Privacy Policy

Effective Date: April 1, 2026

Last Updated: April 1, 2026

1. Introduction

Welcome to Unbuilt. This Privacy Policy explains how Unbuilt, Inc. ("Unbuilt," "we," "us," or "our") collects, uses, shares, and protects your personal information when you use our website at unbuilt.co, our marketplace platform, and any related services (collectively, the "Service").

Unbuilt is a marketplace for surplus construction and building materials. We connect buyers and sellers of new, unused, and surplus building products. This policy applies to all users of our Service, including buyers, sellers, and visitors.

By using our Service, you agree to the collection and use of your information as described in this Privacy Policy. If you do not agree, please do not use our Service.

2. Information We Collect

2a. Information You Provide

We collect information you give us directly when you use our Service:

Account Registration. When you create an account, we collect your name, email address, phone number, and mailing address.

Seller Account Information. If you list items or have items listed on your behalf, we may collect additional information including: listing content, item photos, descriptions, pricing, and item location; payment and payout information (such as check mailing address, PayPal email, or Venmo handle); item inventory details and information submitted through the seller portal; business name, business contact information, tax identification numbers, and inventory feed data (if applicable).

Listings. When you create a listing, we collect photos, product descriptions, pricing, condition details, and item location.

Messages. When you communicate with other users through our messaging system, we collect the content of those messages.

Payment Information. For transactions processed through third-party payment processors such as Shopify, payment information is collected and handled by the applicable processor. We may implement Stripe Connect for direct marketplace payments in the future, at which point payment card details will be collected and processed by Stripe. We do not directly store your full payment card numbers.

Support Requests. When you contact us for customer support, we collect the information you provide in your request, including your name, email, and the content of your communication.

2b. Information Collected Automatically

When you access or use our Service, we automatically collect certain information:

Device and Browser Information. We collect your device type, operating system, browser type and version, screen resolution, and device identifiers.

IP Address and Location. We collect your IP address, which may be used to approximate your general geographic location.

Usage Data. We collect information about how you interact with our Service, including pages viewed, search queries, listings viewed, items saved, time spent on pages, click patterns, and referring URLs.

Cookies and Similar Technologies. We use cookies, pixels, and similar tracking technologies to collect information about your browsing activity. See Section 5 for more details.

2c. Information from Third Parties

We may receive information about you from third-party sources:

Shopify. For purchases, we receive order data from Shopify, including transaction details, shipping information, and order status.

Analytics Providers. We receive aggregated and individual usage data from Google Analytics and similar services.

Advertising Partners. We may receive information about your interactions with our advertisements on other platforms through services like Meta (Facebook/Instagram).

3. How We Use Your Information

We use the information we collect for the following purposes:

Providing and Improving the Marketplace. To operate, maintain, and improve our Service, including displaying listings, facilitating searches, enabling saved items and projects, and developing new features.

Processing Transactions. To process purchases, facilitate payouts to sellers, and manage order fulfillment.

Facilitating Communication. To enable messaging between buyers and sellers, send transaction-related notifications, and provide customer support.

Marketing Communications. To send you promotional emails, newsletters, and updates about new features or listings that may interest you, using Klaviyo as our email marketing platform. You can opt out of marketing emails at any time (see Section 7).

Analytics and Personalization. To understand how users interact with our Service, analyze trends, personalize your experience, and measure the effectiveness of our marketing through tools such as Google Analytics and Meta Pixel.

Fraud Prevention and Safety. To detect, investigate, and prevent fraudulent transactions, abuse, and other harmful activity on our platform.

Enforcing Our Terms. To enforce our Terms of Service, protect the rights and safety of our users, and resolve disputes.

Legal Compliance. To comply with applicable laws, regulations, legal processes, or governmental requests.

4. How We Share Your Information

We share your information in the following circumstances:

With Other Users

Our marketplace requires sharing certain information between buyers and sellers to facilitate transactions:

• Buyers can see: Seller display name, general item location, listing details, and seller ratings or reviews.
• Sellers can see: Buyer name, shipping address, and order details necessary to fulfill the transaction.

