Privacy Policy

AquaLots (“AquaLots”, “we”, “us”, “our”) operates the online marketplace at aqualots.com (the “Platform”) that connects buyers and sellers of aquatic life, equipment, and related products within the United States.

This Privacy Policy applies to personal information we collect from users of the US version of the Platform. For the purposes of applicable US state privacy laws, AquaLots is the business or controller responsible for the personal information collected through the Platform.

Contact: contact us

We collect personal information in the following ways:

Information you give us directly:

• Account registration: name, email address, password (hashed), username, and profile details.
• Third-party sign-in: if you register or sign in via Google, we receive your name, email address, and profile picture from Google.
• Listings: descriptions, photographs, prices, species information, and any other content you upload when creating a listing.
• Purchases and payments: order details, shipping address, and payment method. Payment card processing is handled by Stripe, Inc. — we do not store your full card number. We retain only your payment method type, card type, and last 4 digits for records.
• Seller onboarding: identity, taxpayer, and banking information collected and held by Stripe via Stripe Connect for payout purposes, including Form W-9 information and any information required for Form 1099-K reporting.
• Communications: messages sent via the Platform, emails or inquiries sent to us, and any feedback or reports you submit.
• Preferences: notification settings, cookie consent choices, and region settings.

Information we collect automatically:

• Usage data: pages visited, listings viewed, listings seen in search results and carousels (impressions), searches performed, time spent on the Platform, and clicks.
• Device and technical data: IP address, browser type and version, operating system, device identifiers, screen resolution, and referring URL.
• Cookies and tracking technologies: we use cookies and similar technologies for session management, security, and analytics. See Section 11 and our Cookie Policy for full details.
• Analytics: we use Google Analytics 4 (via Google Tag Manager) and Microsoft Clarity to understand how users interact with the Platform. This may involve the collection of pseudonymous identifiers.
• Approximate location: we infer approximate location from your IP address to serve the correct regional version of the Platform. We do not collect precise geolocation data.

Information from third parties:

• Authentication information from Google if you use Google sign-in.
• Payment, identity-verification, and fraud-prevention information from Stripe.
• Information from other users (for example, where a seller or buyer provides your shipping address in connection with an order).

Sensitive personal information. We do not knowingly collect sensitive personal information as defined by the California Privacy Rights Act (CPRA), including government-issued identifiers, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic or biometric data, or information about health, sex life, or sexual orientation. Taxpayer and banking information collected for seller payouts is held by Stripe, not AquaLots.

We use your personal information for the following purposes:

• To create and manage your account and authenticate your identity.
• To process purchases, auctions, and offers.
• To facilitate payments and seller payouts via Stripe.
• To calculate, collect, and remit sales tax as required by applicable US state law (see our Terms & Conditions for the marketplace facilitator framework under South Dakota v. Wayfair, Inc., 138 S. Ct. 2080 (2018)).
• To communicate with you about your orders, listings, disputes, and account.
• To send service messages, including important updates, security alerts, and policy changes.
• To send marketing emails and notifications where permitted by law and where you have not opted out, including in accordance with the CAN-SPAM Act, 15 U.S.C. §§ 7701 et seq.
• To personalize your experience on the Platform.
• To produce aggregated analytics for our own internal use and to show sellers impression/view statistics for their own listings.
• To detect, prevent, and investigate fraud, abuse, and security incidents.
• To comply with our legal and regulatory obligations, including federal and state tax reporting and lawful requests from government authorities.
• To enforce our Terms & Conditions and other policies.
• To respond to disputes, complaints, and legal claims.
• To conduct business operations including auditing, reporting, and corporate transactions.

Under applicable US state privacy laws, we process personal information for the following business and commercial purposes:

We do not sell your personal information for monetary consideration. We share your information only in the following circumstances:

• Other users: when you buy or sell, certain information (such as your username, listing details, and shipping address) is shared with the other party to complete the transaction.
• Stripe: your payment information is processed by Stripe, Inc. Stripe acts as both a payment processor and, for sellers using Stripe Connect, a separate business/controller for identity verification, tax-reporting, and payout purposes. Please review Stripe’s Privacy Policy.
• Google: if you sign in with Google, your authentication is handled by Google. We also use Google Analytics 4 and Google Tag Manager for site analytics. Please review Google’s Privacy Policy.
• Microsoft: our Platform infrastructure, database, and file storage run on Microsoft Azure. We also use Microsoft Clarity for session-replay and heatmap analytics. Microsoft processes data on our behalf under a data processing agreement.
• Email and notification providers: we use third-party services to send transactional and marketing emails on our behalf.
• Legal and regulatory authorities: we may disclose your information to law enforcement agencies, regulators, or courts where required to do so by law or to protect our legal rights, including in response to valid subpoenas, search warrants, or court orders.
• Business transfers: if AquaLots is involved in a merger, acquisition, or sale of all or part of its assets, your information may be transferred as part of that transaction. We will notify you of any such change and your choices.
• Professional advisers: lawyers, accountants, insurers, and other advisers acting on our behalf where necessary.

All third-party service providers acting on our behalf are contractually required to take appropriate security measures and may only use your information for the specific purposes we instruct.

AquaLots primarily processes US user data within the United States. However, some of our third-party service providers (including Google, Stripe, and Microsoft) operate globally and your personal information may be processed in or transferred to locations outside the United States for backup, disaster recovery, or operational reasons.

