Privacy Notice

What Personal Information About Customers Does GoodGet Collect?

We collect your personal information so we can run the live rooms, take your orders, and keep improving the GoodGet Services. It reaches us in three ways.

Information You Give Us: We receive and keep what you type, say, or submit while using the GoodGet Services: the phone number you enter to join the waitlist or sign in, the verified identity, available verified email address or phone number, and display name returned by your sign-in provider, the display name you use in a room, the messages and bids you send, the shipping address you type at checkout, and the card you save through our payment processor. You can choose not to give us some of this, but then some features, such as checkout, will not work. See Examples of Information Collected for a fuller list.

Automatic Information: Every browser sends technical details with each request, such as your IP address, browser type, and the page requested, so our servers and hosting provider receive them. Our hosting provider records requests under its own policies. For signed-in shoppers, our database records a stable account identifier, login sessions, login and logout times, product views and viewing duration, searches, saved products and categories, messages, bids, cart actions, and room controls. Payment records are associated with that account. Your browser also keeps room state and pending activity uploads as described in What About Cookies and Other Identifiers?.

Information from Other Sources: We receive limited information about you from the providers that act for us: our payment processor tells us the brand, last four digits, expiration date, and cardholder name of a card you saved and whether a charge succeeded; a mapping provider returns complete street addresses that match text you typed; and your browser's speech service returns the words it recognized while you held the talk button.

For What Purposes Does GoodGet Use Your Personal Information?

We use your personal information to run and improve the GoodGet Services. The purposes are:

Purchase and delivery of products and services. We use your information to take bids, record auction wins, process the payment you authorize at checkout, and keep a record of each order. Shipping details collected by Stripe are attached to the verified order record. [FULFILMENT: describe delivery, and the partners who receive an address, once shipping is built.]

Provide, troubleshoot, and improve GoodGet Services. We use your information to keep rooms running, find and fix problems, and make the GoodGet Services work better. We record first-party account activity in our database to understand product use and diagnose problems.

Recommendations and personalization. We remember preferences in your browser and store signed-in product views, viewing duration, searches, saves, messages, and shopping actions against your account. This history supports product recommendations and personalization; a recommendation service is not enabled by collecting it alone.

Provide voice, image and camera services. When you hold the talk button, your browser's own speech-recognition feature turns your voice into text. Where the browser supports it, that happens on your device; otherwise your browser sends the audio to its speech service. GoodGet never receives your audio, only the text, which we treat like a typed message. We do not offer image or camera features.

Comply with legal obligations. In some cases we collect and keep information to meet legal requirements, such as keeping payment and order records for as long as tax and accounting rules require.

Communicate with you. We use your information to talk with you through the GoodGet Services: the presenter answers your messages in the room, and the checkout shows you the outcome of an order. When you place an order, we generate an internal notification for our team that includes your display name, your recent messages in the room, the bids, the products, the amounts, and the payment reference; it is emailed to a GoodGet mailbox, not to you. We retain the verified email address from sign-in for account and transactional communication. This change does not enroll you in marketing or send you an email receipt. We keep the phone number you give the waitlist so we can tell you about the launch and about deals. When you request phone sign-in, Google Firebase sends a verification text. This does not subscribe you to marketing texts. We do not send marketing text messages today.

Advertising. We use your information to show you products and deals inside the GoodGet Services. We do not use your personal information for interest-based advertising, and we do not run third-party advertising on the site. See What About Advertising?.

Fraud Prevention and Credit Risks. We use payment and order information to prevent and detect fraud and abuse: our payment processor screens each charge under its own rules, and we reject order requests that replay or alter an earlier one. We do not evaluate your creditworthiness.

What About Cookies and Other Identifiers?

We use authentication and payment cookies and your browser's storage to run the room. Signed-in room activity is also sent to our database. We do not use advertising cookies or third-party advertising trackers. These include:

• An encrypted, server-readable shopper-session cookie that identifies a recorded login session for up to eight hours; logging out revokes that session in our database. A payment session cookie, named payment-wallet-session, that our server sets after you save a card or pay with Apple Pay. It holds a signed reference to your record at our payment processor. For signed-in shoppers, the database binds that payment record to your account, so another browser can recover it after sign-in. Orders require a separate payment action. It is readable by our server only, not by scripts in the page, and it lasts up to one year.
• Session storage, which your browser clears when you close the tab: a random viewer identifier, your display name, the shipping addresses you entered at checkout, and short-lived markers that return you to the room after checkout.
• Local storage, which stays until you clear it: the state of the room in your browser, including your messages, bids, hearts, cart, and wins; the product categories you recently searched or saved; pending activity records that retry until our server acknowledges them; a flag that you have seen the swipe tip; and a lease that keeps the demo crowd running in only one tab.
• A browser channel that keeps open tabs of the same room in step with each other. It never leaves your device.
• If you used an earlier version of the site, we move entries from older storage names to the current ones and delete the old copies.

