Privacy Policy | MercatoList

This Privacy Policy explains how MercatoList (“MercatoList,” “we,” “us,” or “our”) collects, uses, and shares information when you use mercatolist.com and related services (the “Service”). By using the Service, you agree to the practices described here.

1. Information We Collect

Information you provide directly:

Account information — your name, email address, password (stored only in hashed form), and, if you sign in with Google, the basic profile information Google shares with us (name, email, profile image).
Profile information — optional details such as display name, phone number, bio, website, avatar, and, for brokers and advisors, brokerage name, brokerage phone, and social media links.
Listing information — business details, financial figures, location, and photos you submit when creating a listing.
Communications — inquiries, messages, reviews, reports, and anything you send to us or other users through the Service.
Buyer preferences and saved data — saved listings, collections, saved searches, and buy-box preferences you configure.

Information collected automatically: basic usage and device information (such as pages viewed, listing view counts, approximate location derived from your IP address, browser type, and similar log data), collected to operate and improve the Service and, where used, through cookies and similar technologies.

2. How We Use Your Information

To provide, maintain, and improve the Service and your account;
To display your listings and public profile to other users and to route inquiries and messages between users;
To send transactional communications — for example, email verification, inquiry and message notifications, saved-search alerts, listing status confirmations, and account-related notices;
To send marketing or promotional communications where permitted (you can opt out at any time — see “Your Choices”);
To detect, prevent, and address fraud, abuse, security, and technical issues;
To comply with legal obligations and enforce our Terms of Service.

3. How We Share Information

We do not sell your personal information. We share information only as follows:

Publicly, at your direction — information in your listings and public profile (including your name/brokerage and, if you enable it, your phone number) is visible to other users and the public. We deliberately do not expose seller/broker email addresses publicly; contact happens through our inquiry system, and phone numbers are shown only when you opt in.
With other users — when you send or receive an inquiry or message, the relevant parties see the information needed to communicate.
With service providers who process data on our behalf under contract (see below).
For legal reasons — to comply with law, respond to lawful requests, or protect the rights, safety, and property of MercatoList, our users, or the public.
In a business transfer — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

4. Service Providers We Use

We rely on trusted third parties to run the Service. Each processes only the data needed for its function:

Neon — database hosting (stores your account and listing data).
Vercel — application hosting and delivery.
Amazon Web Services (S3) — storage of uploaded listing and profile photos.
Google — optional sign-in (OAuth) authentication.
Mapbox — maps and address lookup on listing and browse pages.
Resend — delivery of transactional and account emails.
Mailchimp — delivery of newsletters and marketing emails (for users who have not opted out).

5. Cookies

We use cookies and similar technologies that are necessary to keep you signed in, remember preferences, and understand basic usage of the Service. You can control cookies through your browser settings; disabling certain cookies may affect functionality such as staying logged in.

6. Data Retention

We keep your information for as long as your account is active or as needed to provide the Service, and thereafter as necessary to comply with legal obligations, resolve disputes, maintain security, and enforce our agreements. You may request deletion of your account and associated personal information (see below).

7. Data Security

We take reasonable administrative and technical measures to protect your information — including hashing passwords, encrypting data in transit, restricting access, and limiting the exposure of sensitive contact details. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

8. Your Choices and Rights

Access and update — you can view and edit your account and profile information in your dashboard settings.
Marketing opt-out — you can unsubscribe from marketing emails using the link in any such email; transactional emails necessary to operate your account will still be sent.
Deletion — you can request deletion of your account and personal information by contacting us.
Regional rights — depending on where you live (for example, California or other U.S. states with privacy laws), you may have additional rights to access, correct, delete, or restrict use of your personal information, and to not be discriminated against for exercising them. Contact us to make a request.

9. Children’s Privacy

The Service is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

10. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide notice through the Service or by email where appropriate.

11. Contact

Questions or requests about your privacy? Reach us through our contact page.