Where personal information is transferred outside the United States, we rely on the service provider’s standard data transfer safeguards, including contractual protections that require equivalent levels of privacy and security.

We take the security of your personal information seriously and use a variety of measures based on good industry practice to keep it secure. Nonetheless, transmissions over the internet may not be completely secure, so please exercise caution. When accessing links to other websites, their privacy policies, not ours, will apply to your personal information.

We employ security measures to protect the personal information you provide to us, to prevent access by unauthorized persons and unlawful processing, accidental loss, destruction, and damage. When you have chosen a password allowing you access to certain parts of the Platform, you are responsible for safeguarding it and keeping it confidential, and must not allow it to be used by third parties.

In the event of a security incident involving your personal information, we will notify affected individuals and applicable state attorneys general in accordance with applicable US state data breach notification laws, which vary by state.

The Platform may contain links to other websites run by other organizations which we do not control. This policy does not apply to those other websites, so we encourage you to read their privacy policies. Your disclosure of personal information to third-party websites is at your own risk.

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. Our general retention approach is:

When personal information is no longer required, it is securely deleted or anonymized.

Depending on the state in which you reside, you may have one or more of the following privacy rights under applicable US state law. These rights are subject to exceptions and limitations under each state’s statute.

• Right to know / access: the right to request confirmation of whether we process your personal information, and to receive a copy of it.
• Right to delete: the right to request deletion of your personal information, subject to certain exceptions (for example where we must retain it for legal, tax, or security reasons).
• Right to correct: the right to request that we correct inaccurate personal information.
• Right to opt out of sale: the right to opt out of the “sale” of your personal information. We do not sell personal information for monetary consideration; see Section 10 for how we treat “sharing” for advertising purposes.
• Right to opt out of targeted advertising: the right to opt out of the processing of your personal information for the purpose of targeted advertising. We do not currently engage in cross-context behavioral advertising.
• Right to opt out of profiling: the right to opt out of profiling that produces legal or similarly significant effects. We do not engage in such profiling.
• Right to limit use of sensitive personal information: where applicable (primarily California), the right to limit use of sensitive personal information to what is necessary to provide requested services. As noted in Section 2, we do not knowingly collect sensitive personal information.
• Right to data portability: the right to receive your personal information in a portable, commonly used, machine-readable format.
• Right to appeal: if we decline a request, you may appeal our decision.
• Right to non-discrimination: you will not be discriminated against for exercising any of your privacy rights.

States that provide these rights. These rights are provided under the California Consumer Privacy Act (CCPA, Cal. Civ. Code §§ 1798.100 et seq.) as amended by the California Privacy Rights Act (CPRA); the Virginia Consumer Data Protection Act (VCDPA, Va. Code § 59.1-575 et seq.); the Colorado Privacy Act (CPA, Colo. Rev. Stat. § 6-1-1301 et seq.); the Connecticut Data Privacy Act (CTDPA, Conn. Gen. Stat. § 42-515 et seq.); the Utah Consumer Privacy Act (UCPA, Utah Code § 13-61-101 et seq.); and other comprehensive state privacy laws including those of Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island.

How to exercise your rights. Submit a verifiable consumer request via our contact us page. You may also designate an authorized agent to make a request on your behalf — we will require written authorization signed by you and may need to verify your identity directly. We aim to respond within 45 days; if we require more time, we will notify you and may extend the response period by an additional 45 days as permitted under applicable state law.

California Shine the Light. California Civil Code Section 1798.83 permits California residents to request information regarding our disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes.

We do not sell personal information. AquaLots does not sell your personal information for monetary consideration as “sale” is defined under the CCPA/CPRA or any other applicable US state privacy law.

Sharing for advertising. The CCPA/CPRA defines “sharing” broadly to include certain disclosures of personal information for cross-context behavioral advertising. AquaLots does not currently engage in cross-context behavioral advertising. We use Google Analytics 4 and Microsoft Clarity for aggregate site analytics, which in some interpretations of state privacy laws may constitute “sharing.” You can control this through the cookie consent banner on the Platform or through our Cookie Policy.

Global Privacy Control (GPC). We honor Global Privacy Control signals as a valid opt-out request from California residents and residents of other states whose laws recognize universal opt-out mechanisms.

To opt out. Adjust your settings via the cookie consent banner, enable Global Privacy Control in your browser, or contact us with “Do Not Sell or Share” in the subject line.

We use cookies and similar tracking technologies on the Platform for session management, security, and analytics purposes. You can control non-essential cookies through our cookie consent banner.

For full details of the cookies we use, their purpose, duration, and how to manage them, please see our Cookie Policy.

AquaLots is not directed at children. In compliance with the Children’s Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506) and 16 C.F.R. Part 312, we do not knowingly collect or solicit personal information from anyone under the age of 13. Our Terms & Conditions require users to be at least 18 years of age (or the age of majority in their state). Users under 18 may not register for or use the Platform.

If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will take steps to delete that information as quickly as possible. If you believe we may have any information from or about a child under 13, please contact us.

We may update this Privacy Policy from time to time to reflect changes to our practices, technology, legal requirements, or for other operational reasons. The date at the top of this page reflects when it was last updated.

Where changes are material, we will notify registered users via email or a prominent notice on the Platform before the changes take effect. We encourage you to review this policy periodically.

Your continued use of the Platform after changes take effect constitutes your acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact our privacy team:

Contact us

We aim to respond to all privacy-related inquiries within 5 business days and to resolve all requests within 45 days (extendable by an additional 45 days where permitted by law).