Privacy Policy

Effective date: September 24, 2026

1TEMS uses your data to deliver a secure, localized marketplace experience.

We rely on strictly necessary cookies and required browser storage for core functionality. With your separate choices, we may use preference storage, Google Analytics 4 to measure traffic, and Google Ads to measure our advertising. Each optional category is independent and remains disabled unless you grant that category's consent.

1. Overview

This policy explains what personal data we process, why we process it, how long we keep it, and what rights you may have.

By using the platform, you acknowledge this policy alongside our Terms of Use.

2. Data Controller

For the activities described in this policy, 1TEMS acts as the controller of your personal data.

If you have privacy questions, contact us at [email protected].

3. Data We Collect

3.1 Account and profile data
Information you provide during registration and profile use, such as email, account identifiers, and optional profile details.
3.2 Listing and communication data
Content you publish, edit, or submit through platform features, including listing details and support messages.
3.3 Platform Messenger data
When you use Platform Messenger, we process message content and metadata, including conversation and listing references, message timestamps, replies, reactions, read status, mute and block settings, presence state, and contact requests or contact details that you choose to share.
3.4 Reports and moderation evidence
If you submit or are connected to a Messenger report, we process the report, the reported message, and nearby conversation context needed to assess the report, protect users, and enforce our rules.
3.5 Messenger anti-abuse and snapshot data
For Messenger rate limiting, we process the client network address only as a keyed hash; the raw IP address is not stored for this purpose, and short-lived rate-limit counters are purged after the limit window. Each message stores a snapshot of the sender's display name and, where relevant, company name, each conversation stores a snapshot of the listing title and thumbnail, and report records store snapshots of the message, listing, and participant references so history remains readable and reports remain reviewable as they were at the time.
3.6 Push notification subscription data
If you enable browser notifications, we process the push subscription endpoint, encryption keys, selected language, user-agent information, and delivery metadata such as attempted or successful delivery and timestamps.
3.7 Technical and security data
Operational and security signals such as session-related records, timestamps, abuse-prevention information, error diagnostics, and performance traces required to run and improve the service.
3.8 Approximate country detection
When you access 1TEMS, our network or infrastructure provider may supply a country-level signal derived from your connection. We use it at request time to display an approximate localized country hint. We do not request GPS coordinates or precise device location, and we do not store the derived country in cookies, browser storage, or our application database.
3.9 Payment transaction metadata
For wallet top-ups, we store operational metadata such as payment processor session identifiers, payment status, amount, currency, and related technical references needed for reconciliation and support.
3.10 Sign-in and recovery data
For account security, we process sign-in methods and verification records, including registered passkey identifiers and public keys, authenticator settings and secrets, and backup-code verification material. Your passkey private key stays with your device or passkey provider.
3.11 Saved draft data
For unpublished Vehicle → Car drafts saved to your account or a company workspace, we store the draft details, supplied source notes or links, ownership scope, version, and creation and update times.
3.12 Connected app authorizations
When you connect an MCP client, we process the app identity, requested and granted access scopes, authorization and token records, and connection and revocation times.

4. Legal Basis for Processing

4.1 Contract performance
Processing needed to create accounts, provide marketplace functionality, save requested drafts, and manage connected-app access that you authorize.
4.2 Legal obligations
Processing needed to comply with applicable laws, lawful requests, and record-keeping requirements.
4.3 Legitimate interests
Processing needed to secure, operate, and improve the platform, including fraud prevention and service reliability.
4.4 Consent where required
Where specific processing requires consent, we will rely on consent and provide ways to manage it where applicable.
4.5 Messenger and notification processing
We process Messenger data to perform our contract with you by delivering requested communications. We rely on legitimate interests to secure the service, prevent abuse, investigate reports, and keep it reliable. Browser notification permission is controlled by you through your browser and device settings.

5. How We Use Your Data

5.1 Deliver the marketplace service
Operate your account, process listings, and provide customer support.
5.2 Provide Platform Messenger
Deliver conversations between users, including replies, reactions, read and presence features, contact requests or shares, and notification delivery where you have enabled it.
5.3 Support wallet top-ups
Create and verify payment sessions, reconcile pending attempts, and maintain accurate wallet balances.
5.4 Maintain platform reliability
Monitor performance, collect error reports and diagnostic traces, resolve incidents, and protect against abuse.
5.5 Enforce legal and policy requirements
Apply our Terms, handle disputes and violations, and respond to lawful requests.
5.6 Save and synchronize drafts
Let you and authorized company team members resume, edit, check, and delete unpublished Car drafts across devices.
5.7 Manage connected app access
Verify your identity, record the draft access you approve, enforce that access, and let you revoke it.

