BlockBargaining Privacy Notice

1. Information we collect

Accounts and profiles. Email address, account identifier, sign-in/session information, and any name, display name, or preferences you provide. We also record your affirmative declaration that you are 18 or older and its confirmation timestamp. We do not collect a birth date or identity document for this declaration. Sign-in uses an emailed magic link.

Requests. Submitted text, summary, category, attributes, coarse location such as ZIP, deadline, status, and timestamps. Leave out names, contacts, exact addresses, health details, payment information, and unnecessary private information.

Groups and discussion. Group identifiers, membership and participation status, archive/leave state, posts, and links to the relevant account and request.

Reports and support. Messages, reports, optional details, reported content, moderation decisions, resolution notes, and audit records. Gmail handles email and attachments sent to our public address.

Technical and operational information. Session/request identifiers, timestamps, error and function logs, security/rate-limit records, and moderation audit events.

Pending: confirm production hosting/authentication log fields and retention. This draft does not claim that providers collect no IP, device, or request information.

Provider features when enabled. Provider registration/business details, service areas, opportunities, bid versions, approved offers, individual decisions, completion reports, and administrative closure records. An offer decision records account, group and bid identifiers, choice, and timestamp; it does not automatically disclose contact details or process payment.

Email delivery when enabled. Recipient addresses and delivery/failure records; operator digests also retain consolidated-demand snapshot, outbox, and delivery metadata. A digest is not permission to send buyer contacts to providers.

2. Where information comes from and why we use it

Information comes from you, site activity, enabled-workflow participants, and hosting, authentication, storage, or email providers.

• Create accounts and authenticate sign-ins.
• Save, organize, summarize, categorize, and match requests.
• Manage groups, memberships, posts, and participation.
• Prepare limited reviewed public cards.
• Support provider opportunities, bids, offers, individual decisions, and completion records.
• Support operator-managed customer-provider communication without direct contact sharing.
• Send operational messages, support users, investigate reports, enforce policies, prevent abuse, troubleshoot, keep records, and address legal, dispute, or security needs.

Creating an account or request does not subscribe you to third-party marketing.

3. Matching and automated processing

The service uses topic, category, attributes, coarse location, and supported criteria to find related demand. Matching can create or join a member-only group and create a related post. Pending: the final submission notice must explain this before saving. A match is an organizational suggestion, not a purchase requirement or equivalence guarantee.

The public intake uses application rules and does not send request text to an external AI model. Introducing one would require an updated explanation before processing begins.

4. Who can see information

You and authorized operators. Operators access what is needed to run the service, review cards, provide support, moderate, and address security/legal issues.

Other group members. Active members can see the summary, category, location scope, status, deadlines, visible posts, timestamps, replies, membership records and associated UUIDs. UUIDs are account-associated information, not anonymity. Another buyer's profile and underlying raw request remain restricted unless information is repeated in a group post.

The public. A reviewed card contains a sanitized topic/summary, category, aggregate active-member count, and group link/identifier-not identities, contacts, exact addresses, raw requests, membership identities, or posts. Cards can be copied or indexed; small groups and changing counts can permit inferences.

Providers when enabled. Eligible providers see aggregate requirements, group/opportunity identifiers, bid close, status, and their own profile and bids. Eligibility gives no buyer profile, contact, raw request, exact address, posts, or roster access. Kora Agentic AI manages communication; contacts are not automatically disclosed. Necessary fulfillment or merchant disclosures require a reviewed process and appropriate explanation.

Service providers. Supabase provides authentication/database services; Vercel provides hosting/server functions; Resend handles enabled application email; the authentication sender depends on Supabase configuration; Gmail handles support correspondence.

Pending: confirm the authentication-email sender and provider inventory; assess sale, cross-context advertising sharing, and targeted advertising. This draft makes no unverified "never sell or share" assertion.

Legal and safety disclosures. Relevant information may be disclosed when reasonably necessary under applicable law or valid process, for an incident, or to protect rights or safety.

When you pay a provider directly, the provider and its payment service handle that payment under their own notices and agreements. BlockBargaining does not process your payment-card details. Information we actually receive for coordination, support, provider agreements or commission questions may be retained under the retention process described below; no automatic commission obligation or payment record is created by expressing interest. Necessary contact and fulfillment data require affirmative permission explaining recipient, details and purpose. Operator coordination does not promise provider anonymity.

5. Cookies and browser storage

Supabase cookies support sign-in. Local storage holds a pending request draft, retry identifier, and expiry to resume after sign-in. Drafts may contain original text and structured details. They are treated as expired after 30 minutes but cleared only after successful creation or when next loaded after expiry. Browser expiry does not delete a server request.

Browser controls can clear/block storage, which may sign you out, discard a draft, or break a feature. No analytics SDK, advertising technology, or tracking pixel was identified in reviewed code; deployed integrations remain unverified. Current code does not act on Do Not Track or Global Privacy Control.

Pending: verify integrations, cookies, tracking, and legally required opt-outs.

6. Retention and deletion

Leaving, withdrawing, closing, or completing does not automatically delete account records, requests, posts, membership history, reports, audit/operational records, backups, or vendor copies.

Pending review: finalize a documented retention and manual deletion procedure, including verification, record scope, exceptions, vendor coordination, and backups. There is no general automatic purge or promised fixed deletion date; vendor-log and backup retention must be confirmed.

7. Your choices and requests

Ask about access, correction, deletion, a public card, or contact-sharing permission at rrkora@gmail.com. There is no self-service account-deletion button. Identify the relevant account/request/group without sending passwords, sign-in links, payment data, or government ID initially; proportionate verification may be required.

Depending on applicable law, rights may include access, correction, deletion, copy, restriction, consent withdrawal, opt-out, or appeal, subject to conditions and exceptions. Contacts are not automatically shared; provider anonymity is not promised.

Pending: test the manual privacy-request process before publishing it as an operational commitment.

8. Security and processing locations

Authentication and access controls limit access, but no online service can guarantee no loss or unauthorized access. Report suspected exposure to rrkora@gmail.com.

Pending: confirm production processing locations and required international-transfer arrangements.

9. Children

The service is for adults 18 and older. Children are not eligible. Contact rrkora@gmail.com if you believe a child provided personal information. This draft does not claim age verification or parental consent is available.

10. Changes to this notice

We will post an updated notice and effective date when practices change, with additional notice or permission where required. A revision does not itself authorize broader sharing.

Privacy contact: Kora Agentic AI, rrkora@gmail.com.