Definitions and Key Terms

To help explain this Privacy Policy clearly, the following terms are defined:

• AceDrop: AceDrop Inc., a Delaware corporation, the legal entity that owns and operates the Taara brand and marketplace.
• Buyer: A user who purchases or offers to purchase goods or services listed on Taara.
• Seller: A user who lists, offers, or sells goods or services on Taara, including users onboarded as payout recipients through Stripe Connect.
• Company / we / us / our: Taara, operated by AceDrop, responsible for your information under this Privacy Policy.
• Cookie: A small amount of data saved by your web browser used to identify your browser, provide analytics, and remember information such as language preference or login state.
• Device: Any internet-connected device such as a phone, tablet, or computer used to access Taara.
• IP address: A number assigned to devices connected to the Internet, often used to estimate the general geographic location of the device.
• Listing: Any post created by a Seller, including items, vehicles, real estate/houses, events, services, and establishments.
• Personal Data: Information that directly or indirectly allows for the identification of a natural person.
• Personnel: Individuals employed or contracted by AceDrop to perform services.
• Service: The Taara marketplace and all related features described in this policy and our Terms & Conditions.
• Service Provider / Third-party service: A third party that processes data on our behalf or whose services we integrate (e.g., payment, shipping, messaging, analytics, and advertising providers).
• You: A person or entity registered with, or using, Taara.

Information We Collect

Information You Provide Directly

• Account & profile information: name or username, email address, phone number, password (stored in hashed form by our authentication provider), profile photo, and location/city.
• Identity verification information: information you submit to verify your identity as a buyer or seller, which may be processed by our payment and verification partners.
• Listing content: photos, descriptions, prices, categories, and attributes for items, vehicles, houses, events, services, and establishments you post.
• Transaction information: orders, purchases, sales, shipping and billing addresses, order status, tracking numbers, returns, disputes, and refund requests.
• Seller payout information: bank/payout details collected and processed by Stripe when you onboard as a Seller through Stripe Connect. We do not store your full financial account credentials.
• Communications: messages exchanged between buyers and sellers through our in-app chat, and communications with our support team.
• Support & dispute information: the reason for a return or dispute, photo evidence, tracking details, message history, and related documentation you provide.

Information Collected Automatically

• Device & usage information: device type, operating system, app version, unique device and installation identifiers, IP address, crash and diagnostic data, and interactions with screens and features.
• Analytics events: screen views and in-app actions (for example, viewing a product, initiating checkout, or messaging a seller) collected through Firebase Analytics.
• Attribution & deep-link data: information about how you arrived at the app or a listing, collected through our attribution and deep-linking providers (Branch and Firebase Dynamic Links).
• Advertising identifiers: mobile advertising identifiers and related data used to serve and measure ads, subject to your device permissions and consent.

Optional Device Permissions

With your permission, we access the following. You can grant or revoke these in your device settings at any time:

• Location (GPS / coarse and fine): to show nearby listings, power our proximity-based local feed, estimate shipping, and provide relevant results and ads.
• Camera: to let you take and upload photos for listings, profiles, and return/dispute evidence.
• Photo library / storage: to let you upload existing images.
• Notifications: to send you push notifications about orders, messages, disputes, and account activity.

How We Use the Information We Collect

We use the information we collect to:

• Create and manage your account and authenticate you securely.
• Operate the marketplace — publish listings, run search and the local/proximity feed, and connect buyers and sellers.
• Process payments, hold funds through our payment processor where applicable, calculate fees, and disburse seller payouts through Stripe.
• Generate shipping labels, rates, and tracking through our shipping provider (EasyPost).
• Enable in-app messaging between buyers and sellers.
• Process returns, refunds, disputes, and cancellations, including calculating restocking, processing, and shipping-fee allocations.
• Provide sellers with analytics and insights about their own sales (for example, weekly revenue trends, order counts, and aggregate customer insights derived from their own orders).
• Manage subscriptions and premium features purchased through the Apple App Store or Google Play.
• Send transactional messages (order updates, dispute notices, security alerts) and, where permitted, promotional communications.
• Personalize your experience, including ranking and recommending listings and serving relevant advertising.
• Detect, investigate, and prevent fraud, abuse, prohibited listings, and violations of our Terms.
• Improve, troubleshoot, and secure the service, including crash reporting and diagnostics.
• Comply with legal obligations and enforce our agreements.

