GMC Marketplace (“Platform”, “we”, “us”, or “our”) is operated by Tagan Labs LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA. This Privacy Policy explains how we collect, use, store, and protect your personal information when you access or use our Platform.

By creating an account or using our services, you consent to the practices described in this policy.

1. Information We Collect

1.1 Information You Provide

• Account Information: Name, email address, country of residence, and WhatsApp number.
• Profile Information: Profile photo (optional).
• Verification Documents: Government-issued photo ID, business registration documents, or store admin dashboard screenshots (e.g. Shopify or WooCommerce) submitted for identity verification.
• Listing Data: Store details including niche, revenue figures, ad spend, Google Merchant Center and Meta Ads data, and pricing information.
• Communications: Messages sent through platform chats, support tickets, and questions.
• Deal & E-Signature Data: Information entered when electronically signing an Asset Purchase Agreement (legal name, address, signature), e-signature audit logs, and signed agreement PDFs.

1.2 Information Collected Automatically

• Usage Data: Pages visited, listing views, watchlist activity, and interaction timestamps.
• Device Information: Browser type, IP address, and general location data.

2. How We Use Your Information

• To create and manage your account.
• To verify your identity and prevent fraud.
• To facilitate transactions between buyers and sellers, including issuing and storing Asset Purchase Agreements.
• To enable communication between users and administrators via platform chat and support.
• To send transactional notifications (buy requests, listing updates, chat messages, verification status).
• To send broadcast notifications about new listings, price changes, and platform updates.
• To enforce our Terms and Conditions and protect the integrity of the Platform.
• To improve our services, troubleshoot issues, and analyse usage patterns.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your data under the following legal bases:

• Contractual Necessity: To provide the services you signed up for.
• Legitimate Interest: To improve our platform, prevent fraud, and ensure security.
• Consent: For optional communications and broadcast notifications (which you may opt out of).
• Legal Obligation: To comply with applicable laws and regulations.

4. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share data in the following limited circumstances:

• With Other Users: Your listing information is publicly visible. In deal chats, limited profile information is shared with administrators. Buyer and seller identities are not disclosed to each other — each party signs an anonymous counterpart of the Asset Purchase Agreement and sees the counterparty only by platform reference.
• With Service Providers: We use third-party services for email delivery (Resend), hosting (Vercel), data storage (Supabase), and electronic signature (DocuSeal). These providers process data on our behalf under strict contractual obligations.
• For Legal Compliance: If required by law, regulation, legal process, or governmental request.
• To Protect Rights: To enforce our terms, protect against fraud, or defend our legal rights.

5. Asset Purchase Agreements and Identity Schedule

When a deal progresses to agreed sale terms, GMC Marketplace issues an Asset Purchase Agreement for electronic signature by both buyer and seller. Tagan Labs LLC (operator of GMC Marketplace) acts as Records Custodian for each executed agreement.

As Records Custodian, we retain:

• both executed counterparts (buyer and seller signed PDFs)
• e-signature audit logs from our e-signature provider
• a confidential Identity Schedule — a frozen snapshot linking each party's verified platform identity to the transaction at the date the agreement was issued

The Identity Schedule is not attached to the counterpart delivered to either party. We disclose a party's identity to the counterparty only under the limited triggers set out in the Asset Purchase Agreement (e.g. dispute resolution, legal requirement, or material breach). Each party may download their own signed counterpart from the deal chat.

6. Data Retention

• Account Data: Retained for as long as your account is active. Upon account deletion, personal data is removed within 30 days.
• Verification Documents: Retained for the duration of your account and deleted within 30 days of account closure.
• Chat & Support Messages: Retained for the duration of the associated transaction or support ticket.
• Asset Purchase Agreements & Identity Schedules: Retained for the duration required by law and for dispute resolution, compliance, and enforcement of platform terms. Executed agreements and related records are retained after deal completion.
• Audit Logs: Retained for up to 12 months for security and compliance purposes (general platform audit logs).

7. Data Security

We implement industry-standard security measures including encryption in transit (TLS/SSL), encrypted storage, and row-level security policies on our database. Verification documents are stored in private, encrypted storage accessible only to authorised administrators.

While we take reasonable precautions, no method of transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Update or correct inaccurate information via your profile page.
• Erasure: Request deletion of your account and personal data.
• Restriction: Request that we limit how we process your data.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interest.
• Withdraw Consent: Opt out of non-essential notifications at any time from your profile settings.

To exercise any of these rights, contact us via the Platform’s support system or at the address below.

9. Cookies & Local Storage

We use browser local storage to maintain your authentication session. We do not use third-party tracking cookies. Essential cookies may be used for security and functionality purposes only.

10. Children’s Privacy

Our Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a minor, we will delete it promptly.

11. International Data Transfers

Your data may be processed and stored in the United States and other countries where our service providers operate. By using the Platform, you consent to the transfer of your data to these jurisdictions, which may have different data protection laws than your country of residence.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. Continued use of the Platform after changes constitutes acceptance of the updated policy.

13. Contact