Privacy policy
Last updated: 2026-10-03
This policy explains how Spot Auction (“we”, “us”) processes personal data when you use https://spot.auction and related services. We provide a read-only research catalog of U.S. auction lots (including Copart and IAAI listings). We are not Copart, IAAI, or an auction house, and we do not sell vehicles or place bids on your behalf.
We designed this notice to meet the EU/EEA GDPR, Georgia’s Law on Personal Data Protection (2023), and comparable rules in Germany, Kazakhstan, Armenia, and other countries where our users work.
1. Controller and contact
The controller of personal data processed via the Spot Auction website is the operator of https://spot.auction. For privacy requests write to privacy@spot.auction.
If a group company or local representative is appointed, we will publish those details here.
2. Data we process
Account data: email address and a hashed password if you register. We do not require your real name to open an account.
Service data: saved searches, watch lists and lot notes stored against your account; optional Telegram chat linkage if you connect alerts.
Billing data: subscription plan, status, and payment identifiers. Card details are collected and processed by Stripe, not stored on our servers.
Usage data on your device: interface language, theme, recently viewed lots, local search drafts, and a consent record. These usually stay in your browser (localStorage / sessionStorage).
Technical logs: IP address, user agent, timestamps, and error traces needed to run and secure the service.
Optional analytics: if you allow analytics cookies, a first-party SEO measurement script (A.I.T.A. / 52525.ru) may load. It is not loaded until you consent.
Catalog content (VIN, photos, sale data) comes from auction data providers. It describes vehicles, not you, unless you enter a VIN or lot number in search.
3. Purposes and legal bases
Provide the catalog, lot pages, archive, calculator, and account features — contract (GDPR Art. 6(1)(b); equivalent provisions of Georgian, Kazakh, and Armenian law).
Secure the service, prevent abuse, and keep logs — legitimate interests / legal obligation (Art. 6(1)(c) and (f)).
Process subscriptions via Stripe — contract and legal obligations for invoicing.
Remember theme, locale, and session — strictly necessary for the service you requested.
Optional functional storage (remember email, local drafts) and analytics — consent (Art. 6(1)(a); Georgia PDPL consent rules). You can withdraw consent at any time via Cookie settings without affecting the lawfulness of prior processing.
Email operational messages (password, billing) — contract. We do not send marketing newsletters unless you opt in separately.
5. Recipients
Hosting and infrastructure providers who run the website and API under contract.
Stripe for payment processing (see stripe.com/privacy).
Auction data suppliers (including Apibara and fallback providers). They supply lot data; they do not receive your account password.
Telegram if you choose to link the bot for search alerts.
A.I.T.A. (52525.ru) only if you consent to analytics.
Authorities when required by law.
6. International transfers
Servers, payment systems, and data suppliers may be located in the EU/EEA, the United States, Georgia, or other countries. Where GDPR or Georgian PDPL requires a transfer tool, we use appropriate safeguards (adequacy, standard contractual clauses, or equivalent).
7. Retention
Account and saved searches: until you delete the account or the data, plus a short period for backups and legal claims.
Billing records: as required by tax and accounting law.
Security logs: typically up to 12 months unless a longer period is needed to investigate an incident.
Consent records: for the life of the choice plus evidence of compliance.
Browser storage: until you clear it or change cookie settings.
8. Your rights
Depending on your location you may have the right to access, rectify, erase, restrict, object, port data, and withdraw consent. EU/EEA users also have GDPR rights; Georgia residents have rights under the 2023 PDPL; Kazakhstan and Armenia grant analogous data-subject rights.
Send requests to privacy@spot.auction. We may need to verify the account email. You may lodge a complaint with a supervisory authority, including the Personal Data Protection Service of Georgia (pdps.ge), an EU/EEA data protection authority, Germany’s BfDI or a Land DPA, Kazakhstan’s authorized body for personal data, or Armenia’s Personal Data Protection Agency.
9. Children
The service is for professional dealers and adult users. We do not knowingly collect data from children.
10. Security
We use HTTPS, hashed passwords, access controls, and least-privilege operations. No method of transmission is perfectly secure; please use a unique password.
11. Changes
We will update this page when our processing changes. Material changes may be highlighted in the product or by email to registered users.