Privacy Policy

HappyFish KC ("HappyFish KC," "we," "us," or "our") operates an online coral auction platform for customers in the United States. This Privacy Policy explains what information we collect, how we use and protect it, and the choices you have. By creating an account or using the platform, you agree to the practices described here. The "Last updated" date and version are shown at the end of this policy.

Information We Collect

We collect the following information when you register an account and use the platform:

• Account information — your email address, used to sign in, verify your account, and send notifications.
• Contact and shipping details — your name, shipping address, and phone number, used to fulfill and coordinate the delivery of items you win.
• Bidding activity — the bids you place, including proxy (maximum) bids, retained as the record of your auction activity.
• Account credentials — your password, which is stored only as a one-way bcrypt hash and is never accessible in readable form.
• Technical information — a first-party session cookie that keeps you signed in, and server logs that include your IP address and basic request metadata, retained for security and troubleshooting.

We do not knowingly collect more personal information than is necessary to operate the auctions and ship your orders.

How We Use Your Information

We use the information we collect to:

• Operate the auctions, including proxy bidding and winner determination.
• Create and send invoices for items you win.
• Send account and transactional messages such as account verification, outbid alerts, ending-soon notices, and win notifications.
• Protect the platform and our users against fraud, abuse, and unauthorized access.
• Comply with our legal obligations.

How We Share Your Information

We do not sell or rent your personal information. We share it only with service providers who help us operate the platform, and only as needed to provide their services:

• Payment processing — when you win an auction, we create a customer record with Square so we can issue your invoice. Your payment card details are entered and processed entirely on Square's secure hosted page; we never see or store your card numbers.
• Email delivery — we use an email provider to send transactional and notification emails.
• Hosting and infrastructure — we use cloud hosting, database, caching, and image-storage providers to run the platform.

We may also disclose information if required by law, or to protect the rights, safety, and security of our users, the public, or HappyFish KC.

Cookies and Third-Party Services

The auction platform uses only first-party cookies that are necessary to keep you signed in. We do not use advertising, analytics, or cross-site tracking cookies.

The auction may appear embedded within the HappyFish KC storefront, which is operated on Square Online and may use its own cookies and services (such as Square and Google reCAPTCHA). Those services are governed by Square's and Google's privacy practices, not this policy.

Data Security

We protect your personal information using industry-standard safeguards. Your name, shipping address, and phone number are encrypted at rest using AES-256-GCM, and your password is stored only as a one-way bcrypt hash. While no method of transmission or storage is completely secure, we take reasonable measures to protect your information against loss, misuse, and unauthorized access.

Data Retention

We retain your account information and bidding history for as long as your account remains active. We will delete your personal information upon your request, or when you close your account. We may retain limited information where necessary to comply with legal obligations or resolve disputes.

Your Privacy Rights

Subject to applicable law, including the California Consumer Privacy Act (CCPA), you have the right to:

• Know what personal information we hold about you.
• Access a copy of that information.
• Request deletion of your personal information.
• Opt out of the sale of your personal information — note that we do not sell personal information.

To exercise any of these rights, email us at HappyFishKC@gmail.com. We will not discriminate against you for exercising your rights.

Children's Privacy

The platform is intended for adults and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

United States Only

The platform is offered to, and ships within, the United States only. It is not directed to users in the European Union or United Kingdom, and we make no representation that the platform is appropriate or available for use outside the United States.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the version identifier and "Last updated" date shown below. Your continued use of the platform after a change takes effect constitutes acceptance of the updated policy.

Contact Us

If you have any questions or requests regarding this Privacy Policy or your personal information, contact us at HappyFishKC@gmail.com.

Operated by HappyFish KC. Owner: Shane Barnard.