Privacy Policy

1. Who we are

Barn2Buyer is run by Barn2Buyer Holdings, LLC, an Illinois limited liability company ("Barn2Buyer", "we", "us"). This policy explains what personal information we collect through barn2buyer.com and the Barn2Buyer web app (the "Service"), why we use it, who sees it, how long we keep it, and your choices. It goes with our Terms of Use.

Questions or requests: email [email protected], or use Contact us on our website.

2. What we collect and why we use it

We collect only what each feature needs. For each kind of information, we say what it is and why we use it.

Signing up and your account

• What: your first name, last name and email address, your password, whether your email is confirmed, and your account status. Your password is stored only in a scrambled (hashed) form that can't be read back.
• Your agreements: the date and time you confirmed you're 18 or older and agreed to the Terms and Privacy Policy, and the exact version of each document and statement you saw. We don't ask for your birth date, ID or phone number.
• Password breach check: when you set a password, we check it against the Have I Been Pwned list of passwords exposed in data breaches. Only the first five characters of a scrambled code made from your password leave our system; your password itself is never sent.
• Sign-in and sessions: a record of each signed-in session (when it started and expires, and a shortened description of your browser). We don't store your IP address with your session. To stop password guessing and abuse, we count sign-in, sign-up and reset attempts under scrambled codes made from your IP address or email, never the address itself.
• Email changes: if your login email is changed, a record of the old and new address and the confirmation steps.
• Why we use it: to create your account, let you sign in, and keep your account secure. Sign-ups that are never confirmed are deleted after 7 days.

Membership and payments

• What we keep: your plan (monthly or annual), price, trial start and end dates, billing period dates, status (trial, active, grace period, ended), the reminders we sent, the exact consent wording you accepted and when, and Stripe's reference numbers for your customer record, subscription, invoices, refunds and any dispute.
• What we don't keep: your card number or card details. You enter them on Stripe's checkout page, and Stripe also collects your billing address there.
• Why we use it: to charge the fees you agreed to, send reminders, handle failed payments, refunds and disputes, and keep the tax and accounting records the law requires.

Listing a horse or an item

• What: everything you enter about the horse or item (for a horse: name, breed, discipline, sex, foaling year, color, height, pedigree, show history; for an item: title, category, condition, description, delivery options), the price or price range, the city, state and 5-digit ZIP code, photos, PDF documents and YouTube links, its status and history (published, edited, sold, removed, expired, renewed), and the confirmations you gave before publishing.
• Photos: we remove location and camera details before members see them, and keep your clean original privately for you. Documents are scanned for malware and shown to members only as page images.
• ZIP code: kept private. We use it only to check that the city and state match and to work out approximate distances for members' distance searches, using U.S. Census ZIP center points kept in our own system. Members never see it. We never ask for a street address.
• Views and saves: we show you how many members viewed and saved your horse, as numbers only, never who.
• Why we use it: to publish and manage your listing, and to keep listings accurate and safe.

Listing contacts

• What: for each contact you save: a private label only you see, the contact's name, and their phone number and email address if you add them; the role you pick on each listing (Owner, Trainer, Agent, Consignor, Farm office or Other); which methods to show (Call, Text, Email); and your preferred method. Earlier versions of a contact are kept in a restricted history.
• Whose data this is: often someone else's. You must have their permission before you add it.
• Why we use it: so members can reach the right person, and so we can show who authorized what.

Saved horses, saved searches and alerts

• What: the horses you save, the searches you save, how often you want alerts (as they happen, daily or weekly), whether price-drop alerts are on, the in-app notifications we show you, and which listings matched your searches.
• Why we use it: to send you the alerts you asked for.

Messages between members

• What we store: each message's text, who sent it, when, and which listing it's about; whether each person has read the conversation; and any blocks and reports.
• Automated safety checks: each message is checked when it's sent, using automated, rule-based checks that run inside Barn2Buyer. They look for wording often used in scams or abuse: paying by wire, gift card, crypto or a payment app; buying or shipping a horse sight unseen; and abusive language. No outside AI service or other company reads your messages. When a rule matches, we record only the category, the version of the rules and the date. The person receiving the message sees a safety warning. A match isn't a finding that anyone did wrong, and it never by itself suspends or penalizes anyone.
• Who can read them: see Section 3.
• How long we keep them: a conversation and its messages are deleted 12 months after the last message (a new message restarts the 12 months), unless the conversation was reported or is under a legal hold. A reported conversation is kept as restricted evidence for the report's retention period. Warning records are deleted after 13 months.
• If someone deletes their account: they show as "Former member". After the 30-day deletion hold, their messages are removed and show as "Message removed". The other person's own messages stay until the normal 12-month deletion.
• Email alerts about new messages name the horse or item and link you to sign in. They never include the message text, a preview or the sender's name.
• Why we use it: to deliver messages, and to protect members from scams and abuse.

