Privacy policy

Who we are

bid4buy.com (“bid4buy”, “we”) is an independent catalogue of vehicle auctions in Thailand. Questions about your data: [email protected] or WhatsApp +66 63 66 77 900.

What we process when you browse

• Technical request data — IP address, browser, requested address and time — to deliver pages, protect the site from abuse and fix errors. It is kept only as long as needed for these purposes.
• The site is delivered through Cloudflare, which processes the same request data on our behalf.
• No visitor analytics of our own: we run no statistics tools or advertising pixels, only Cloudflare’s aggregate traffic figures (see “Visitor statistics”).

What stays in your browser

• Before you sign in, your watchlist — the ids of the lots you tap the heart on — lives in your browser’s local storage and never leaves your device.
• When you sign in we add that list to your account and clear it from the browser; when you sign out we clear it again.
• The cookies described below. We use no advertising or cross-site tracking cookies.

Your account data

An account is optional. If you create one, this is everything it holds:

• Your e-mail address. It identifies the account and receives sign-in codes, account e-mails and alerts.
• A display name and a phone number, only if you enter them. We don’t send text messages.
• Your interface language (English, Thai or Russian). The site and every e-mail we send you follow it.
• From the welcome screen, which you can skip: what kind of buyer you are (private buyer, dealer, business or fleet, other) and what you are looking for (cars, pickups, vans, trucks, motorbikes, machinery).
• Your consents — these terms, this policy and the separate consent to marketing e-mail — each with the date and the version of the document you agreed to.
• Your plan (Free, Pro or Dealer) and its history: when it started, when it ends, who granted it and our internal note.
• Your watchlist and your alert settings.
• Daily counters of how many lots and CSV files the account opened, used only to apply the limits of your plan.
• When the account was created and when it was last used.

How you sign in

• By e-mail we send a six-digit code and a one-time link, both valid for 15 minutes. We store the code only as a one-way hash, next to the address, the language, the IP address of the request and the number of attempts.
• A password is optional. If you set one, we store only an argon2id hash of it — never the password itself, and never in a log, a backup or an e-mail — together with the day it was set and the day it last changed. Nobody at bid4buy can read it, and failed attempts are counted per account and IP address so that it cannot be guessed.
• With Google, Facebook or LINE we receive, only when you press that button, the account id the provider gives us, the name and the e-mail address it returns. We never store the provider’s access tokens, and we never post anything anywhere.
• We keep which methods are connected to your account, when they were added and when each was last used, so you can see and disconnect them.

Sessions, devices and the security log

• A session keeps you signed in. We store only the SHA-256 hash of the cookie value — never the value itself — with the sign-in method, the start, the last use, the IP address and the browser string, so the account page can show your devices and sign them out.
• At most ten devices are signed in at once; an eleventh sign-in ends the one used least recently.
• The security log records sign-ins and failed attempts, codes sent and blocked, methods connected and disconnected, sessions ended, e-mail changes, blocks, deletions and plan changes, with the time and the method.
• IP addresses and browser strings, in sessions and in the log, are erased after 90 days. In log entries that belong to no account the address is kept only as a one-way code, never as text.

Watchlist and alerts

• Your watchlist holds the ids of the lots you watch and the date you added them.
• If alerts are on, we e-mail you when a watched lot changes: a new auction date, a new start time, a lane and time announced for a pre-list vehicle, a lot withdrawn, or the same vehicle listed again in another auction. Alerts go by e-mail only.
• We record which change we sent you and when, so that the same change is never sent twice.
• Every alert e-mail carries an unsubscribe link and a List-Unsubscribe header, so your mail program can unsubscribe you in one click. The account page has the same switch and the choice of one summary a day.

Cookies

We set only the cookies the site needs to work. None of them follow you around the web.

