Your information, explained plainly

1. Information you provide

When you use a buyer, seller, or professional inquiry form, we may collect your name, email address, phone number, postal code, organization or estate name, audience and inquiry type, interests, collection type, approximate volume, timeline, preferred reply method, message, the page where you submitted it, the referring page, UTM campaign parameters, and your separate email or SMS consent choices. Seller and professional forms may also collect optional property photos, inventory spreadsheets, PDFs, Word or text documents, short item videos, the submitted filename, file type, byte count, and a cryptographic file digest used for integrity and duplicate handling.

When you request a charity or benefit auction consultation, we may also collect your role, organization website, event date or anticipated month, event city and postal code, venue status, event type and format, expected attendance, fundraising goal, professional-services budget, requested support, approximate live- and silent-auction item counts, prior-event context, production or platform notes, accessibility or communication needs, and the outcome the organization hopes to support.

When you join the auction-alert email list, we collect your email address, optional first name, the placement and page where you subscribed, sanitized referral and UTM information, and a versioned record of the email and privacy consent you selected. A current subscriber record is maintained separately from the immutable subscription-request receipt so an updated preference does not erase the original consent evidence.

Upload only records relevant to the property. Do not submit passwords, full payment-card or bank-account numbers, government identification numbers, medical records, unrelated personal information, executables, scripts, archives, web pages, SVG files, macro-enabled documents, or password-protected files through a website inquiry form. The upload allowlist, declared-type checks, and basic file-structure checks reduce obvious mismatches but are not antivirus scanning. Supported files remain untrusted; authorized staff should download them cautiously and use protected-view or safe-preview tools where available.

For a charity or benefit event request, do not submit donor lists, beneficiary details, payment information, medical information or diagnoses, passwords, account credentials, or other sensitive event records. Describe accessibility or communication needs only to the level reasonably needed for event planning.

2. Information generated by site use

Our hosting and security providers may process routine technical information needed to deliver and protect the site, such as IP address, browser and device details, request time, and security events. Within a browser tab, the site keeps the first meaningful referring page and UTM source, medium, campaign, term, and content values for attribution. When a valid Microsoft Advertising click identifier (msclkid) is present, the most recent value is retained in that tab for advertising attribution. Those values are submitted with a form if you choose to send it. Query strings, fragments, and credentials are removed from the stored referrer.

For abuse control, the inquiry and auction-alert forms create a one-way client key from network and browser information using a private server secret. The raw network address is not stored in the lead or subscriber record, rate-limit buckets are used only to restrict repeated submissions, and expired buckets are routinely removed. We do not expose a public endpoint for reading submitted inquiries or subscribers.

3. Analytics and advertising measurement

Google Analytics through the site’s first-party Google tag gateway, Meta Pixel, and Microsoft Advertising Universal Event Tracking (UET) are fail-closed. Each tool remains paused unless the production site is configured with a validated Bidding Is Open measurement ID. The website does not load any of these measurement libraries merely because you open a public page. A configured library loads only after you explicitly choose Allow measurement. Global Privacy Control and Do Not Track signals are treated as a denial.

After you allow measurement, Google Analytics may measure page views, referring sources, navigation, live-catalog visits, primary calls to action, and successful form submissions. Meta Pixel records PageView events so we can understand visits and evaluate Facebook and Instagram advertising. Microsoft UET records page-load events so we can understand visits from Microsoft Advertising. A successful property-seller or property-service professional request may also send a seller_request_submitted event through UET and Microsoft’s Conversions API. The browser and server copies use the same random event identifier so Microsoft can deduplicate them. A charity-event request uses the separate charity_event_inquiry_submitted browser event for consented Google Analytics and is not sent as a Microsoft seller conversion.

The Microsoft server event is sent only when the visitor allowed measurement before submitting an eligible property-sale form. It may include the Microsoft click identifier, browser user-agent, page path, seller-or-property-service-professional classification, form placement, and a one-way SHA-256 hash of a normalized email address for attribution. It does not send the raw email address, phone number, name, postal code, organization, inquiry text, attachments, filenames, or other submitted form contents to Microsoft Advertising. Buyer-help inquiries are not sent as Microsoft advertising conversions. Charity-event inquiries are likewise not sent as Microsoft advertising conversions.

Google, Meta, and Microsoft may process routine device, browser, network, referral, campaign, and interaction information under their own terms and privacy practices. After consent, the Google tag gateway serves configured Google measurement code through a first-party path on this domain; this delivery path does not change your consent choice. Meta Pixel may set or read first-party measurement cookies such as _fbp or _fbc, and Microsoft UET may set or read measurement cookies such as _uetvid or _uetsid. We do not configure Meta advanced matching. Our browser event payloads do not deliberately include contact fields, inquiry text, passwords, payment-card information, HiBid credentials, or attachments. Google advertising storage, advertising user data, and advertising personalization remain denied.

You can change your choice using the Measurement privacy control on the site. Revoking the choice stops future measurement sent by this website and attempts to remove accessible Google, Meta, and Microsoft measurement cookies; it cannot retract information a provider already received while consent was active.

