AA Surplus Sales Inc. ("Company," "we," "us," or "our") operates the Surplus Exchange platform. AA Surplus Sales Inc. is an affiliate of AA Innovation Group LLC. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform.
1. Information We Collect
1.1 Information You Provide
When you register for an account, create listings, or conduct transactions, we collect information you voluntarily provide, including: your name, email address, business name, city and state, phone number (if provided), business identification numbers (if provided), listing content (photos, descriptions, pricing), shipping addresses, payment information (processed by Stripe; we do not store full credit card numbers), and messages sent through the Platform.
1.2 Information Collected Automatically
When you access the Platform, we automatically collect certain technical information, including: your IP address, browser type and version, operating system, referring URLs, pages viewed and time spent on pages, click patterns and navigation paths, device identifiers, and general geographic location derived from IP address.
1.3 Information from Third Parties
We may receive information from third-party services integrated with the Platform, including Stripe (payment processing status and transaction data), Firebase/Google Cloud (authentication and analytics data), and Vercel (hosting and performance data).
2. How We Use Your Information
We use collected information for the following purposes: to operate, maintain, and improve the Platform; to process transactions and send related notifications; to facilitate communication between buyers and sellers; to verify user identity and business legitimacy; to enforce our Terms of Service and Acceptable Use Policy; to detect and prevent fraud, abuse, and security incidents; to send administrative communications (account updates, security alerts, policy changes); to generate anonymized, aggregated analytics about Platform usage; to comply with legal obligations; and to respond to your inquiries and provide customer support.
3. How We Share Your Information
3.1 With Other Users
Certain information is visible to other Platform users by design. Your business name, city, state, plan tier, verified status, listing content, and seller ratings are publicly visible. Your email address and full name are shared with counterparties only when you engage in a transaction or initiate a conversation.
3.2 With Service Providers
We share information with third-party service providers who assist us in operating the Platform, including: Stripe, Inc. (payment processing); Google LLC / Firebase (authentication, database and file storage); Vercel Inc. (hosting and content delivery); Resend (transactional email delivery); Functional Software, Inc. d/b/a Sentry (error monitoring — when something breaks, Sentry receives technical details of the error, which can include your IP address, browser, the page you were on and your account ID); Upstash, Inc. (rate limiting — it processes your IP address briefly to block abuse). If you apply for seller verification, the business details you submit (such as EIN, business license number and address) are stored with Firebase and reviewed only by our staff. These providers are contractually obligated to use your information only for the purposes of providing services to us and are bound by their own privacy policies.
3.3 For Legal Reasons
We may disclose your information if required by law, regulation, legal process, or governmental request; if we believe disclosure is necessary to protect our rights, your safety, or the safety of others; to detect or prevent fraud or security issues; or to enforce our Terms of Service.
3.4 Business Transfers
In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your information.
3.5 No Sale of Personal Information
We do not sell, rent, or trade your personal information to third parties for their marketing purposes.
4. Data Retention
We retain your personal information for as long as your account is active or as needed to provide services. We also retain information as necessary to comply with legal obligations, resolve disputes, enforce our agreements, and maintain business records. If you request account deletion, we will remove your personal information within 30 days, except for information we are required to retain by law or for legitimate business purposes (such as transaction records for tax and accounting compliance).
5. Data Security
We implement reasonable administrative, technical, and physical safeguards to protect your information, including: encryption of data in transit (TLS/SSL); Firebase Authentication for secure account access; Stripe PCI-DSS compliant payment processing (we never store full card numbers); access controls limiting employee access to personal data; and regular security assessments. However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information.
6. Cookies and Tracking
We use only the cookies and browser storage the Platform needs to work: keeping you signed in, security, and remembering your settings. We do not use advertising or third-party analytics cookies, and we do not track you across other websites. Listing view counts shown to sellers are counted on our own servers. You can control cookies through your browser settings. Disabling essential cookies may impair Platform functionality.
7. Your Rights and Choices
Depending on your jurisdiction, you may have the following rights regarding your personal information:
Access: You may request a copy of the personal information we hold about you.
Correction: You may request that we correct inaccurate or incomplete personal information.
Deletion: You may request that we delete your personal information, subject to certain exceptions.
Portability: You may request a copy of your data in a structured, machine-readable format.
Opt-out: You may opt out of non-essential communications at any time.
To exercise any of these rights, contact us at info@thesurplusexchange.com. We will respond to your request within 30 days.
8. California Privacy Rights
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of personal information. As stated above, we do not sell personal information. To exercise your California privacy rights, contact us at info@thesurplusexchange.com.
9. Children's Privacy
The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will take steps to delete that information promptly.
10. International Users
The Platform is operated from the United States. If you access the Platform from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your jurisdiction. By using the Platform, you consent to such transfer, storage, and processing.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Platform or sending you an email. Your continued use of the Platform after any changes constitutes acceptance of the updated Privacy Policy.
12. Contact Us
For questions or concerns about this Privacy Policy or our data practices, contact us at:
AA Surplus Sales Inc.
Attn: Privacy
Ronkonkoma, NY 11779
Email: info@thesurplusexchange.com