Privacy Policy

Tømmesalg is a live-auction marketplace operated by M&CO AS, organisation number 821 157 102, Kai Møllers vei 1B, 1637 Gamle Fredrikstad, Norway. We treat M&CO AS as the data controller for the personal data described in this policy. Controller identity and contact details remain subject to Legal confirmation.

Questions about privacy, or about data we hold about you: support@tommesalg.no.

Logged-in users can open privacy controls at /account/privacy (cookies, export, marketing objection for notifications, restriction of optional processing, and account deletion).

Information you give us

• Account details: your name, e-mail address, phone number, and, where provided, date of birth, gender, a nickname and a profile picture.
• Addresses: the delivery and billing addresses you save for your orders.
• Payment details: card numbers are entered directly into our payment provider Stripe. We do not receive or store your full card number. Where you save a card, we store card brand, last four digits and expiry so you can recognise it, plus Stripe customer and payment-method identifiers. Vipps may be used for login and/or checkout where offered.
• Content you create: messages you send in live-auction chat, bids and offers you place, and reports you file about other users or content.
• Seller applications: if you apply to sell, we collect your phone number, address, your answers about experience and availability, and the CV file you upload.
• Support correspondence: what you write to us when you get in touch.

Information collected automatically

• Account activity: your purchases, bids, offers, orders and which auctions you have joined.
• Technical information: browser and server logs may include IP address, user agent and similar request metadata needed to operate and secure the service.
• Push / device tokens: where you enable notifications, we store a push token (for example via Firebase Cloud Messaging) to deliver auction and order notifications.
• Mobile apps may also send device model, OS version, app version and an installation identifier. The production native marketplace app is not fully represented in this repository; treat mobile-specific device claims as subject to mobile evidence review.
• Cookie consent choices (necessary / analytics / marketing flags, timestamp and consent version 2026-03-24).

What we do NOT collect

• We do not sell your personal data.
• We do not collect precise GPS location as a product feature.
• We do not receive biometric templates. If a mobile OS offers Face ID / Touch ID for unlocking the app, that check is performed by the device; we only learn whether unlock succeeded where that flow exists.
• On the website, buyers watch and listen to live auctions; you do not broadcast with the buyer camera/microphone as part of the standard buyer flow.

Optional web analytics: when a measurement ID is configured and you grant analytics cookie consent, the website may load Google Analytics (gtag). Analytics is off by default. Whether a given production host has analytics configured is environment-dependent and not asserted here.

We use a first-party consent cookie named tm_cookie_consent (consent version 2026-03-24). Categories in the product:

• Necessary — required for login/session and recording your cookie choice. Not offered as an optional toggle.
• Analytics — optional. Gates Google Analytics when a measurement ID is present. Defaults to off until you accept.
• Marketing (cookies) — optional cookie category. It is not the same control as promotional e-mail/push preferences (marketing_opt_in under notification settings).

You can change or withdraw optional cookie choices in the cookie banner (when shown) or at /account/privacy. Withdrawal stops future optional analytics in the browser and expires known Google Analytics cookies locally; it does not delete historical consent audit rows and does not call a provider user-deletion API by itself.

Promotional notification preferences are managed separately at /account/notifications.

The Article 6 bases below are the wording currently published for transparency. They remain subject to Legal confirmation and are not an engineering certification of compliance.

• To create and run your account, show you auctions and let you bid and buy — necessary to perform our contract with you (GDPR Art. 6(1)(b)).
• To process payments, deliver orders and handle returns and disputes — performance of a contract, and compliance with a legal obligation for accounting records where applicable (Art. 6(1)(b) and (c)).
• To send you operational notifications about auctions, bids and orders — performance of a contract. You can adjust notification channels in account settings and on your device.
• To keep the marketplace safe: reviewing reports, moderating live streams and chat, and acting on blocks — our legitimate interest in a safe service (Art. 6(1)(f)).
• To prevent fraud and meet legal obligations, including bookkeeping and consumer-protection law where applicable (Art. 6(1)(c) and (f)).
• To improve the service and fix faults — legitimate interest.
• Optional analytics cookies — only after analytics consent where consent is used for that purpose (see Cookies). Legal characterisation of analytics remains under review.

Tømmesalg carries content created by its users: sellers broadcast live video of the items they sell, and buyers write messages in the auction chat. Live media and chat are delivered using Agora infrastructure.

• Anything you write in a live-auction chat is visible to everyone watching that auction, together with your display name or nickname. Participation is not anonymous.
• Your bids may be shown to other participants in the auction room (including display name).
• We have zero tolerance for objectionable content and abusive behaviour. You can report any message, live stream, listing or account from inside the product, and you can block any account — blocked accounts disappear from your feed, chat and search immediately.
• We review reports and remove content that breaks our terms. We may suspend or terminate accounts that do.
• We keep records of reports and moderation decisions so we can act on repeat behaviour.

We do not sell your personal data. We share it with service providers that make the marketplace work. Contractual roles (controller vs processor), DPAs and transfer safeguards for each provider remain subject to Legal / contractual confirmation — this list is an engineering inventory of integrations that process personal data.