6. How Data Is Shared

6.1 Payment provider (Stripe)
Wallet top-ups are handled by Stripe. When you start a top-up we send you to Stripe's own payment page, so your card number and CVC are entered on Stripe's site and never reach ours. We keep only the amount, the payment status, and Stripe's reference for the transaction.
6.2 Service providers
We may share data with vendors that host, secure, or support platform operations under appropriate contractual safeguards.
6.3 Bot protection (Cloudflare)
Sign-in, registration, and password-reset forms use Cloudflare Turnstile to tell real visitors apart from automated abuse. Cloudflare receives your IP address and basic technical details about your browser to make that check, and also uses these signals to improve its own bot detection. This protects accounts, so it runs without a consent choice, and we never use it for advertising or analytics.
6.4 Error monitoring (Sentry)
We may send technical error reports to Sentry so we can diagnose faults. Reports do not include your account details, cookies, or what you typed, and we never record your screen. Sentry does receive the IP address of the connection that reported the error.
6.5 Messenger recipients and operations
Messenger content and related state are available to the conversation counterpart and, for company accounts, authorised company team members with access to that account. Authorised moderators may review reported content and nearby context. Infrastructure and browser push providers process the data needed to host, secure, and deliver the service or notifications.
6.6 Legal and compliance disclosures
We may disclose data where required by law, lawful authority request, or to protect rights, users, and platform integrity.
6.7 Connected apps you authorize
An MCP client you approve can receive the draft data allowed by its granted scopes. Write access also permits it to create, edit, validate, and delete drafts. The external app handles data it receives under its own privacy practices; revoking 1TEMS access cannot erase copies it already received.
6.8 Authorized company team members
Company drafts are available to team members who have permission to create posts for that company. Personal drafts are available to the account holder.

7. Saved Drafts and Connected Apps

Unpublished Car drafts saved to your account or company workspace are stored on 1TEMS servers so they can be resumed across devices. A separate browser-only form draft can remain on the device where you started it.

A connected app can access only the draft information covered by the scopes you approve and the account or company permissions you have. The app cannot publish a listing or charge your wallet. You review and submit the listing in 1TEMS.

You can manage connected apps and revoke access in the MCP guide. Revocation prevents future access through 1TEMS; it does not delete your saved drafts or information already received by the external app.

8. Platform Messenger and Browser Notifications

Platform Messenger lets eligible users communicate about listings. We process its content and metadata to provide the requested communication features, protect users, prevent fraud and abuse, investigate reports, and comply with legal obligations.

Messenger data can include message content, conversation and listing references, replies, reactions, timestamps, read state, mute or block choices, presence state, contact requests, and contact details shared by a user. We process this data primarily to perform our contract with you and, where needed, for our legitimate interests in security, moderation, service reliability, and dispute handling.

Your counterparty can see the information you send or share. For company accounts, authorised company team members may access conversations for that company. Authorised moderators may access a reported message and nearby context. Infrastructure providers and browser push providers process limited data as needed to operate, secure, or deliver Messenger and notifications.

Browser notifications are optional. You can allow, block, or revoke them in your browser or device settings. Push notifications identify the relevant conversation so the device can route the alert, but they do not include message text. We process the subscription endpoint, keys, language, user-agent information, and delivery metadata needed to send and troubleshoot notifications.

1TEMS does not routinely read private conversations. Access is limited to reported content and a few nearby messages for moderation, to authorised company team members for that company's conversations, and to what the law requires. Messages are protected in transit and by access controls, but they are not end-to-end encrypted, so do not share highly sensitive information such as payment card numbers, passwords, or identity document scans in Messenger.

We retain Messenger, report, and notification data only for the periods described in this policy and according to the feature lifecycle, security needs, dispute handling, and applicable legal requirements.

9. Cookies and Similar Storage

We use strictly necessary cookies and equivalent technical storage to keep core platform features working, such as authentication and security controls.

We keep your cookie choices in this browser’s local storage (1tems_cookie_banner) for 180 days. When you enable Preferences, the first-party 1tems_preferences_consent cookie records that permission and its expiry for the same period. It is removed when you withdraw permission and does not enable Analytics or Marketing.