With Service Providers

We share information with third-party companies that help us operate and improve our Service:

• Vercel — website hosting and deployment
• Supabase — database and backend infrastructure
• Shopify — product listings, order processing, and checkout
• Klaviyo — email marketing and transactional emails
• Google Analytics — website analytics and usage reporting
• Meta (Facebook) — advertising measurement and optimization via Meta Pixel
• Payment Processors — Shopify Payments (currently) and Stripe (planned) for processing transactions and seller payouts

These service providers are contractually obligated to use your information only as necessary to provide their services to us and in accordance with this Privacy Policy.

For Legal Requirements

We may disclose your information if required to do so by law or if we believe in good faith that such action is necessary to: (a) comply with a legal obligation, court order, or legal process; (b) protect and defend our rights or property; (c) prevent fraud or protect against potential safety issues; or (d) protect the personal safety of users or the public.

Business Transfers

If Unbuilt is involved in a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you of any such change by posting the updated Privacy Policy on our Service.

With Your Consent

We may share your information in other ways if you give us explicit consent to do so.

We Do Not Sell Your Personal Information

Unbuilt does not sell your personal information to third parties for their own marketing purposes. This includes under the definitions of "sale" and "sharing" in the California Consumer Privacy Act (CCPA/CPRA).

5. Cookies and Tracking Technologies

We use cookies and similar technologies to collect information and improve your experience on our Service.

Types of Cookies We Use

Essential Cookies. These are necessary for the Service to function. They enable core features like user authentication, session management, and security. You cannot opt out of essential cookies without affecting the functionality of the Service.

Analytics Cookies. We use Google Analytics cookies to understand how visitors use our Service, which pages are most popular, and how users navigate the site. This information helps us improve the Service. Google Analytics uses cookies to collect information in an anonymous form, including the number of visitors, where visitors come from, and the pages they visit.

Marketing Cookies. We use Meta Pixel and Klaviyo tracking to measure the effectiveness of our advertising, deliver relevant ads to you on other platforms, and understand how you arrived at our Service. These cookies may track your browsing activity across other websites.

Managing Cookies

You can control cookies through the following methods:

• Browser Settings. Most web browsers allow you to manage cookie preferences through their settings. You can set your browser to refuse cookies, delete cookies, or alert you when a cookie is being set. Note that disabling cookies may affect the functionality of our Service.
• Google Analytics Opt-Out. You can opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-On.
• Meta Opt-Out. You can manage your Meta ad preferences at Meta Ad Preferences. You can also opt out of interest-based advertising from Meta and other participating companies at www.aboutads.info/choices.
• Klaviyo. You can unsubscribe from Klaviyo-powered emails using the unsubscribe link in any marketing email we send.

Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) setting that sends a signal to websites you visit indicating you do not wish to be tracked. There is no accepted standard for how to respond to DNT signals, and our Service does not currently respond to DNT signals. We will update this policy if we adopt a DNT standard in the future.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Account Data. We retain your account information for as long as your account is active. If you request account deletion, we will delete or anonymize your personal information within 45 days, subject to the exceptions below.

Transaction Records. We retain records of transactions, including purchase and payout information, for a minimum of seven (7) years as required for tax reporting and compliance purposes.

Listing Data. Listing information for completed or expired listings may be retained in an anonymized or aggregated form for marketplace analytics.

Messages. Message history is retained while your account is active and for a reasonable period after account deletion to support dispute resolution and safety investigations.

Legal Obligations. We may retain certain information as required by applicable law, regulation, or legal proceedings, even after you request deletion.

7. Your Rights and Choices

You have the following rights and choices regarding your personal information:

Access Your Data. You can request a copy of the personal information we hold about you.

Correct Your Data. You can update your account information at any time by logging into your account settings. You can also contact us to correct any inaccurate information.

Delete Your Data. You can request that we delete your personal information, subject to certain exceptions (such as legal retention requirements). See Section 6 for details on retention periods.

Opt Out of Marketing Emails. You can unsubscribe from marketing emails at any time by clicking the "unsubscribe" link in any marketing email, or by contacting us at customer_support@unbuilt.co. Note that even after opting out, you may still receive transactional or account-related emails (such as order confirmations or security alerts).

