Effective date: [EFFECTIVE DATE]

1. Scope and responsibility

This Privacy Policy explains how Tool Trader LLC ("Tool Trader", "we", "us" or "our") handles information when you use the Tool Trader website, progressive web app, mobile app, marketplace and support features. It covers account creation, browsing, listings, rentals, purchases, messages, payments and verification.

Other marketplace users and third-party providers may handle information under their own responsibilities and policies. This policy does not replace notices shown during payment, seller onboarding or identity verification.

2. Account and profile information

When you register or manage an account, we receive information such as your name, email address, password, optional phone number, profile photograph, address, city, state, country and postal code. Seller profiles can include a business name and information about listings.

We keep account identifiers, roles, email and identity verification status, seller onboarding status, account restrictions, onboarding status and records of terms acceptance. Passwords are stored as hashes rather than ordinary readable passwords. Browser sessions and mobile access tokens are used to keep you signed in.

3. Browsing, location and device storage

You can browse public information as a guest. To show tools near a selected area and estimate distances, the marketplace uses the location you choose, including its label, coordinates and whether it came from manual search, your profile or GPS. Device location is requested when you use the current-location feature; you can search manually instead.

The mobile app stores the guest's selected marketplace location and recent selections on the device separately from signed-in account locations. For signed-in users, the selected marketplace location can also be saved to the account. Website and PWA flows use browser storage for location preferences. Profile and listing addresses may have their own coordinates.

Location search and map features may send the text you search, a selected address or coordinates to Google Maps/Places. The mobile current-location flow can send coordinates to OpenStreetMap Nominatim to obtain a location label. These services receive information according to their own policies. Approximate distance calculations do not guarantee an exact journey distance or travel time.

4. Listings, public profiles and reviews

We process listing titles, descriptions, categories, brands, condition, prices, rental periods, security deposits, availability, delivery settings, location and uploaded photographs or videos. We also process public profile details, ratings and reviews.

Public listings and seller profiles are visible to other users and guests. Profile names, photographs, listing media, area information, verification indicators and reviews may be displayed publicly. Exact pickup address access depends on the listing and the viewer's transaction permissions. Information you make public can be copied by others; do not include unnecessary sensitive information in a listing or review.

5. Rentals, purchases and dispute records

We keep transaction information such as the parties and tool involved, selected dates and times, pricing, deposits, fees, taxes, delivery details, booking and order status, payment references, cancellation and refund records, and seller payout records.

Pickup, return and inspection flows may collect confirmations, notes, timestamps and photos or videos. Damage and non-return workflows can include descriptions, estimated costs, supporting evidence, responses, deadlines and administrative decisions. Relevant information may be shown to the other participant and authorised administrators to manage the transaction or resolve a dispute.

6. Messages, attachments and support

In-app chat processes messages, photographs, videos, document attachments, participant and tool identifiers, timestamps, delivery and read status, and inbox information. Chat content is handled through Firebase Realtime Database; chat relationship information and uploaded attachments are also handled by the application backend and storage.

Message recipients can view content you send them and may retain or share it. Reports, blocks and support enquiries may be reviewed by authorised staff, who may need relevant message or transaction evidence to investigate. Uploaded files can be available through file links; do not assume that a file link provides the same protection as account authentication. Do not send unnecessary passwords, payment card details or identity documents in chat.

Contact and support forms collect the information you provide, such as your name, email, subject, message and any attachments. We use it to respond and maintain the related support record.

7. Payment and payout information

Stripe processes supported payments, payment-method setup, authorisation holds, refunds and seller onboarding and payouts. Payment card details entered through Stripe's payment interface are handled by Stripe. Tool Trader stores or receives references and summary information needed for the transaction, which can include Stripe customer and account identifiers, payment-method identifiers, card brand and last digits, payment and refund status, bank-account summaries and payout records.

Seller onboarding can require business, identity and bank information submitted to Stripe. Do not submit full card details in listings, messages or support forms. Stripe's handling of payment information is explained in its Privacy Policy.

8. Identity verification and sensitive information

Didit provides identity verification. Depending on the configured workflow, it may collect an identity document, document images and extracted information, a selfie, facial or liveness information, device signals and verification results. Review the specific notice and consent request in the verification flow before proceeding.

Tool Trader sends account-related information such as your user reference, email and submitted name to help initiate and evaluate verification. We receive and store verification session identifiers, status and decision information. Decision responses and related webhook records may contain sensitive identity information and references to verification evidence; these are used for verification, fraud prevention and authorised administrative review.

A successful verification can be reflected in a badge shown to other users. We do not display your verification document in your public profile. Didit's separate handling of verification and biometric information is explained in its Privacy Policy and the notices in the verification flow.