Contact us, emails to us, reports and appeals

• Contact us (signed in): your topic, your messages and our replies, linked to your account, with a case reference.
• Contact us (signed out): your name, email address, topic and message. To stop abuse we also keep a scrambled code made from your IP address and a scrambled fingerprint of the message to catch repeats.
• Emails to [email protected]: whatever you send us. These are forwarded by our domain provider to our business email account and kept there.
• Reports and appeals: who reported, what was reported, the reason, your explanation, a copy of the listing, account or conversation as it was when reported, and our decision. Staff notes are kept separately and aren't shown to members.
• Please don't send passwords, codes, card numbers or veterinary records.
• Why we use it: to answer you and to keep the marketplace safe.

Emails we send

• What: a record that we sent an email, when, and whether it was delivered. We don't keep a copy of the email's text. We also count emails sent each day to stay within our limits.
• Our emails come from a no-reply address.
• Why we use it: to deliver service emails reliably and avoid sending duplicates.

How the Service is used

• What: basic actions recorded in our own database, such as signing up, viewing or saving a listing, starting or publishing a listing, starting a conversation, sending a message, reporting, or tapping Call, Text or Email (only which button, never the number or address). Each is linked to a pseudonymous code, not your name or email. They never include your search text, messages, contact details, uploaded files, or anything you type. We also note when a page seems not to respond (for example repeated taps), with technical details only.
• We don't use Google Analytics, advertising pixels or session-recording tools.
• Why we use it: to understand what works and fix what doesn't.

Records of important actions

We keep a permanent record of important account, listing, billing and staff actions: who did it, what, to which record, and when. Staff can't edit or delete it. It's deleted only when its retention period ends (Section 6). We use it to keep the Service accountable and to resolve disputes.

The launch-list email

If you signed up on our coming-soon page to hear when we open, we keep only your email address and when, and to which wording, you agreed. That list is separate from member accounts. We use it to send one email when Barn2Buyer opens, then delete the list within 30 days. Our separate launch-list privacy notice, at barn2buyer.com/privacy/launch-list/, has the details.

What we don't do

We don't sell or share your personal information. We don't use it for advertising, we don't share it for advertising on other sites, and we don't build advertising profiles.

3. Who sees your information

Other members (signed in, with an active trial or paid membership) see:

• your published listings: horse or item details, photos, document page images, YouTube videos, price or price range, and the city and state, never the ZIP code;
• the listing contact details you choose to show: the contact's name and role and only the methods you enabled. A member who has seen a phone number or email can keep it; we can't take it back;
• in messages, you appear by first name and last initial (for example "Mary D."). Your email, phone number and account details aren't shown unless you type them. In-app messages go to the account holder who created the listing, who may not be the person shown as its contact.

Your account name and login email aren't shown to other members unless you choose them as a listing contact. Visitors who aren't members see no listings.

Barn2Buyer staff and owners. Authorized Barn2Buyer staff and owners see account, membership, billing and listing information and support requests, only as needed to run, secure and support the Service. Card details are held by our payment processor, Stripe, not by us. For messages:

• staff can't browse or search conversations;
• staff see only totals of automated warnings, never message text;
• a staff member may read a conversation only after one of its two members reports it, or under a legal hold or legal process. Every such view is recorded with the reason.

Technical access. The companies that host our website and database, and a small number of authorized people at Barn2Buyer, can technically reach stored data, including messages. That access is used only to operate, secure and support the Service, never to browse conversations.

Service providers (Section 4) handle data only to provide their service to us.

Legal requests. We disclose information, including messages, to authorities only when the law requires it, for example a valid subpoena or court order. We'll tell you before we do, unless we're legally prohibited from doing so.

Business changes. If Barn2Buyer is sold or merged, your information may move to the new owner, still covered by this policy.

4. Companies that help us run the Service

• Vercel hosts the website and app, in the United States.
• Supabase runs our database, in the eastern United States (North Virginia).
• Amazon Web Services (S3 and GuardDuty) stores photos and documents privately and scans uploads for malware, in the United States.
• Stripe handles payments, checkout and receipts. Stripe receives your card, billing address and email under its own privacy policy.
• Resend sends our emails. It receives your email address and the email content.
• Cloudflare runs our domain name, website security and network, and forwards emails sent to [email protected].
• Have I Been Pwned checks passwords against known breaches. It receives only the first five characters of a scrambled code made from your password, never the password or any account data.
• YouTube (Google) plays listing videos, only when you choose to. Videos use YouTube's privacy-enhanced player. Nothing loads from YouTube until you press play, and we tell you before it connects. After that, YouTube's own privacy policy applies.

5. Cookies and similar technology

We use only the cookies needed to sign you in and keep the Service secure. We use no advertising, analytics or tracking cookies.

• Sign-in cookie (__Host-b2b.session_token): keeps you signed in. It ends after 7 days without use, and after 30 days at most.
• Staff two-step cookie (__Host-b2b.two_factor): used only during staff two-step sign-in, for 5 minutes.
• Both are secure, can't be read by page scripts, are sent only to barn2buyer.com, and use SameSite=Lax.
• Security cookie: our security provider, Cloudflare, may set a short-lived cookie to tell people from automated traffic.
• The app also saves a small offline page on your device so it can show that you're offline. It never stores listings, messages or account data on your device.