Some continuity features may rely on browser local or session storage, for example language continuity, the splash screen and notice dismissals, password-reset attempt limits, and unfinished listing or registration drafts (car-form-data and user-form-data). A registration draft can include the account details you have typed, excluding your password, and stays in this browser until you finish, discard, or clear it. If you enable Analytics, Google Analytics 4 may set analytics cookies or use similar browser storage to help us understand site usage and improve the product.

If you enable Marketing, Google Ads may use advertising storage, user-data signals, and ad personalization to measure and improve our advertising. These Google Ads permissions remain denied when Marketing is disabled.

Browser-only unfinished listing or registration drafts remain on the device where they were entered. Car drafts saved under Posts are also stored on our servers and can be resumed across devices, as described in Saved Drafts and Connected Apps.

10. Optional Preferences

Preferences consent is separate from Analytics and Marketing consent. You may allow it on its own, decline it while allowing another optional category, or withdraw it at any time in Cookie settings.

With Preferences consent, after a successful sign-in to an active account, 1TEMS stores the first-party better-auth.last_used_login_method cookie for 30 days. Its method label may be credentials (email and password), email-otp, passkey, google, or two-factor. It contains no email address, password, authenticator secret, or backup code, does not keep you signed in, and is not stored as login-method history in our database.

With Preferences consent, the email address you type on the sign-in form is kept in this browser's local storage (lastLoginEmail) so we can prefill it on the sign-in and password-reset forms. It never leaves your browser, is not linked to analytics or advertising, and is removed as soon as you withdraw Preferences consent or choose Only necessary.

If you make no choice or choose Only necessary, we do not use this last-used cookie. Withdrawing Preferences consent removes the cookie and its hint. You can still sign in with any available method. You can change your choice in Cookie preferences on this page or in your account settings.

11. Strictly Necessary Cookies We Set

These storage technologies support core functionality, security, or remembering your consent choices. Optional last-used sign-in hints are controlled separately under Preferences.

11.1 Consent record
Records your Preferences consent for 180 days so we can honor your choice.
11.2 Authentication and session security
Keeps you signed in, maintains secure session continuity, and protects account access.
11.3 Security and abuse prevention
Helps detect suspicious behavior and maintain platform integrity.
11.4 Essential preference continuity
Keeps essential platform preferences, such as language continuity, available across core flows.
11.5 Interface state you choose
Remembers interface choices you make yourself: the collapsed or expanded dashboard sidebar (sidebar_state), Messenger focus mode (1tems_messenger_focus), and your selected wallet view (dashboard_wallet_context). These first-party cookies store only your own setting, are not used to track you across sites, and are not shared with third parties.

12. Data Security

We apply technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or loss.

No online service can guarantee absolute security, but we continuously work to strengthen our controls and incident response.

13. Retention and Control

Authentication/session-related technical records are retained for operational and security purposes for only as long as needed under applicable requirements.

Wallet top-up transaction metadata and related ledger records are retained as required for accounting, fraud prevention, dispute handling, and legal compliance.

Account information is kept while your profile remains active or as otherwise required by law.

Messenger conversations and related metadata follow the lifecycle of the related listing, account, and, where applicable, company account. They may become read-only earlier, and are permanently deleted when that lifecycle ends, subject to legal obligations or holds.

Open and in-review reports, including reported content and nearby-context evidence, are retained until the report is closed. Closed report evidence is retained for 90 days, subject to legal obligations or holds.

Finalised push delivery work is generally purged after 24 hours. Revoked or invalid push subscription records may be retained as needed for security, endpoint ownership and integrity, troubleshooting, and legal obligations.

Messenger rate-limit counters, including the keyed hash of the client network address, are kept only for the applicable limit window and then purged. Sent messages cannot be edited or individually deleted by users, and conversation data is permanently deleted when the related listing is deleted or terminated, when a participant's account is terminated, or when a seller company account is deleted, subject to legal obligations or holds.

Server-saved drafts remain while they are listed in Posts. You can delete them there; they may also be removed after successful listing submission. Revoking a connected app does not delete your drafts. Authorization grants and access records are kept as needed to operate and secure connections; revoked tokens cannot be used to obtain further draft access through 1TEMS.

14. Your Rights

14.1 Access and correction
You may request access to your personal data and request correction of inaccurate or incomplete information.
14.2 Deletion and restriction
Where applicable, you may request deletion or restriction of processing, subject to legal and operational retention requirements.
14.3 Objection and complaints
Where applicable, you may object to certain processing and may file a complaint with your local supervisory authority, including the Data State Inspectorate of Latvia.

