Privacy Policy

WAXED operates waxed.market, a marketplace where independent record dealers sell vinyl to buyers. This policy explains what personal data we collect, why, who we share it with, and what you can do about it.

Dealers who sell on WAXED are independent businesses. When you buy a record, the dealer receives the information they need to fulfil your order and is responsible for their own handling of it.

Account data. Your email address, and any name, username, avatar, bio, or location you add. If you sign in with Google or Apple, we receive your email and basic profile details from them — never your password.

Order and shipping data. Your shipping address, phone number where provided, what you bought, and the amount paid. Card numbers go directly to Stripe; WAXED never receives or stores them.

Content you create. Listings, crates, wishlists, reviews, and messages you send to other users.

Dealer data. If you sell on WAXED: your storefront details, inventory, payout information held by Stripe, and — only if you connect them — authorization to your Discogs or Square account.

Technical data. Standard server logs including IP address, browser type, and pages requested, plus cookies necessary to keep you signed in.

To run your account and keep you signed in; to process orders, payments, shipping, and refunds; to show your storefront and listings to buyers; to deliver messages between buyers and dealers; to send transactional email such as order confirmations; to prevent fraud and abuse; and to meet legal and tax obligations.

We do not sell your personal data, and we do not use it for third-party advertising.

Dealers. When you place an order, the dealer receives your name, shipping address, and order details so they can ship it.

Service providers. We use the following companies to operate WAXED. Each receives only what it needs for its stated purpose.

We may also disclose data where required by law, or to protect the rights and safety of our users. If WAXED is involved in a merger or acquisition, data may transfer as part of that transaction; we will give notice before it becomes subject to a different policy.

WAXED publishes a public catalog API and an MCP server so AI assistants can search records, look up pricing, and browse storefronts. Those public tools expose catalog and listing information only — never buyer personal data.

A dealer may connect an AI assistant to their own WAXED account, using either an agent key or OAuth. An assistant connected this way acts on that dealer's behalf and can reach the same account data the dealer can, including their orders and buyer messages. Dealers can revoke that access at any time in Settings. No tool available over the MCP server can take a payment, issue a refund, or move money.

We keep account data while your account is open. If you delete your account, your profile and listings are removed from public view immediately and permanently deleted after a 30-day grace period, during which you can restore the account.

Order and transaction records are kept longer where we are legally required to — typically seven years for tax and accounting purposes — even after an account is closed.

You can access and correct most of your data directly in Settings, and delete your account at any time. Depending on where you live — including the EEA and UK under GDPR, and California under the CCPA — you may also have the right to request a copy of your data, ask us to delete it, object to certain processing, or lodge a complaint with your local data protection authority. We do not sell personal data or share it for cross-context behavioural advertising.

To make a request, email privacy@waxed.market. We may need to verify your identity before acting.

Data is encrypted in transit. Access to production systems is restricted, dealer integration tokens are stored encrypted, and payment credentials never touch our servers. No system is perfectly secure, and we cannot guarantee absolute security.

WAXED and its service providers operate primarily in the United States. If you use WAXED from outside the US, your data will be transferred to and processed there.

WAXED is not intended for children under 13, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

We will update the date at the top of this page when this policy changes, and give notice of material changes by email or in the app.

Questions about this policy or your data: privacy@waxed.market.