising profiles. We don't sell your personal information to anyone.

4. Who we share it with

We share information with a small number of vendors who help us run the Service. Each of them has its own privacy policy and terms; you can read theirs through the linked names below.

Seller information shown to buyers (INFORM Consumers Act)

Federal law (the INFORM Consumers Act, 15 U.S.C. § 45f) requires online marketplaces to disclose certain seller identity information to buyers once a seller's sales cross $20,000 in gross revenue in a trailing 12-month period. Once that threshold is reached, we add a "Seller information" block to that seller's listing pages — visible to every visitor, including those not logged in — showing either:

• the seller's legal name and full ship-from street address, city, state, and ZIP; or
• if the seller has certified that address is residential rather than a place of business, only their legal name, state, and country, plus a notice that no business address is on file and that inquiries can be sent through Rumblebid's on-listing messaging.

The same law requires us to verify the identity of sellers who cross a lower threshold (200 sales and $5,000 in gross revenue in a trailing 12-month period) — we do this through Stripe's identity-verification (KYC) process — and lets us suspend a seller's ability to sell if they don't complete verification, or if a residential certification turns out to be false. Seller-identity information is retained on the same schedule as the rest of your account information — see Section 5, "How long we keep it."

We may also disclose information when we believe in good faith that disclosure is required by law, by court order, or to protect the rights, property, or safety of Rumblebid, our users, or the public — for example, in response to a valid subpoena or to investigate suspected fraud. We'll resist overly broad requests and will notify you when we're able to, unless prohibited by law or the request involves an imminent threat.

If Rumblebid is acquired or merges with another company, your information may transfer as part of that transaction. We'll let you know before that happens, and the acquirer will be bound by this Policy with respect to the information transferred.

5. How long we keep it

We keep account information for as long as your account is active. When you delete your account, we immediately remove your saved payment details and postal address. The rest of your account information is retained for two years after deletion — this lets support restore mistaken deletions and prevents banned users from re-registering — and is then deleted or anonymized, except where we need to keep it to:

• complete pending transactions (payouts, refunds, dispute resolution),
• comply with tax retention requirements (typically 7 years for transaction records),
• preserve evidence in a legal proceeding,
• defend against fraud (suspended accounts may be retained longer to prevent re-registration).
• preserve limited forensic metadata about listing-related communications (such as who contacted whom and when) — not the message content — after account deletion, for fraud prevention and dispute resolution.

6. Your rights

You can review and update most of your account information through your profile page. For everything else, contact privacy@trevul.com and we'll:

• Confirm what personal information we have about you,
• Correct inaccuracies,
• Delete your information, subject to the retention exceptions above,
• Export your information in a machine-readable format.

California, Virginia, Colorado, Connecticut, and Utah residents have specific privacy rights under their state laws (CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA respectively). EU/UK residents have rights under GDPR / UK-GDPR. We respond to verifiable requests under any of these regimes. We don't currently offer cross-border data transfer mechanisms, so practically, EU/UK residents using a US marketplace are an edge case for now — contact us if you have one.

7. Cookies in detail

We use cookies sparingly, all first-party, all functional or security-related:

• sessionid — keeps you logged in across page loads. HttpOnly, Secure, expires when the browser session ends or after 14 days of inactivity, whichever comes first.
• csrftoken — prevents cross-site request forgery on form submissions.
• trevul_2fa — confirms your device passed two-factor verification recently. Signed (HMAC), HttpOnly, Secure, 24-hour TTL.
• hardiness_zone (anonymous visitors only) — remembers your selected USDA zone so listings filter correctly across page loads. Cleared when the session ends.

We don't use analytics cookies, advertising cookies, or third-party trackers. If we ever add analytics, we'll update this policy and add a cookie banner.

8. Children's privacy

Rumblebid is not directed to children under 13, and we don't knowingly collect personal information from anyone under 13. If we learn we've collected information from a child under 13, we'll delete it. Users between 13 and 18 should not use Rumblebid without parental consent; our Terms require users to be 18 or older.

9. Security

We take reasonable steps to protect your information, including encryption in transit (TLS), encryption at rest for backups, hashed passwords (PBKDF2), hashed two-factor codes, and access controls on our infrastructure. No system is 100% secure; if you suspect your account has been compromised, contact us immediately.

10. International users

Rumblebid is operated from the United States and is currently available only to users physically located in the continental United States. Our servers and most of our vendors are also US-based. If you access Rumblebid from outside the US, you're transferring your information to a country whose data-protection laws may differ from your own.

11. Changes to this Policy

We may update this Privacy Policy from time to time. For material changes, we'll notify you by email at least 30 days before the change takes effect. Non-material updates take effect immediately, and the current version is always at rumblebid.com/privacy.

12. Contact

Trevul LLC
8 The Green, STE B
Dover, DE 19901
United States
Privacy: privacy@trevul.com
General support: support@trevul.com

Version 1.8-2026-08-11 — effective August 11, 2026.