Automated Processing, Personalization & Artificial Intelligence

Taara uses automated systems to operate the marketplace. These include:

• Ranking and personalization of the listings feed and search results based on factors such as your location/proximity, recency, category, and activity.
• Advertising personalization and remarketing as described in the "Advertising & Cookies" section.
• Automated fee and refund calculations that determine restocking fees, payment-processing fees, and refund amounts based on the return reason you and the seller select.
• Fraud, risk, and content screening to help identify prohibited items, suspicious transactions, and policy violations.

Taara does not currently use generative artificial intelligence to make legally or financially significant decisions about you without the ability for human review. Where an automated outcome (such as a dispute resolution or account restriction) materially affects you, you may contact us to request human review. If we introduce new AI-powered features in the future — such as automated content generation, moderation, or recommendations that rely on machine-learning models — we will update this Privacy Policy and, where required by law, notify you and obtain any necessary consent before those features process your personal data.

How We Share Information

We share personal information only as described below. We do not sell your personal information for money.

• With other users: A Seller's public listing information and profile are visible to buyers. To complete a transaction, we share the information necessary to fulfill and ship an order (for example, a shipping name and address with the seller, or seller contact details with the buyer). Messages you send are visible to the user you message.
• Payment processing: We share transaction and payout information with Stripe to process payments, run identity/KYC checks, hold funds pending delivery, and pay sellers. Stripe processes this data under its own privacy policy.
• Shipping: We share shipping addresses and package details with EasyPost and the applicable carriers to generate labels, rates, and tracking.
• Messaging: In-app chat is provided through Stream Chat, which processes message content and metadata on our behalf.
• App stores: Subscription purchases are processed by Apple and Google through their in-app purchase systems; we receive purchase and renewal status but not your full payment details.
• Analytics, crash reporting & attribution: We share usage and diagnostic data with Google Firebase (Analytics, Crashlytics, Cloud Messaging) and attribution data with Branch.
• Advertising: We work with Google AdMob and advertising partners to serve and measure ads, including interest-based advertising and remarketing.
• Affiliate programs: Some links in the app may be affiliate links (for example, the Amazon Associates Program). See our Disclaimer for details.
• Service providers: We engage trusted providers for hosting, database, infrastructure, email delivery, customer support, and fraud prevention who process data on our behalf under contract.
• Legal & safety: We may disclose information to law enforcement, regulators, or private parties when reasonably necessary to comply with law or legal process, enforce our terms, prevent fraud or harm, or protect the rights, property, or safety of Taara, our users, or the public.
• Business transfers: If AceDrop is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to this Privacy Policy.

Where Information Is Stored and Processed

Taara is operated from the United States. Your information is stored using Google Firebase (Authentication, Cloud Firestore, and Cloud Storage) and a managed relational (MySQL) database accessed through secure cloud functions, along with the third-party processors listed above. Information may be transferred to, stored in, and processed in the United States and other countries where we or our service providers operate. By using Taara, you consent to such transfer to the extent permitted by applicable law.

Data Retention

We retain your information for as long as your account is active and as needed to provide the service, comply with our legal obligations (including tax, accounting, and transaction records), resolve disputes, prevent fraud, and enforce our agreements. When information is no longer needed and we have no legal obligation to retain it, we delete or de-identify it. Certain records within backups may persist for a limited period until those backups are cycled out. Where required by GDPR, personal data associated with a deleted account is disposed of within 60 days, subject to legal retention requirements.