4. AI-assisted customer-service chat

The website offers an AI-assisted Live Chat widget operated through HighLevel and LeadConnector. When you open or use it, HighLevel may process the messages and contact details you choose to provide, conversation times, and routine device, browser, network, and session information needed to operate and protect the chat. Chat is a customer-service function, not measurement: after you answer the first-visit measurement notice, chat remains available whether you allow or decline measurement. Using chat does not by itself enroll you in marketing or SMS messages.

The AI assistant provides general help and can make mistakes. It cannot inspect or change live catalogs, bids, lot clocks, auction terms, invoices, payments, cards, refunds, or shipment status. For live auction and account information, use the platform linked for your event on our Auctions page. For help from a person, email help@biddingisopen.com. Do not send passwords, full payment-card numbers, government identification, or other highly sensitive information in chat.

5. Why we use information

• Respond to bidder, lot, payment, pickup, shipping, consignment, or professional questions.
• Evaluate whether property may fit an auction engagement and prepare a preliminary collection appraisal for auction planning when the evidence supports one.
• Review charity or benefit event needs, availability, location, planning stage, requested services, and practical engagement scope.
• Maintain a record of the inquiry, response, consent, and source page.
• Maintain the consented auction-alert list and prepare future catalog or bidder-guide email updates.
• Route the inquiry to authorized business systems and team members after launch configuration.
• Measure website use, evaluate campaign sources, and improve page content and navigation.
• Protect the website, prevent spam, troubleshoot, and comply with legal obligations.
• Send optional auction or consignment updates only when the relevant consent was selected, subject to unsubscribe or opt-out rights.

6. Email and SMS choices

Email marketing and SMS consent boxes are optional and are not conditions of purchase. The dedicated auction-alert form requires email consent because joining that list is its only purpose; using the form is optional and is not required to browse, register, bid, buy, sell, or request service. If you opt into SMS elsewhere, message frequency varies; message and data rates may apply. Reply STOP to opt out and HELP for help. You may unsubscribe from marketing email using the message link or contact us directly. Service responses to a request may still be sent as reasonably necessary to handle that request.

7. Storage and CRM routing

Inquiry and auction-alert records are designed to be stored in a private Cloudflare D1 database associated with this site. Optional seller and professional attachments are stored in a private Cloudflare R2 bucket using server-generated object names; the public response does not reveal storage keys, file digests, or retrieval credentials. A limited attachment summary—filename, type, extension, and size, but not a public file URL—may be included in the record-only CRM copy. When configured, inquiry forms and consented auction-alert signups may also forward a record-only copy through a private authenticated workflow to GoHighLevel for contact and inquiry management. Storage happens first; forwarding is best-effort so a temporary CRM issue does not silently lose the website submission. Private delivery status, attempt timing, and the accepted CRM contact identifier may be retained for reconciliation. The website endpoints and record-only receiver do not themselves send a campaign, confirmation email, or SMS.

8. When information is shared

We may provide information to service providers that host, secure, route, or support the website and business communications; to carriers or fulfillment providers when needed for an approved shipment; to professional advisors; or when required to comply with law, protect rights, prevent harm, or complete a business transaction. We do not use inquiry records as a data-broker product.

9. Retention and security

We keep inquiry information, uploaded property evidence, charity-event planning details, and subscriber information for as long as reasonably needed to respond, evaluate the property or event-service fit, manage the business relationship or subscription, maintain consent and transaction records, resolve disputes, and meet legal obligations, then delete or de-identify it when appropriate. Files can contain embedded metadata supplied by the file or device; remove anything you do not want included before uploading. Withdrawal can change the current subscriber status without requiring us to erase a consent receipt that must be retained for legitimate recordkeeping. No online system can promise absolute security, but access is intended to be limited to authorized business and service-provider functions.

10. External services

The site loads the consent-gated Google Analytics through Google tag gateway, Meta Pixel, and Microsoft Advertising UET services described in Section 3, loads the HighLevel/LeadConnector Live Chat service after the first-visit measurement notice is resolved, and loads official Trustpilot widgets on pages that display review information. The customer-reviews page also provides ordinary outbound links to the public Google Business Profile, Google review form, and Facebook Recommendations; it does not embed a Google or Facebook review feed or frame. If an attributed customer excerpt is separately published on this website after permission is documented, you may contact us to request correction or removal. HighLevel, LeadConnector, Google, Microsoft, HiBid, Trustpilot, Meta, Facebook, Instagram, LinkedIn, email providers, carriers, and other external services have their own privacy notices. Information you submit directly to those services is governed by their policies, not this one.

11. Your requests

You may ask to access, correct, or delete information you submitted, or withdraw optional communication consent, by emailing help@biddingisopen.com. We may need to verify identity and may retain information when permitted or required for transaction, fraud-prevention, recordkeeping, or legal purposes.

12. Children

This site and its auction services are intended for adults and are not directed to children. Do not submit a minor’s personal information through the inquiry forms.

13. Changes and contact

We may update this policy as the site, tools, or legal requirements change. The updated date appears above. Questions may be sent to help@biddingisopen.com or mailed to Bidding Is Open, 217 Capitol Ct, Ocoee, FL 34761.