• Stripe — payment processing. Stripe may act as an independent controller for fraud prevention and keeps transaction records under its own retention policy. See stripe.com/privacy. Tommesalg does not currently call Stripe's customer-deletion API on account erase.
• Vipps — if you sign in or pay with Vipps, Vipps confirms identity and/or payment details according to the Vipps flow you use. See vipps.no.
• Agora — live video, audio and chat infrastructure for auction broadcasts and chat messages.
• Google (Firebase Cloud Messaging) and Apple — delivery of push notifications where enabled.
• Bring — when you type an address, we send what you have typed to Bring's address service to suggest and validate Norwegian addresses.
• Profrakt — when a shipment is created, consignee name, address, phone and related parcel data are sent so a label/tracking can be produced (carriers such as Bring may be used via Profrakt).
• Amazon Web Services — application hosting, account authentication (Amazon Cognito), database hosting (Amazon Aurora PostgreSQL) and storage of images and uploaded files (Amazon S3).
• SMTP / Mailcow — outbound transactional e-mail (orders, auth, notifications). Local send history may be retained; no fixed public retention period is asserted here.
• Google Analytics — optional web analytics when configured and analytics consent is granted (see Cookies).
• Infrastructure such as Redis, application hosting and reverse proxies may process technical identifiers (for example cache keys, rate limits, access logs). Hosting location and log retention for those systems require operations evidence.

We also share information with sellers where a purchase requires it: a seller receives the name and delivery address needed to ship your order.

We may disclose information where the law requires it, or to establish, exercise or defend legal claims.

Some of our primary systems are configured in the EU/EEA (for example our Amazon Web Services region is eu-north-1). That does not prove that every provider processes data only in the EEA. Where a provider processes data outside the EEA, the applicable transfer mechanism (adequacy, SCCs or other safeguards) must be confirmed from contracts and account settings — it is not asserted solely by this engineering document.

You can ask us for the safeguards we rely on: support@tommesalg.no.

Traffic between clients and our servers is encrypted with TLS. Access to personal data inside our organisation is limited to roles that need it. Web login sessions use first-party auth cookies managed by our authentication provider. Mobile secure-storage behaviour depends on the client app and is not fully verified from this repository for the production Flutter marketplace app.

We use server-side access controls, signed URLs for private uploads where applicable, and log redaction helpers for sensitive fields. No system is perfectly secure. We will notify you and the Norwegian Data Protection Authority where the law requires it. This section does not claim GDPR compliance or zero risk.

You can request account deletion at tommesalg.no/account/delete (also linked from /account/privacy). Mobile clients may hand off to the same web confirmation flow.

How it works in our systems:

1. You confirm the deletion in your browser by entering your e-mail address and accepting the consequences.
2. Your account enters a 90-day cooling period. During this period marketplace access is frozen: you cannot use the account normally, and you are not treated as an active participant.
3. If you change your mind, sign in on the website within those 90 days and choose "Reactivate account".
4. After the cooling period, a scheduled purge deletes personal data from our primary first-party systems, subject to the exceptions below. Deletion from provider backups, archives, payment providers, shipping providers, analytics providers or e-mail infrastructure is not guaranteed by this product flow alone.

Some information may need to be kept even after deletion because the law requires it — see "How long we keep your information" below.

We keep your personal data for as long as you have an active account with us.

When you delete your account, personal data in our primary systems is frozen for 90 days and then scheduled for first-party deletion. That cooling period is an application behaviour — it is not a claim that every store is emptied after exactly 90 days in all circumstances.

Transaction and accounting records relating to purchases and sales may be retained longer where required by law. This policy has referred to a 5-year bookkeeping retention under the Norwegian Bookkeeping Act section 13. That statutory application to Tommesalg remains subject to Legal confirmation (engineering decision reference DEC-003). Until Legal confirms retention schedules, we do not claim that every dataset follows a single approved period.

Bidding history and other content tied to other users' completed purchases may be retained with foreign keys removed and a frozen display name on orders. That is not the same as full anonymisation: remaining fields can still identify a person until a separate legal retention/minimisation decision is applied.

Payment records held by Stripe, shipping data held by Profrakt/carriers, analytics data held by Google, and e-mail provider mailboxes follow those providers' own retention unless a separate erase process is implemented and confirmed.

Under the GDPR you may have the right to:

• access the personal data we hold about you, and receive a copy of it;
• have inaccurate data corrected — most profile and address fields you can edit yourself; date of birth cannot be changed in-product after creation;
• have your data erased — use the account-deletion flow (cooling period applies);
• restrict or object to certain processing — see the practical limits below;
• receive a machine-readable JSON export of entitled first-party data;
• withdraw cookie consent for optional analytics/marketing cookies without affecting processing that already took place.

Logged-in users can use /account/privacy for export, marketing notification objection, restriction of optional/marketing processing, cookie settings, request status, and the existing account-deletion flow. Self-service restriction today covers optional/marketing-style processing flags — it is not a full Article 18 halt of all contractual marketplace processing. Self-service objection today covers promotional notifications (marketing_opt_in); broader legitimate-interest objections are handled manually via support pending Legal process design.

Contact support@tommesalg.no. We aim to answer within one month. That timing is the wording currently published in this policy and remains subject to Legal confirmation of the applicable statutory deadline. Internally, operations track request age in UTC; a 21-day review hint is an engineering target only, not a legal deadline.

If you believe we handle your data incorrectly, you may complain to the Norwegian Data Protection Authority (Datatilsynet), www.datatilsynet.no.

Tømmesalg is not intended for children. This policy has historically stated that you must be at least 18 years old. Where a date of birth is provided during registration, our systems currently enforce a technical minimum of 15 years. Date of birth is not always required on every signup path. The correct service minimum age and DOB collection rules remain a Legal / Product decision (GAP-019 / GAP-045). We do not knowingly collect personal data from children below the applicable minimum age. If you believe a child has given us personal data, contact support@tommesalg.no.

We will update this policy when the service changes. Material changes will be announced in the app or by e-mail before they take effect where practicable. The date at the top tells you when this version was published. Cookie consent version (2026-03-24) is a separate product version for the cookie banner categories and is not automatically the same as this policy date.

M&CO AS
Kai Møllers vei 1B
1637 Gamle Fredrikstad
Norway
support@tommesalg.no

A dedicated DPO contact is not published in this repository. Use the address above for privacy requests unless Legal publishes a different channel.