Information Security

We use administrative, technical, and physical safeguards designed to protect your information, including TLS/SSL encryption in transit, encrypted storage, and access controls that limit access to authorized personnel. Payment card data is handled by Stripe and is not stored on Taara's servers. Our internal administrative tools restrict access to user and listing data to authorized administrators only. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Privacy Rights and Choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information (you can edit much of your profile directly in the app).
• Delete your account and associated personal data.
• Object to or restrict certain processing.
• Data portability — receive a copy of certain information.
• Opt out of promotional emails (use the unsubscribe link) and interest-based advertising (see below).
• Withdraw consent for optional device permissions in your device settings.

To exercise these rights, use Settings → Help & Support in the app or contact us at [email protected]. We may need to verify your identity before acting on a request. We will not discriminate against you for exercising your rights.

Advertising & Cookies

Our app and website may display advertising through Google AdMob and third-party advertising partners, and our website may use cookies and similar technologies.

• Interest-based advertising & remarketing: We and our partners may use advertising identifiers and cookies to deliver ads relevant to your interests, limit repetitive ads, and measure ad performance, including remarketing to people who have previously used Taara.
• Analytics cookies: Our website uses cookies to recognize returning visitors and improve performance and functionality. We do not place personally identifiable information in cookies.
• Your controls: On mobile, you can reset or limit ad tracking through your device's advertising settings. On the web, you can block or delete cookies through your browser settings, though some features may not function properly as a result.

Consent Management

Where required (for example, under the EEA/UK and for Google's consent requirements), we provide controls to manage consent for analytics storage and advertising storage. Your choices are applied to how we and Google process this data.

Email and Communications

By creating an account, you agree to receive transactional communications necessary to operate your account and orders. With your consent where required, we may also send promotional messages; you can unsubscribe from promotional emails at any time using the link provided. Order- and dispute-related messages are used solely to keep you informed about your activity.

GDPR (European Economic Area, UK)

If you are located in the EEA or UK, we process your personal data in accordance with the General Data Protection Regulation and applicable UK data protection law.

• Legal bases: We rely on (i) performance of a contract (to provide the marketplace and process your transactions), (ii) legitimate interests (to secure, improve, and market the service), (iii) consent (for optional permissions, cookies, and certain advertising), and (iv) legal obligation (for tax, accounting, and compliance).
• Your rights: access, rectification, erasure, restriction, objection, portability, and the right to lodge a complaint with your local supervisory authority.
• Retention: We store personal data no longer than necessary for the purposes described, and dispose of data associated with a deleted account within 60 days unless a longer retention period is legally required.

To exercise these rights, contact [email protected].

California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know / Access: request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it.
• Delete: request deletion of your personal information, subject to legal exceptions.
• Correct: request correction of inaccurate personal information.
• Opt out of "sale" or "sharing": We do not sell personal information for money. To the extent that the use of advertising identifiers and cookies for cross-context behavioral advertising is considered "sharing" under California law, you may opt out through your device advertising settings, your browser cookie controls, or by contacting us.
• Non-discrimination: We will not discriminate against you for exercising these rights.

To exercise these rights, contact [email protected]. We will respond within the timeframes required by law.

Children's Privacy

Taara is a marketplace for adults and is not directed to children. You must be at least 18 years old to create an account or use the service. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it. If you believe a minor has provided us with personal information, contact [email protected].

Links to Other Websites and Third-Party Services

Our service may contain links to, or integrate, third-party websites and services (including advertisements, affiliate links, and payment, shipping, and messaging providers) that we do not operate or control. This Privacy Policy does not apply to those third parties, and we are not responsible for their content or practices. Review their privacy policies before providing information.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our service, technologies, or legal requirements. If we make material changes, we will notify you through the app, by email, or by updating the "Last Updated" date above, and, where required by law, obtain your consent. Your continued use of the service after changes take effect constitutes acceptance of the updated policy.

Contact Us

If you have questions or requests regarding this Privacy Policy or your personal information, contact us:

• Email: [email protected]
• In-App: Settings → Help & Support

Taara is operated by AceDrop Inc., a Delaware corporation.