Privacy Policy
1. Who we are
This policy describes how the Madera marketplace handles personal information. The marketplace is operated by Madera, Inc., in Long Beach, California.
Premium boards ship from the seller to the buyer. Artifacts are handled at our warehouse in Long Beach, California, and that is where an Artifact and the shipping address that travels with it are packed. Open boards under $500 are also available to buy.
Privacy requests: support@madera.co. Mailing address: Madera, Inc., Long Beach, California. This policy does not state a street address or a telephone number.
This draft does not state a calendar date.
2. Information we collect
We collect the following, depending on how you use Madera.
Account. Your name, email address, and password, and the addresses you save. Passwords are stored only as a hash we cannot read back.
Profile. A display name, and any optional detail you choose to give, including an age bracket on your profile or a giveaway entry.
Orders, offers, and auctions. The boards you list, buy, offer on, or bid on, the prices, and the shipping address for a purchase.
Payments. Payments are processed by Stripe. We receive whether a payment was paid, failed, or refunded, the reference Stripe assigns, and the card brand and last four digits when Stripe sends them. We do not store your full card number.
Seller payouts. Payouts are sent by ACH through the payout provider. That provider collects identity information and bank details on its hosted pages. Madera does not see those identity documents. We learn whether payouts are enabled for the account.
Shipping. The name and address you give for a purchase, and the tracking information for the shipment. On a Premium sale the seller receives your name and shipping address so they can ship the board. On an Artifact, Madera ships from Long Beach and the seller does not receive your street address.
Forums. The posts, comments, and photos you submit, shown with your display name. Forum posts are visible to other people using the Forums.
Sign-in records. When you sign in, we receive the user agent your browser sends. At the edge of the network, our host also observes the viewer address of the connection, so a sign-in can be recorded against the person who made it rather than against the server that forwarded it. We keep those records for 12 months. Staff who operate the marketplace can read them.
Analytics. We use Google Analytics to understand how the site is used, including pages viewed and commerce events such as viewing a listing and beginning checkout. IP anonymization is on. We do not run a separate advertising property.
Abuse checks. Creating an account, and a sign-in that has failed several times, uses Cloudflare Turnstile. We receive whether the check passed or failed. We do not use it to identify you.
Photos you upload. Listing photos, Forum photos, and an avatar are stored for us by Amazon Web Services. The processors that receive personal information are Stripe, Google Analytics, Cloudflare Turnstile, Amazon Web Services, and the carrier that delivers a board. Transactional email is sent by Madera.
3. How we use it
We use personal information to:
- create and secure your account;
- run a purchase, an offer, or an auction, including taking payment through Stripe and adding sales tax from the shipping address;
- approve a Premium listing from its photos, and check an Artifact in Long Beach before it ships to the buyer;
- pay a seller by ACH once the buyer has the board and the payment clears, and hold a new seller's first few payouts until delivery is confirmed;
- show Forum posts and enforce the Forum rules in the Terms of Service;
- detect fraud, banned accounts, and misuse;
- send transactional messages about your account, an offer, an auction, an order, or a payout;
- understand how the site is used, through Google Analytics.
If you subscribe, we send a newsletter by email: new boards and a Journal story. Opt out from the link in any newsletter or from notification settings. We don't use personal information to advertise, on or off Madera.
6. California privacy rights
This section is for residents of California. It describes rights under the California Consumer Privacy Act, as amended by the CPRA (together, the "CCPA").
Madera honors the rights below whether or not it already meets the CCPA thresholds that define a business.
You may request that we:
- tell you the categories and specific pieces of personal information we collected about you, the categories of sources, the purposes, and the categories of recipients;
- delete personal information, subject to the exceptions the law allows, including records we keep to complete a sale, pay a seller, collect tax, or prevent fraud;
- correct inaccurate personal information;
- opt you out of a sale or sharing of personal information, if we sell or share it (see section 4);
- limit the use of sensitive personal information. We use account and order details only to complete a sale, pay a seller, and keep the marketplace secure. Government identification and bank details for a seller payout are collected by Stripe, not typed into Madera.
We will not deny the marketplace, charge a different price, or provide a different level of service because you exercised a privacy right.
To make a request, write to support@madera.co from the email on the account. For an order, include the order number. An authorized agent may write from that same address with your signed permission. There is no web form. We will respond within the time the CCPA requires, generally 45 days, and we will tell you if we need one extension of up to 45 more days. We do not publish a toll-free number.
In the CCPA's categories, we collect:
- identifiers, such as name, email address, account id, and the viewer address observed at sign-in;
- customer records, such as a shipping address;
- commercial information, such as listings, orders, offers, bids, and payout status;
- internet or network activity, such as pages and commerce events in Google Analytics, and the user agent sent with a sign-in;
- an approximate location inferred from a shipping address you provide or from the viewer address at the edge. We do not derive a finer location than that.
We do not collect government identification ourselves. We do not collect precise geolocation, biometric data, or information about children.
7. Retention and security
We keep personal information for as long as your account is open and for as long as we need it to complete a sale, send a payout, handle Buyer Protection, collect tax, resolve a dispute, or prevent fraud. After you close an account or we grant a deletion request, we delete or de-identify what we can and keep transaction, tax, and fraud records for four years.
We use access controls, we serve the site over HTTPS, and we store passwords only as hashes. No method of storage or transmission is completely secure. We don't claim a security certification.
8. Children
The marketplace is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, write to support@madera.co and we will delete it.
An account requires age 18. Registration is not offered under that age.
9. Changes and contact
We may update this policy by posting the new text on this page. A material change is also sent by email to the address on the account. This draft does not state a last updated date.
Questions and privacy requests: support@madera.co. Mailing address: Madera, Inc., Long Beach, California. The operator is Madera, Inc. The terms that govern the marketplace are the Terms of Service.