Because the GoodGet Services have no accounts, these identifiers are the only way we recognize a returning browser. Clearing your browser's cookies and site storage removes them; What Choices Do I Have? explains the effects.

Does GoodGet Share Your Personal Information?

We do not sell your personal information. We share it only as described here.

Transactions involving Third Parties: The GoodGet Services do not include third-party sellers or a marketplace today, so we do not pass your information to other sellers. We do not hand your information to a fulfilment or delivery partner today, and fulfilment integrations remain to be implemented.

Third-Party Service Providers: We rely on other companies to run parts of the GoodGet Services. They receive only the information needed for their job and may not use it for anything else:

• AWS hosts the website and stores account profiles, verified contact information, sessions, activity history, waitlist entries, payment references, and order records.
• Stripe collects and stores your card details, billing address, and name on its own pages, records your consent to save a card, screens payments, charges a payment you authorize at checkout, and processes Apple Pay. Card numbers never enter our systems.
• LiveKit Cloud carries the presenter's live video and audio to your browser and your messages to our presenter agent. Your browser connects to LiveKit directly, so LiveKit sees your IP address.
• OpenAI powers the presenter's understanding and speech. While a presenter is live, it receives your display name, your messages (typed or dictated), and the name of the leading bidder so the presenter can respond.
• Anam and LemonSlice render the presenter's face and voice from the presenter's speech. They do not receive your messages or audio, although the presenter may say your display name aloud.
• Google Firebase handles Google and phone sign-in. It receives the identity information needed to authenticate you. Phone numbers provided for authentication are sent to and stored by Google to prevent spam and abuse across Google services. Firebase reCAPTCHA checks help prevent automated sign-in abuse. We receive a verified user identifier and basic profile information; we do not receive access to your Gmail mailbox.
• Google's Places service receives the street address text you type at checkout, with a short-lived session token, and returns matching addresses. Our key for that service stays on our server.
• AWS's email service delivers our internal order notifications.
• Vercel hosts a legacy copy of the site while we finish moving to AWS, and processes any request sent to that copy.

Business Transfers: If GoodGet or substantially all of its assets are acquired, or if we merge or reorganize, customer information is one of the assets that would transfer. The acquirer would take on the commitments in this notice unless you agree otherwise.

Protection of GoodGet and Others: We release information when we believe doing so is appropriate to comply with the law, to enforce our Conditions of Use and other agreements, or to protect the rights, property, or safety of GoodGet, our users, or others, including sharing with our payment processor to detect and prevent fraud. This never includes selling or renting personal information for commercial purposes in violation of this notice.

How Secure Is Information About Me?

We design the GoodGet Services with your security in mind:

• goodgetlive.com is served over HTTPS, so traffic between your browser and our servers is encrypted.
• Card numbers are entered on pages hosted by Stripe or through Apple Pay, and only Stripe holds them. Our systems keep a reference to your Stripe record and show you the brand, last four digits, expiration date, and cardholder name that Stripe sends back.
• The payment session cookie is signed with a secret so it cannot be forged, and it is readable by our server only.
• Keys for the services we use stay on our servers and are never sent to your browser.
• Each order request carries a fingerprint that lets us reject replayed or altered requests.

No system is perfectly secure. Use a private device for checkout, and clear the browser's cookies and site storage when you leave a shared one.

What About Advertising?

Third-Party Advertisers and Links to Other Websites: The GoodGet Services may link to other websites, such as Stripe's pages during checkout. Those sites have their own privacy practices, which we do not control. GoodGet does not carry third-party advertisements.

Use of Third-Party Advertising Services: We do not use third-party advertising services, ad networks, or tracking pixels, and no advertising software loads when you use the GoodGet Services. If that changes, we will update this notice and give you the choices the law requires before it starts.

What Information Can I Access in My Account?