15. Changes to This Policy

We may update this policy from time to time. Material updates will be communicated where required, and the effective date will be updated accordingly.

16. Contact Us

If you have questions about privacy or want to exercise your rights, contact [email protected]. For general support matters, contact [email protected].

Effective date: September 24, 2026

1TEMS uses your data to deliver a secure, localized marketplace experience.

1. Overview

This policy explains what personal data we process, why we process it, how long we keep it, and what rights you may have.

By using the platform, you acknowledge this policy alongside our Terms of Use.

2. Data Controller

For the activities described in this policy, 1TEMS acts as the controller of your personal data.

If you have privacy questions, contact us at [email protected].

3. Data We Collect

3.1 Account and profile data
Information you provide during registration and profile use, such as email, account identifiers, and optional profile details.
3.2 Listing and communication data
Content you publish, edit, or submit through platform features, including listing details and support messages.
3.3 Platform Messenger data
When you use Platform Messenger, we process message content and metadata, including conversation and listing references, message timestamps, replies, reactions, read status, mute and block settings, presence state, and contact requests or contact details that you choose to share.
3.4 Reports and moderation evidence
If you submit or are connected to a Messenger report, we process the report, the reported message, and nearby conversation context needed to assess the report, protect users, and enforce our rules.
3.5 Messenger anti-abuse and snapshot data
For Messenger rate limiting, we process the client network address only as a keyed hash; the raw IP address is not stored for this purpose, and short-lived rate-limit counters are purged after the limit window. Each message stores a snapshot of the sender's display name and, where relevant, company name, each conversation stores a snapshot of the listing title and thumbnail, and report records store snapshots of the message, listing, and participant references so history remains readable and reports remain reviewable as they were at the time.
3.6 Push notification subscription data
If you enable browser notifications, we process the push subscription endpoint, encryption keys, selected language, user-agent information, and delivery metadata such as attempted or successful delivery and timestamps.
3.7 Technical and security data
Operational and security signals such as session-related records, timestamps, abuse-prevention information, error diagnostics, and performance traces required to run and improve the service.
3.8 Approximate country detection
When you access 1TEMS, our network or infrastructure provider may supply a country-level signal derived from your connection. We use it at request time to display an approximate localized country hint. We do not request GPS coordinates or precise device location, and we do not store the derived country in cookies, browser storage, or our application database.
3.9 Payment transaction metadata
For wallet top-ups, we store operational metadata such as payment processor session identifiers, payment status, amount, currency, and related technical references needed for reconciliation and support.
3.10 Sign-in and recovery data
For account security, we process sign-in methods and verification records, including registered passkey identifiers and public keys, authenticator settings and secrets, and backup-code verification material. Your passkey private key stays with your device or passkey provider.
3.11 Saved draft data
For unpublished Vehicle → Car drafts saved to your account or a company workspace, we store the draft details, supplied source notes or links, ownership scope, version, and creation and update times.
3.12 Connected app authorizations
When you connect an MCP client, we process the app identity, requested and granted access scopes, authorization and token records, and connection and revocation times.

4. Legal Basis for Processing

4.1 Contract performance
Processing needed to create accounts, provide marketplace functionality, save requested drafts, and manage connected-app access that you authorize.
4.2 Legal obligations
Processing needed to comply with applicable laws, lawful requests, and record-keeping requirements.
4.3 Legitimate interests
Processing needed to secure, operate, and improve the platform, including fraud prevention and service reliability.
4.4 Consent where required
Where specific processing requires consent, we will rely on consent and provide ways to manage it where applicable.
4.5 Messenger and notification processing
We process Messenger data to perform our contract with you by delivering requested communications. We rely on legitimate interests to secure the service, prevent abuse, investigate reports, and keep it reliable. Browser notification permission is controlled by you through your browser and device settings.

5. How We Use Your Data

5.1 Deliver the marketplace service
Operate your account, process listings, and provide customer support.
5.2 Provide Platform Messenger
Deliver conversations between users, including replies, reactions, read and presence features, contact requests or shares, and notification delivery where you have enabled it.
5.3 Support wallet top-ups
Create and verify payment sessions, reconcile pending attempts, and maintain accurate wallet balances.
5.4 Maintain platform reliability
Monitor performance, collect error reports and diagnostic traces, resolve incidents, and protect against abuse.
5.5 Enforce legal and policy requirements
Apply our Terms, handle disputes and violations, and respond to lawful requests.
5.6 Save and synchronize drafts
Let you and authorized company team members resume, edit, check, and delete unpublished Car drafts across devices.
5.7 Manage connected app access
Verify your identity, record the draft access you approve, enforce that access, and let you revoke it.