• b4_session — keeps you signed in for 90 days, extended while you use the site. It holds a random token, nothing about you.
• b4_lang — the language you chose, for one year, so we don’t suggest another language again.
• b4_preview — before the public launch it lets a tester see the account features, for 30 days.
• b4_email_flow — ties the code form to the device that asked for the code, for 15 minutes.
• b4_oauth — carries the security values of one sign-in with Google, Facebook or LINE, for 10 minutes.
• b4_pending_identity — holds a sign-in method waiting for you to confirm your address, for 15 minutes.

Who processes data with us

• Resend — delivers our e-mails (sign-in codes, account e-mails, alerts). It receives the recipient address and the message, and processes them outside Thailand, in the European Union and the United States.
• Google, Facebook and LINE — only if you choose that sign-in. They learn that you signed in to bid4buy and return your id, name and address to us.
• Cloudflare — delivers the site and the photos worldwide.
• Hetzner Online GmbH — our servers and the photo storage, in Germany.
• OpenAI — machine-translates catalogue texts only. No visitor or account data is sent there.

How long we keep it

• Sign-in codes and links expire after 15 minutes; their rows are deleted at the latest 48 hours after that.
• Sessions that ended — signed out or expired — are deleted 30 days later.
• IP addresses and browser strings are erased after 90 days, in sessions and in the security log.
• Daily counters are kept for 7 days.
• Everything else stays while the account exists. After you delete it, the data is erased 30 days later; see “How to delete your data”.

When you contact us

If you write to us by e-mail or WhatsApp we receive what you send (for example your name, number and message) and use it only to answer you.

Vehicle data

Lots come from the public catalogues of the auction houses listed on bid4buy — at present AUCT, Carro and SIA. We don’t publish seller names, licence plate numbers as text or engine numbers. Photos are shown as the auction houses publish them. If a listing shows your personal data, write to us and we will remove it.

Catalogue texts are machine-translated with OpenAI; no visitor or account data is sent for this.

Where the data is

Our servers and the photo storage are run by Hetzner Online GmbH in Germany; Cloudflare delivers the site worldwide; our e-mail goes out through Resend. We don’t sell personal data and we don’t share it with advertisers.

Your rights

• Access and a copy: the account page exports everything the account holds as one JSON file — profile, sign-in methods, consents, devices, watchlist, plans with their history and your security log.
• Correction: change your name, phone, language, buyer type and interests on the account page, and your e-mail address with a code sent to the new one. For anything else, write to us.
• Deletion: see the next section.
• Withdraw consent: switch marketing e-mail off on the account page at any time, and alerts with it. Withdrawing does not affect what we sent before.
• Object or ask us to restrict processing: write to [email protected].
• Complain: you can lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) in Thailand, which supervises us under the Personal Data Protection Act.

How to delete your data

You can delete your account and everything in it yourself, at any time, without asking us:

• Sign in and open the Account page at bid4buy.com/account.
• Choose “Delete account”.
• Confirm: the form asks you to type DELETE, and for a fresh sign-in — if you signed in more than 15 minutes ago, we send a code to your address first.
• You are signed out of every device at once, the account stops working and its sign-in methods — including the connection to Google, Facebook or LINE — are removed. Your e-mail address is free to register again straight away.
• Thirty days later everything the account held is erased: profile, sign-in methods, sessions, consents, watchlist, plans and counters. The security log keeps only the dates the account was created and deleted, with nothing that points to you.
• If you cannot sign in, or you would rather we did it, write to [email protected] from the address of the account (or WhatsApp +66 63 66 77 900) and we delete it for you.
• To remove only one sign-in method and keep the account, use “Sign-in methods” on the account page instead.

Age

An account is for people aged 18 or over. We don’t knowingly collect data about children; if you believe we hold any, write to us and we will delete it.

Changes

We update this policy before a new feature goes live and change the date at the top. The version you agreed to is stored with your consent and shown on the account page. This is a draft until our legal review is finished; the operator’s details and the governing law will be added then.