Privacy Policy
Last Updated: October 15, 2026
1. Introduction
Expired Auctions ("we," "our," or "us") is operated from Texas, United States. This Privacy Policy describes how we collect, use, store, and protect information when you visit our website. We are committed to transparency and compliance with applicable privacy laws, including the Texas Data Privacy and Security Act (TDPSA) and the EU/UK General Data Protection Regulation (GDPR).
We do not sell your personal data. We do not use third-party advertising networks, Facebook Pixel, or external advertising tracking scripts. We use Google Analytics to measure site traffic and usage patterns; this is subject to Google's Privacy Policy. All other analytics are first-party and operated entirely by us.
2. Data We Collect
2.1 All Visitors — Automatic Collection
When you visit the site, our servers and first-party analytics system automatically record the following for every pageview:
- Hashed IP address — Your IP is hashed using SHA-256 with a daily-rotating salt. The raw IP is never stored for general visitors.
- Hashed user agent — A one-way hash of your browser's user agent string.
- Raw user agent string — Stored up to 500 characters, used to determine browser, OS, and device type.
- Raw referrer URL — The page you came from, stored up to 500 characters.
- Country code — Derived from your IP address at collection time.
- Browser, OS, and device type — Parsed from the user agent.
- Page URL visited and session ID.
2.2 Search Queries
When you use our search or filter features, we store: the raw search terms entered, filters applied, hashed IP address, and session ID. This helps us understand what domains users are looking for and improve our listings.
2.3 Ad Interactions
Each ad impression and click is tracked with: hashed IP address, hashed user agent, device type, page URL where the ad appeared, and referrer URL. No raw IP is stored for ad interaction events.
2.4 Popup Interactions
Popup view, close, and conversion events are tracked with hashed IP address and session ID to measure popup effectiveness.
2.5 Newsletter Subscribers
If you subscribe to our newsletter, we collect your email address and optionally your name, along with your subscription date and double opt-in confirmation timestamp.
2.6 Contact Form Submissions
Contact form submissions (name, email, message) are delivered to us via email and are not stored in our database. We retain only what is necessary to respond to your inquiry.
2.7 Advertisers
When you purchase an advertising campaign, we collect: email address, name, company name, website URL, and your raw IP address (stored for account security and fraud prevention). Payment card data is handled exclusively by Stripe and is never stored on our servers. We store only Stripe-issued identifiers (customer ID, payment intent ID).
2.8 Bot Detection & Security Logs
When our systems detect automated or abusive traffic, the raw IP address of the request is stored in a security log for abuse prevention purposes.
3. How We Use Your Data
- To operate and improve the Service (analytics, search quality, performance monitoring)
- To send newsletter emails to subscribers who have opted in
- To process and manage paid advertising campaigns
- To detect and prevent abuse, fraud, and unauthorized access
- To respond to contact form inquiries
- To measure ad campaign performance for advertisers
- To comply with legal obligations
4. Legal Basis for Processing (GDPR)
For visitors from the EU or UK, our legal bases under GDPR Article 6 are:
- Legitimate interests (Art. 6(1)(f)): First-party analytics, security logging, bot detection, and ad performance tracking. We have assessed that these interests are not overridden by your rights.
- Contract performance (Art. 6(1)(b)): Processing advertiser data to deliver purchased ad campaigns.
- Consent (Art. 6(1)(a)): Newsletter subscription (double opt-in). You may withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)): Retaining financial records for tax and legal compliance.
5. Third-Party Services
We use the following third-party services that may process your data:
- Google Analytics — We use Google Analytics to measure site traffic and usage patterns (page views, session duration, referral sources). Google may set cookies and collect your IP address and browser information. You can opt out via the Google Analytics Opt-out Browser Add-on. Google's data practices are described in their Privacy Policy.
- Stripe — Payment processing for advertising campaigns. When you purchase an ad, your payment card data is submitted directly to Stripe. We receive only a Stripe customer ID and payment confirmation. Stripe's privacy practices are described in their Privacy Policy.
Outbound links to GoDaddy, Namecheap, Dynadot, and GNAME are redirect destinations only. We do not share any user data with these platforms. Transactional emails are sent via SMTP using PHPMailer; no email marketing platform or third-party ESP is used.
6. Data Sharing and Sale
We do not sell, rent, or trade your personal data. We do not share personal data with third parties for their marketing purposes. Data is shared only as follows:
- Google Analytics — receives anonymized usage data as described above.
- Stripe — receives payment data as described above.
- Legal requirements — we may disclose data if required by law, court order, or to protect our legal rights.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Pageview analytics, search queries, ad interactions, popup events | 90 days, then automatically purged |
| Newsletter subscriber data | Until you unsubscribe |
| Advertiser account data | Duration of account; financial records retained 7 years for legal/tax compliance |
| Bot/security logs (raw IP) | 30 days, then purged |
| Contact form submissions | Not stored in database |
| Stripe webhook payloads | Retained for payment reconciliation; purged per financial record schedule |
8. Cookies
We use only essential cookies required for the website to function. We do not use advertising cookies, third-party tracking cookies, or persistent profiling cookies.
| Cookie Name | Purpose | Type | Duration |
|---|---|---|---|
ea_session |
PHP session management and CSRF protection | Essential / Functional | Session (expires on browser close or after 2 hours of inactivity) |
ea_gdpr_consent |
Records that you have acknowledged the GDPR/cookie notice | Functional | 1 year |
Theme preference (light/dark) and view mode (grid/list) are stored in your
browser's localStorage, not in cookies, and never transmitted to
our servers.
9. Your Rights
Depending on your location, you may have the following rights regarding your personal data. To exercise any of these rights, please contact us.
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate data.
- Deletion: Request deletion of your personal data (subject to legal retention obligations).
- Portability: Request your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interests.
- Withdraw consent: Unsubscribe from the newsletter at any time via the link in any email.
Because most visitor analytics data is stored in hashed/anonymized form, we may not be able to identify or retrieve records associated with a specific individual from analytics tables. We will inform you if this is the case.
10. Texas Residents — TDPSA
Under the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024, Texas residents have the right to:
- Know what personal data we collect and how it is used
- Access, correct, and delete personal data we hold about you
- Obtain a portable copy of your personal data
- Opt out of the sale of personal data — we do not sell personal data
- Opt out of targeted advertising — we do not conduct targeted advertising
- Not be discriminated against for exercising your privacy rights
To submit a TDPSA privacy request, please contact us. We will respond within 45 days as required by law, with a possible 45-day extension if necessary.
11. EU/UK Residents — GDPR
If you are located in the European Union or United Kingdom, you have rights under the GDPR/UK GDPR as described in Section 9. In addition:
- You have the right to lodge a complaint with your local data protection authority (DPA).
- Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
- We do not transfer personal data outside the US/EU except as necessary to process payments via Stripe (which is Privacy Shield-certified and GDPR-compliant).
To exercise your GDPR rights, please contact us. We will respond within 30 days.
12. Security
We implement appropriate technical and organizational measures to protect personal data, including:
- HTTPS/TLS encryption for all data in transit
- SHA-256 hashing with daily-rotating salts for IP addresses and user agents
- CSRF protection on all forms
- Parameterized database queries to prevent SQL injection
- Content Security Policy (CSP) headers
- Automated bot detection and IP blocking
No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data using industry-standard practices.
13. Children's Privacy
The Service is not directed to children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically. Continued use of the Service after changes are posted constitutes acceptance of the revised policy.
15. Contact Us
For privacy-related questions, data subject requests, or to exercise your rights under TDPSA or GDPR, please contact us. We are based in Texas, United States.