Privacy Policy

WAXED Industries, LLC ("WAXED," "we," "us") operates waxed.market, a marketplace where independent record dealers sell records, CDs and tapes to buyers. Our mailing address is 484 Harman Street, 1F, Brooklyn, NY 11237, United States; for data and privacy matters, write to info@waxed.market. This policy explains what personal data we collect, why, who we share it with, and what you can do about it.

Dealers who sell on WAXED are independent businesses. When you buy a record, the dealer receives the information they need to fulfil your order and is responsible for their own handling of it.

Account data. Your email address, and any name, username, avatar, bio, or location you add. If you sign in with Google or Apple, we receive your email and basic profile details from them — never your password.

Order and shipping data. Your shipping address, phone number where provided, what you bought, and the amount paid. Card numbers go directly to Stripe; WAXED never receives or stores them.

Content you create. Your collection, likes, listings, crates, wishlists, reviews, and messages you send to other users. If you connect Discogs, we import your Discogs collection and wishlist into WAXED; wishlists are not written back to Discogs.

Reports and blocks. If you report content or block someone, we keep the report (who made it, what was reported, the reason, and any details you add) and your list of blocked accounts. To review a report, our team reads the reported content, including the messages in a reported conversation.

Messages. Messages between users are stored so they can be delivered, and so we can investigate reports, disputes, and suspected fraud. WAXED staff do not read messages except for those purposes or where the law requires it.

Waitlist. If you join the waitlist for marketplace access, your email address and the date you joined, plus your store name if you give it and, if you joined from a record in the app, which record it was. We use it only to contact you about access to WAXED. You can ask to be removed at any time by emailing info@waxed.market.

Dealer data. If you sell on WAXED: your storefront details, inventory, payout information held by Stripe, and — only if you connect them — authorization to your Discogs or Square account.

Scan photos. If you use the scanner, a cropped image of the record you scanned, the match results, and image-quality measurements. See Camera and scan photos below.

Support conversations. Messages you send to the support assistant and its replies, and any support tickets you file. These are stored with your account so a person can follow up.

Technical data. Standard server logs including IP address, browser type, and pages requested, plus cookies necessary to keep you signed in.

To run your account and keep you signed in; to process orders, payments, shipping, and refunds; to show your storefront and listings to buyers; to deliver messages between buyers and dealers; to send transactional email such as order confirmations; to identify records you scan and to improve recognition and build condition and grading data; to answer support questions; to understand, in aggregate, which parts of WAXED are used; to prevent fraud and abuse; and to meet legal and tax obligations.

We do not sell your personal data, we do not use it for third-party advertising, and we do not track you across apps or websites owned by other companies.

Dealers. When you place an order, the dealer receives your name, shipping address, and order details so they can ship it.

Service providers. We use the following companies to operate WAXED. Each receives only what it needs for its stated purpose.

Supabase

Purpose: Account authentication, database, and file storage

Data involved: Email, name, profile and storefront details, listings, orders, messages, uploaded images

Stripe

Purpose: Payment processing and dealer payouts

Data involved: Name, email, billing and shipping address, payment amounts. Card details go directly to Stripe — WAXED never receives or stores them

Shippo

Purpose: Shipping rate quotes, labels, and tracking

Data involved: Buyer and dealer names, postal addresses, parcel details

Resend

Purpose: Transactional and dealer broadcast email

Data involved: Email address, name, and message content

Discogs

Purpose: Optional collection, wishlist, and dealer inventory sync

Data involved: Account authorization, your Discogs collection and wishlist, and dealer listing data. Connected only when you choose to link your account

Square

Purpose: Optional dealer point-of-sale inventory sync

Data involved: Dealer account authorization and listing/inventory data. Connected only when a dealer chooses to link their account

Shopify

Purpose: Optional dealer store inventory sync

Data involved: Dealer account authorization and listing/inventory data. Connected only when a dealer chooses to link their account

Cloudflare (R2 storage and CDN)

Purpose: Image storage, hosting, and content delivery

Data involved: Uploaded images, including scan photos, and standard request metadata such as IP address

OpenAI

Purpose: Scan recognition assist, and the support assistant

Data involved: Cropped scan images sent to help read and verify a record (not used for model training), and the text of support chat messages

Moonshot AI

Purpose: Support assistant, and the AI assistant in the dealer dashboard

Data involved: The text of chat messages and the conversation so far. For dealers using the dashboard assistant, also their store and inventory details and any files they attach

TypeSafe

Purpose: Scan recognition decisions

Data involved: Text read from a scanned record and the candidate catalog matches. Not the photo itself

Apple Music / Spotify / YouTube

Purpose: Music playback and listening links

Data involved: Your authorization with Apple Music or Spotify, only if you connect it. Playing a YouTube video loads YouTube’s player, which receives standard request data such as your IP address

Google Sign-In / Sign in with Apple

Purpose: Signing in

Data involved: Your email address and basic profile details from the provider you choose. Never your password

PostHog

Purpose: Product analytics, only where enabled

Data involved: A limited set of named product events (such as which area of the app was used) tied to your account ID. No session replay, autocapture, or page content

Google Places / Mapbox

Purpose: Address autocomplete and maps

Data involved: Partial address text entered into address fields

Render

Purpose: Application hosting

Data involved: Standard server request logs, including IP address

Notion

Purpose: Internal team workspace

Data involved: Waitlist sign-ups: email address, sign-up date, and store name if given

Each provider is bound by contract or by its terms of service to protect your data at least as carefully as this policy does, and to use it only for the purpose we share it for.