GoodGet supports accounts through Google and phone sign-in. Our database stores the verified identity and contact information provided at sign-in. What you can see within the GoodGet Services:

• Checkout shows the card you saved (brand, last four digits, expiration date, and cardholder name) and the shipping addresses you entered in this session.
• The room shows the display name you are using, along with your messages, bids, cart, and wins from your browser's storage.
• The checkout shows the result of each order you place.

For a copy of the information we hold about you on our servers, write to privacy@goodgetlive.com. Information You Can Access in the examples section lists what that covers.

What Choices Do I Have?

• You can use the GoodGet Services without joining the waitlist, without saving a card, and without holding the talk button; typing works wherever voice does.
• The talk button listens only while you hold it. You can deny the microphone permission in your browser and type instead.
• Your display name is generated for you unless the link you opened carried one, and the room does not currently offer a way to change it.
• You can clear the payment session cookie and the site's storage in your browser settings. Doing so clears browser state and any activity that has not yet uploaded; it does not delete server records. Signing in again restores the association with your saved payment account. Your browser can also block storage, but rooms and checkout will not work without it.
• To remove your phone number from the waitlist, email privacy@goodgetlive.com with the number.
• To delete the card you saved and the related Stripe record, email privacy@goodgetlive.com. We will remove it, and Stripe keeps what its own legal obligations require.
• To request a copy or deletion of the account, session, activity, and order records we keep about you, email privacy@goodgetlive.com. We answer within 45 days of verifying who you are, and if we need longer we will tell you why and take at most a further 45 days.
• We do not send text messages today. If we start, every message will include a way to opt out.

How long we keep information: We keep personal information only as long as needed for the purposes above or as the law requires. Waitlist numbers have no automatic expiry, so they stay until you ask us to remove them. Order records carry an expiry of 400 days, and our database is set to delete them once it passes. Stripe keeps payment records under its own obligations. Account profiles, session records, and activity history currently have no automatic expiry; session access expires separately from record retention. Browser copies remain until you clear them.

Are Children Allowed to Use GoodGet Services?

The GoodGet Services are for adults. You must be at least 18 years old to bid, buy, or join the waitlist, and the GoodGet Services are not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has given us information, email privacy@goodgetlive.com and we will delete it.

International Transfers

GoodGet operates from the United States, and we process and store personal information there, including the waitlist, the order records, and the records our service providers keep for us. Some providers may process information in other countries under their agreements with us. GoodGet does not participate in the EU-US Data Privacy Framework, the UK Extension to it, or the Swiss-US Data Privacy Framework. If you use the GoodGet Services from outside the United States, you understand that your information is transferred to and handled in the United States, where privacy laws may differ from those where you live.

Conditions of Use, Notices, and Revisions

The GoodGet Services are provided by GoodGetLive, Inc., a Delaware corporation, [STREET ADDRESS], [CITY, STATE ZIP].

If you choose to use the GoodGet Services, your use and any dispute over privacy are subject to this notice and our Conditions of Use, including its limits on liability and its rules for resolving disputes, and to the laws of the State of Delaware, without regard to its conflict-of-law rules. If you have a question or concern about privacy at GoodGet, email privacy@goodgetlive.com with a full description and we will try to resolve it.

Our business changes, and this notice will change with it. Check the website often for the latest version; the "Last updated" date at the top tells you when it last changed. Unless we say otherwise, the current notice applies to all information we hold about you and your use of the GoodGet Services. We stand by the promises in this notice: we will not materially weaken the protection of information collected in the past without the consent of the people it concerns.

Related Practices and Information

Readers usually need these sections:

• Are Children Allowed to Use GoodGet Services?
• What Choices Do I Have?
• What About Cookies and Other Identifiers?
• How Secure Is Information About Me?
• Conditions of Use

Examples of Information Collected

Information You Give Us When You Use GoodGet Services

You give us information when you:

• join the waitlist on our home page;
• open a live room and take part under a display name;
• send a message in the room, by typing or by holding the talk button;
• place a bid, tap a heart, or add a product to your cart;
• win an auction and place the order;
• type a shipping address at checkout;
• save a card on the payment page hosted by Stripe, or pay with Apple Pay;
• write to us at privacy@goodgetlive.com.

