Luxier Privacy Policy

Who We Are

Luxier is a marketplace that connects owners of watches and jewelry (“Customers”) with vetted independent watchmakers and jewelry specialists (“Vendors”), operated by CoFabri LLC. When this policy says “Luxier,” “we,” or “us,” it refers to that entity.

Data We Collect

From Customers:

• Account data: email address, name, phone number (optional), profile photo (optional), and preferred language. You sign in through CoFabri’s hosted sign-in, which manages your credentials, one-time codes, and passkeys.
• Service request data: item type, brand, model, materials, condition notes, symptoms, estimated and insured value, whether the item is vintage or an heirloom, your budget, timeline, ZIP code and search radius, and the photos, videos, and documents you upload.
• Order data: quotes you accept, order history, shipping carrier and tracking number, custody records for items in transit, and the last four digits of the card used.
• Messages and files you send to Vendors through Luxier.
• Ratings and written feedback you leave about a Vendor, and any dispute you file, including its description and evidence files.

From Vendors:

• Application data: business name and type, years in business, website, business address, services, item and brand expertise, certifications, insurance details and insurance document, biography, portfolio images, and references.
• Public profile data: business name, biography, city, state, specialties, turnaround, portfolio images, tier, and the ratings and feedback Customers leave about you.
• Payout data: your Stripe connected account is created and managed by Stripe. We store your Stripe account identifier and whether payouts are enabled, not your bank details.
• Messages, quotes, shipping updates, and dispute responses you submit.

Automatically collected:

• Request logs and operational logs (Vercel infrastructure), browser and device type.
• Usage analytics (Vercel Analytics).
• Error and performance telemetry from Sentry, which may include session replays of a sample of visits and of visits where an error occurs.
• A record of each payment step we take (charge, payout, refund), so we can audit and reconcile money movement.

How We Use Your Data

• To operate the marketplace: create your account, match your request with suitable Vendors, deliver quotes, enable messaging, and track orders.
• To process payments: collect payment, hold it until the work is confirmed, pay Vendors, and issue refunds.
• To vet Vendors and resolve disputes between Customers and Vendors.
• To communicate with you: transactional emails and in-app notices about quotes, orders, payments, shipping, messages, disputes, and your account.
• To keep Luxier safe and reliable: fraud and abuse prevention, rate limiting, suspension of accounts that violate our Terms, and error monitoring.
• For legal compliance: responding to legal requests and keeping financial records.

We do not sell your personal data and we do not use it for advertising.

What Other Users See

When you send a service request, matched Vendors can see its details and the media you attach, along with your messages. Once you accept a quote, the Vendor sees what is needed to complete and ship your order. Vendor profiles and the ratings and feedback Customers write about Vendors are visible to the public.

Sub-Processors

We share data only with these service providers:

• Supabase — database, authentication, and file storage.
• Stripe — payment processing and Vendor payouts through Stripe Connect. Stripe handles card data and Vendor identity verification under its own privacy policy; we never see full card numbers.
• CoFabri — hosted sign-in, shared billing for Vendor plans, and delivery of our emails through its email gateway, which uses Resend. CoFabri keeps a record of messages it sends.
• Resend — email delivery, through CoFabri.
• Vercel — hosting, content delivery, and analytics.
• Sentry — error monitoring and session replay.
• Zippopotam.us — we send the ZIP code you enter to look up the matching city and state.

We may also disclose data in response to valid legal process (court order, subpoena), to enforce our Terms, or to protect the safety of users or the public.

Data Retention

• Account, request, order, message, and dispute data is kept while your account is active and for a reasonable period afterward to resolve disputes and meet legal and tax obligations.
• Payment records and the audit log of payment steps are kept as needed for accounting, refunds, chargebacks, and legal compliance.
• Order custody records are kept with the order they relate to.
• Stripe retains payment and payout data under its own policies.
• Our logs are kept for the period set by our infrastructure providers.

Your Privacy Rights

Depending on where you live, you may have rights under CCPA/CPRA or other state privacy laws, including:

• Access — know what personal data we hold about you.
• Deletion — request deletion of your personal data, subject to records we must keep.
• Correction — request correction of inaccurate data. You can edit most of your profile directly in your account.
• Opt-out of sale or sharing — we do not sell or share personal data for advertising.
• Opt-out of profiling — we do not profile individuals for advertising purposes.

We will respond to verified requests within 45 days. To make a request, email privacy@cofabri.com.

Security

We use TLS in transit, row-level security policies on our database, access-controlled private storage for uploaded files, and signed webhook verification for payment events. Sensitive operations are logged.

To report a security vulnerability, email security@cofabri.com.

Children

Luxier is not directed at individuals under 18. We do not knowingly collect data from minors.

Changes to This Policy

We will notify you of material changes by email or in-app notice. Continued use after the effective date constitutes acceptance.

Contact

Privacy questions: privacy@cofabri.com