We may also disclose data where required by law, or to protect the rights and safety of our users. If WAXED is involved in a merger or acquisition, data may transfer as part of that transaction; we will give notice before it becomes subject to a different policy.

The WAXED app uses your camera only when you open the scanner. When you scan a record we keep a cropped image of the cover, label, or barcode you pointed it at, together with the match results (which records it was compared with and which, if any, it identified) and image-quality measurements such as sharpness and framing. Frames that are not part of a scan are not kept.

We store scan photos in Cloudflare R2, linked to your account. We use them to identify the record for you, to improve recognition over time, and to build WAXED's own proprietary record-condition and grading data. To help read a record, a cropped scan image may be sent to OpenAI, and the text read from it may be sent to TypeSafe; see the table above. OpenAI does not use this data to train its models and may keep it for up to 30 days for abuse monitoring.

Scan photos are kept indefinitely. They stay linked to your account while it exists. If you delete your account, your scan photos are de-identified — the link to you is removed — and may be kept in that form to continue improving recognition and grading. Our Terms of Service set out the same terms. Please point the scanner only at records, not at people or documents.

Using scan photos to improve recognition and build grading data is on by default. You can turn it off at any time in the WAXED app: open the menu, then Account & listening, and switch off "Help improve recognition and grading". While it is off, new scans are used only to identify the record for you; their photos are not kept or added to our grading data. Scans made while it was on are kept as described above.

The support chat is answered by an automated assistant. Your messages are sent to Moonshot AI, with OpenAI as a fallback, to generate replies. The conversation is stored with your account so that if you ask for a person, the team can see what was said. If you file a ticket, the conversation and any note you add are emailed to the WAXED team. The assistant cannot see your account, orders, or payments.

WAXED publishes a public catalog API and an MCP server so AI assistants can search records, look up pricing, and browse storefronts. Those public tools expose catalog and listing information only — never buyer personal data.

A dealer may connect an AI assistant to their own WAXED account, using either an agent key or OAuth. An assistant connected this way acts on that dealer's behalf and can reach the same account data the dealer can, including their orders and buyer messages. Dealers can revoke that access at any time in Settings. No tool available over the MCP server can take a payment, issue a refund, or move money.

We keep account data while your account is open. Scan photos are kept indefinitely, as described above. Support conversations are kept with your account.

Order and transaction records are kept longer where we are legally required to — typically seven years for tax and accounting purposes — even after an account is closed.

Reports and moderation records, including the reported content, are kept for up to three years after a report is resolved, and longer where needed to enforce a ban. Your block list is deleted with your account.

You can delete your account in Settings on the web or in the app. When you do, your profile and active listings are removed from public view immediately. After a 30-day grace period, during which signing back in restores the account, the account and your personal data are permanently deleted: your sign-in, profile, collection, crates, wishlists, listings, messages, support conversations, and connected-service authorizations.

Two exceptions: scan photos are de-identified rather than deleted, as described above, and order and transaction records are kept where the law requires it — typically seven years for tax and accounting purposes — even after the account is gone. If you signed in with Apple, we also revoke WAXED's access with Apple.

You can access and correct most of your data directly in Settings, and delete your account at any time. Depending on where you live — including the EEA and UK under GDPR, and California under the CCPA — you may also have the right to request a copy of your data, ask us to delete it, object to certain processing, or lodge a complaint with your local data protection authority. We do not sell personal data or share it for cross-context behavioural advertising. You can also turn off the use of your scan photos for recognition and grading data in the app, as described in Camera and scan photos.

To make a request, email info@waxed.market. We may need to verify your identity before acting.

Data is encrypted in transit. Access to production systems is restricted, dealer integration tokens are stored encrypted, and payment credentials never touch our servers. No system is perfectly secure, and we cannot guarantee absolute security.

WAXED and most of its service providers operate in the United States. Support and assistant chat messages may be processed by Moonshot AI outside the United States. If you use WAXED from outside the US, your data will be transferred to and processed in the US and, for those chats, where Moonshot AI operates.

WAXED is not intended for children under 13, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

We will update the date at the top of this page when this policy changes, and give notice of material changes by email or in the app.

Questions about this policy or your data: info@waxed.market. See also our Terms of Service.