Through those actions you may give us information such as:

• your mobile phone number;
• your display name;
• the text of your messages and the words your browser transcribed from your voice;
• the products you bid on, the amounts, and the times;
• the amount you agreed to pay for a win and your authorization to charge the saved card;
• your shipping name and address, collected by Stripe and stored with verified orders;
• the card brand, last four digits, expiration date, and cardholder name that Stripe reports back after you save a card (your card number and billing address stay with Stripe);
• the email address you write to us from, and the content of the message.

Automatic Information

Examples of information our systems and providers receive automatically:

• the IP address, browser type, and requested page that every browser sends with a request, received by our hosting provider and kept under its policies rather than ours;
• a stable account identifier for signed-in shopping, a random per-tab identifier for room synchronization, and a separate random identity our server issues for the live video connection;
• the room, product, and timing details that accompany each bid and message, such as which room you were in and when you sent them;
• the order record we keep after a win, which includes Stripe's references for your record, saved card, and payment, the products and amounts, your display name and viewer identifier, the room, how long you had been in it, your recent messages there, and the bids;
• the technical result of each payment, such as whether it succeeded.

Information from Other Sources

Examples of information we receive from others:

• the card summary (brand, last four digits, expiration date, and cardholder name) and payment outcomes that Stripe returns;
• complete street addresses that Google returns for the text you typed;
• the transcript your browser's speech service returns for what you said.

Information You Can Access

Examples of information you can see in the GoodGet Services or ask us for:

• the card summary shown in checkout;
• the shipping addresses you entered in this session;
• your display name and the room history in your browser (messages, bids, hearts, cart, and wins);
• the result of each order you place;
• on request to privacy@goodgetlive.com, the account, session, activity, waitlist, and order records we hold about you.

State Privacy Disclosures

If you live in a state with a comprehensive privacy law, including California, Colorado, Connecticut, Texas, Utah, and Virginia, you have the rights set out here. This section adds to the rest of this notice rather than replacing it, and the categories below use the vocabulary those laws use.

Categories we collect. Identifiers, such as the phone number you give the waitlist, the email address you write to us from, the display name you choose, the random viewer identifier your browser creates, and the reference our payment processor holds for you. Commercial information, such as the products you bid on, your bids, your cart, and your orders. Internet and network activity, such as your messages in a room and the technical details every browser sends with a request. Financial information limited to the card brand, last four digits, expiration date, and cardholder name our payment processor reports back. Audio-derived information limited to the text your browser transcribes from your voice.

Sensitive personal information. We do not collect it. We hold no government identifier, no precise location, no account password, and no complete payment card number or security code, because your card details are entered on our payment processor's own pages.

Sources. You, when you type, speak, or submit something. Your browser, which sends technical details and runs the speech recognition. Our service providers, which return the card summary, matching street addresses, and payment outcomes described in What Personal Information About Customers Does GoodGet Collect?.

Purposes. The purposes listed in For What Purposes Does GoodGet Use Your Personal Information?, which are running the live rooms, taking and delivering orders, keeping the GoodGet Services working, remembering your preferences, meeting legal obligations, communicating with you, and preventing fraud.

Recipients. The service providers named in Does GoodGet Share Your Personal Information?, each of which may use the information only to do its job for us, together with the recipients described there for legal process and business transfers.

Retention. The periods in What Choices Do I Have?. Order records carry a 400-day expiry; account, session, activity, and waitlist records currently have no automatic expiry; browser records remain until cleared.

Sale and sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done either. We use first-party activity records to operate and improve the service and do not use them for cross-context advertising.

Your rights. Subject to your state's law, you may ask us to:

• tell you what personal information we hold about you and where it came from;
• give you a copy of it, in a portable form where the law requires one;
• correct it if it is wrong;
• delete it;
• stop selling or sharing it, which we do not do in the first place.

How to exercise them. Email privacy@goodgetlive.com from the address you want us to reply to, and include the phone number or order details that let us find your records. We verify a request by matching it against what we already hold, and we ask for nothing beyond that. An authorized agent may act for you if you give them written permission we can check. We answer within 45 days, and if we need longer we tell you why and take at most a further 45 days. If we refuse, you may reply to the same address to appeal, and we will tell you the outcome and how to complain to your state's attorney general.

No discrimination. We will not deny you the GoodGet Services, change what you pay, or give you a worse experience because you exercised a right.

[COUNSEL REVIEW: confirm this section against each state law you are subject to before launch, including whether any waitlist offer counts as a financial incentive that needs its own notice.]