Because these cookies are strictly necessary, we don't show a cookie banner.

6. How long we keep information

These are our retention rules. Where a period says "up to", it is our policy limit.

• Unfinished sign-ups never confirmed: 7 days.
• Conversations and messages: deleted 12 months after the last message, unless reported or under a legal hold.
• Automated message-warning records: 13 months.
• Usage records (how the Service is used): 13 months.
• Saved-search alerts and matches: 12 months.
• Email delivery records: 13 months.
• Scrambled IP codes on the launch-list form: about 2 hours.
• Launch-list addresses: deleted within 30 days after the launch email, or right away if you remove yours.
• Payment, receipt, refund and dispute records, renewal consents, and important financial or staff action records: up to 7 years.
• Sign-in and security logs: up to 2 years.
• Contact us requests, reports and appeals, including a reported conversation's evidence copy: up to 3 years after they close.
• Listing details and photos for sold, removed or expired listings: up to 12 months, so you can see and copy them, then deleted. We keep only minimal billing and action records.
• Rejected or quarantined uploads: up to 30 days.
• Your account, profile, listings, saved items and contacts: while your account is open; if you ask us to delete your account, see Section 8.
• Backups: we don't keep separate backup copies of the database at this time. If we start, we'll update this policy.
• Anything under a legal hold, or that the law requires us to keep: as long as that requirement lasts.

7. How we protect information

• Encrypted connections (HTTPS) everywhere.
• Passwords stored only in hashed form, at least 15 characters long, and checked against known breached passwords.
• Limits on repeated sign-in, sign-up and reset attempts.
• Staff accounts must use two-step sign-in, and need a fresh code for sensitive actions.
• Photos and documents are stored privately and shown only to signed-in members. Documents are malware-scanned before anyone else can see them.
• Every staff view of a reported conversation is recorded.
• Card details stay with Stripe.

No system is perfectly secure. If a breach affects your personal information, we'll notify you as required by law. A warning that your password appears in another company's breach is not a Barn2Buyer breach notice.

8. Your choices

Your account details. You can change your name in Your account, and your saved listing contacts in My listings.

Emails.

• Saved-search alerts: choose as they happen, daily or weekly, or stop them. Every alert email has a link to manage them.
• Price-drop alerts: one on/off switch on Saved horses (on by default).
• New-message emails: turn them off in your settings or from the link in the email.
• Service emails (security, billing, renewal reminders, account and listing notices) can't be turned off while you have an account, because they tell you about charges and your account's safety.
• Launch-list email: remove your address at barn2buyer.com/launch-notice/remove/ or by emailing us.

Blocking. You can block another member from messaging you.

Deleting your account. At launch there's no delete button. Email [email protected] and we'll do it by hand. When we start a deletion:

• you're signed out everywhere, lose access, and your listings come down straight away;
• your account is held for 30 days in case you change your mind; you can recover it during that time using your email;
• after 30 days we delete or anonymize your name and profile, listings and drafts with their photos and documents, saved horses and searches, and the contacts you added. Your messages are removed and show as "Message removed", and you show as "Former member" to the people you messaged;
• we keep only what we must: payment, receipt, refund and dispute records and your consents (up to 7 years); sign-in and security logs (up to 2 years); support requests, reports and appeals (up to 3 years after they close); a record that you asked us to delete and what we did; and anything under a legal hold. Only authorized people can see kept records.

Canceling your membership is different: your account stays and your listings come down, but nothing is deleted.

Getting a copy of your data. Email [email protected]. We'll send your profile, listings, saved horses and searches, contacts, billing history, consents, support requests, reports and appeals you made, and your own messages, but never other people's private details or staff-only notes.

Correcting information. Edit it yourself, or ask us.

How we handle requests. We answer within 30 days. To protect your account, we confirm a request by writing to the email address on your account and act only once it's confirmed from there.

9. Your rights as a U.S. resident

Whatever state you live in, you can ask us what personal information we hold about you, ask for a copy, ask us to correct it, and ask us to delete it. You can also opt out of the sale of your information or its use for targeted advertising, although we don't do either. We won't treat you differently for using these rights. Ask by emailing [email protected]. You may use an authorized agent. If we refuse a request, you may ask us to reconsider by replying to our answer.

10. Children

Barn2Buyer is for adults. You must be 18 or older to create an account, and you confirm it when you sign up. We don't knowingly collect information from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete its information. If you believe someone under 18 has an account, tell us at [email protected].

11. Where your information is stored

Barn2Buyer is for U.S. residents. Your information is stored in the United States.

12. Changes to this policy

We may update this policy. We'll post the new version with its date and, for a material change, email you before it applies. We won't use information we already hold for a materially new purpose without telling you first and, where required, asking you. We keep a record of the version you accepted.

13. Contact

Barn2Buyer Holdings, LLC, an Illinois limited liability company. Email: [email protected]. Mail: PO Box 112, Bloomington, IL 61701.