9. How information is used

• To create, authenticate and manage accounts and record required acceptance and verification.
• To display listings, search and filter tools, calculate nearby results and manage favourites.
• To enable communication, booking requests, handover, return, payments, refunds and payouts.
• To provide notices about messages, transactions, deadlines, account status and support.
• To investigate reports, suspected fraud, damage, non-return, security incidents and payment discrepancies.
• To maintain transaction records, administer the service and comply with applicable legal obligations.

Applicable privacy laws and legal bases: [APPLICABLE PRIVACY LAWS AND LEGAL BASES]

10. Who receives information

Information is shared with other users where needed for public listings, profiles, messages and transactions; with authorised staff for support, administration and dispute review; and with service providers that supply payments, verification, hosting, storage, email, search, maps and messaging infrastructure.

Our service providers include Stripe, Didit, Google/Firebase, Google Maps/Places and OpenStreetMap Nominatim. Additional hosting, storage, email and other providers and their processing regions: [PRODUCTION PROVIDER LIST AND HOSTING REGIONS].

We may disclose information where required by applicable law or valid legal process, or as necessary to address fraud, protect users and enforce lawful agreements. If ownership or operation of the business changes, any transfer of personal information must follow applicable law and relevant notices.

[DATA SALE, TARGETED ADVERTISING AND MARKETING DISCLOSURES AND OPT-OUT OPTIONS]

11. Cookies, notifications and permissions

The website and PWA use cookies and browser storage for sign-in sessions, request security and preferences. Mobile storage includes session information, onboarding state and preferences; authentication credentials are handled through platform secure-storage facilities where implemented. Service-worker caches help the PWA load resources. Browser or device settings can clear stored data, which may sign you out or reset preferences.

Push notifications use Firebase Cloud Messaging and a registered device token for signed-in accounts. Notifications and emails may contain transaction or message summaries that can be visible to someone who sees your device or inbox. Adjust the available in-app notification preferences and device settings to control alerts.

Camera, photo-library, microphone, document-picker and location permissions support features you choose to use, including profile photos, listing media, chat attachments, handover evidence and identity verification. Denying a permission may prevent that feature from working; it does not grant the platform access to unrelated device content.

[ANALYTICS, CRASH-REPORTING AND NON-ESSENTIAL COOKIE TOOLS AND CONSENT OPTIONS]

12. Retention and account deletion

Information is retained according to its purpose, unresolved transactions, disputes, fraud prevention, payment reconciliation and applicable record-keeping obligations. Retention periods for account, transaction, chat, verification, media, security-log and backup records: [RETENTION PERIODS AND DELETION SCHEDULE].

The current account-deletion flow requires ongoing bookings and unsettled payments, payouts and refunds to be resolved. Successful deletion revokes platform account access and hides published listings. It uses a soft-deletion record and preserves historical information; it does not automatically erase all messages, attachments, verification evidence, transaction records or third-party provider records.

To request access, correction, erasure or other privacy action beyond the available account controls, contact [PRIVACY EMAIL]. We may need to verify your request and explain which records must be retained. Provider-held information may require a request to that provider as well. Account closure does not replace any privacy rights that applicable law grants you.

13. Security and international processing

The application uses measures such as password hashing, authenticated access, permission checks and payment-provider interfaces. Access and storage safeguards must also be maintained in the deployed hosting and provider configuration. No online service can guarantee absolute security. Protect your device and credentials, and report suspected misuse to [SECURITY / SUPPORT EMAIL].

Providers may process information in countries other than the one where you live. Processing locations and applicable transfer safeguards: [INTERNATIONAL TRANSFER LOCATIONS AND SAFEGUARDS].

14. Your choices and rights

You can edit supported profile information, choose a marketplace location, manage available notification settings, change device permissions and use account-deletion controls subject to unresolved transactions. Public information and messages already shared with other users may remain in their possession.

Depending on your location and applicable law, you may have rights to access, correct, erase, restrict or object to processing, receive a copy of information, withdraw consent, or complain to a supervisory authority. These rights can have legal exceptions and verification requirements. Send requests to [PRIVACY EMAIL]. [ADD REQUIRED REGIONAL RIGHTS, RESPONSE PERIODS AND REGULATOR CONTACT].

15. Minimum age

Tool Trader is intended for users who meet the minimum age of [MINIMUM USER AGE] and any capacity requirements for transactions. [PROCESS FOR HANDLING INFORMATION SUBMITTED BY USERS BELOW THE MINIMUM AGE] If you believe such information has been collected, contact [PRIVACY EMAIL].

16. Changes to this policy

We may update this policy to reflect changes in features, providers or legal requirements. The effective date appears at the beginning of this policy. We will explain material changes where required. A privacy notice describes processing; it does not replace a separate consent request where consent is required.

17. Contact us

For privacy questions or requests about your personal information, contact us using the details below.

Company: Tool Trader LLC
Business address: 1630 Downtown West Blvd Suite 116, Knoxville, TN, 37919
Privacy email: [PRIVACY EMAIL]
Support email: [SUPPORT EMAIL]