Cookie Preferences. See Section 5 for information on managing cookies and tracking technologies.

California Residents. If you are a California resident, you have additional rights under the CCPA/CPRA. See Section 8 for details.

To exercise any of these rights, contact us at customer_support@unbuilt.co.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), provides you with additional rights regarding your personal information.

Categories of Personal Information We Collect

In the preceding twelve (12) months, we have collected the following categories of personal information:

Your CCPA Rights

As a California resident, you have the right to:

Right to Know. Request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.

Right to Delete. Request that we delete the personal information we have collected about you, subject to certain exceptions permitted by law.

Right to Correct. Request that we correct inaccurate personal information we maintain about you.

Right to Opt Out of Sale or Sharing. You have the right to opt out of the "sale" or "sharing" of your personal information. Unbuilt does not sell your personal information and does not share your personal information for cross-context behavioral advertising as those terms are defined under the CCPA.

Right to Non-Discrimination. We will not discriminate against you for exercising your CCPA rights. We will not deny you goods or services, charge you different prices, provide a different level of quality, or suggest any of these will occur because you exercised your privacy rights.

California "Shine the Light" Law

Under California Civil Code Section 1798.83, California residents who have provided personal information to a business with which they have established a business relationship may request information about whether the business has disclosed personal information to any third parties for the third parties' direct marketing purposes. Unbuilt does not disclose personal information to third parties for their direct marketing purposes. If you have questions about this practice, please contact us at customer_support@unbuilt.co.

How to Exercise Your Rights

To submit a request to know, delete, or correct your personal information, contact us at:

• Email: customer_support@unbuilt.co
• Subject Line: "CCPA Privacy Request"

Verification Process

When you submit a request, we will take steps to verify your identity before processing it. We may ask you to confirm your email address, provide account details, or answer security questions. If we cannot verify your identity, we may deny your request.

For requests to know specific pieces of personal information, we require a higher degree of verification, which may include providing a signed declaration under penalty of perjury.

Authorized Agents

You may designate an authorized agent to make a CCPA request on your behalf. If you use an authorized agent, we may require: (a) signed written permission from you authorizing the agent, and (b) verification of your identity directly with us. We may deny a request from an agent if they do not provide sufficient proof of authorization.

9. Children's Privacy

Our Service is not intended for anyone under the age of 18. We do not knowingly collect personal information from children under 18. If you are under 18, please do not use our Service or provide any personal information to us.

If we learn that we have collected personal information from a child under the age of 13 in violation of the Children's Online Privacy Protection Act (COPPA), we will promptly delete that information. If we learn that we have collected personal information from a child between the ages of 13 and 18, we will take steps to delete that information.

If you believe that a child has provided us with personal information, please contact us at customer_support@unbuilt.co so that we can take appropriate action.

10. Security

We take reasonable administrative, technical, and physical measures to protect your personal information from unauthorized access, use, alteration, and destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Secure storage of data using Supabase's built-in security features, including row-level security and encrypted backups
• Access controls limiting employee and contractor access to personal information on a need-to-know basis
• Regular monitoring of our systems for potential vulnerabilities

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

If you believe your account has been compromised, please contact us immediately at customer_support@unbuilt.co.

11. International Users

Our Service is operated from the United States and is intended for users located in the United States. If you access our Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

By using our Service from outside the United States, you consent to the transfer, storage, and processing of your information in the United States.

12. Third-Party Links

Our Service may contain links to third-party websites, services, or content that are not owned or controlled by Unbuilt. This includes links within listings to manufacturer websites, external product pages, or other resources.

We are not responsible for the privacy practices of any third-party websites or services. We encourage you to review the privacy policies of any third-party sites you visit. This Privacy Policy applies only to our Service.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will update the "Last Updated" date at the top of this policy.

If we make material changes that significantly affect how we handle your personal information, we will provide prominent notice, such as by posting a notice on our Service or sending you an email notification (if we have your email address).

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Unbuilt, Inc.
Email: customer_support@unbuilt.co
Website: https://unbuilt.co

For CCPA-specific requests, please use the subject line "CCPA Privacy Request" when emailing us.

This Privacy Policy is effective as of April 1, 2026.