6. How Data Is Shared

6.1 Payment provider (Stripe)
Wallet top-ups are handled by Stripe. When you start a top-up we send you to Stripe's own payment page, so your card number and CVC are entered on Stripe's site and never reach ours. We keep only the amount, the payment status, and Stripe's reference for the transaction.
6.2 Service providers
We may share data with vendors that host, secure, or support platform operations under appropriate contractual safeguards.
6.3 Bot protection (Cloudflare)
Sign-in, registration, and password-reset forms use Cloudflare Turnstile to tell real visitors apart from automated abuse. Cloudflare receives your IP address and basic technical details about your browser to make that check, and also uses these signals to improve its own bot detection. This protects accounts, so it runs without a consent choice, and we never use it for advertising or analytics.
6.4 Error monitoring (Sentry)
We may send technical error reports to Sentry so we can diagnose faults. Reports do not include your account details, cookies, or what you typed, and we never record your screen. Sentry does receive the IP address of the connection that reported the error.
6.5 Messenger recipients and operations
Messenger content and related state are available to the conversation counterpart and, for company accounts, authorised company team members with access to that account. Authorised moderators may review reported content and nearby context. Infrastructure and browser push providers process the data needed to host, secure, and deliver the service or notifications.
6.6 Legal and compliance disclosures
We may disclose data where required by law, lawful authority request, or to protect rights, users, and platform integrity.
6.7 Connected apps you authorize
An MCP client you approve can receive the draft data allowed by its granted scopes. Write access also permits it to create, edit, validate, and delete drafts. The external app handles data it receives under its own privacy practices; revoking 1TEMS access cannot erase copies it already received.
6.8 Authorized company team members
Company drafts are available to team members who have permission to create posts for that company. Personal drafts are available to the account holder.

7. Saved Drafts and Connected Apps

8. Platform Messenger and Browser Notifications

9. Cookies and Similar Storage

We use strictly necessary cookies and equivalent technical storage to keep core platform features working, such as authentication and security controls.

10. Optional Preferences

Preferences consent is separate from Analytics and Marketing consent. You may allow it on its own, decline it while allowing another optional category, or withdraw it at any time in Cookie settings.

11. Strictly Necessary Cookies We Set

These storage technologies support core functionality, security, or remembering your consent choices. Optional last-used sign-in hints are controlled separately under Preferences.

11.1 Consent record
Records your Preferences consent for 180 days so we can honor your choice.
11.2 Authentication and session security
Keeps you signed in, maintains secure session continuity, and protects account access.
11.3 Security and abuse prevention
Helps detect suspicious behavior and maintain platform integrity.
11.4 Essential preference continuity
Keeps essential platform preferences, such as language continuity, available across core flows.
11.5 Interface state you choose
Remembers interface choices you make yourself: the collapsed or expanded dashboard sidebar (sidebar_state), Messenger focus mode (1tems_messenger_focus), and your selected wallet view (dashboard_wallet_context). These first-party cookies store only your own setting, are not used to track you across sites, and are not shared with third parties.

12. Data Security

We apply technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or loss.

No online service can guarantee absolute security, but we continuously work to strengthen our controls and incident response.

13. Retention and Control

Authentication/session-related technical records are retained for operational and security purposes for only as long as needed under applicable requirements.

Wallet top-up transaction metadata and related ledger records are retained as required for accounting, fraud prevention, dispute handling, and legal compliance.

Account information is kept while your profile remains active or as otherwise required by law.

14. Your Rights

14.1 Access and correction
You may request access to your personal data and request correction of inaccurate or incomplete information.
14.2 Deletion and restriction
Where applicable, you may request deletion or restriction of processing, subject to legal and operational retention requirements.
14.3 Objection and complaints
Where applicable, you may object to certain processing and may file a complaint with your local supervisory authority, including the Data State Inspectorate of Latvia.

15. Changes to This Policy

We may update this policy from time to time. Material updates will be communicated where required, and the effective date will be updated accordingly.

16. Contact Us

If you have questions about privacy or want to exercise your rights, contact [email protected]. For general support matters, contact [email protected].

Privacy Policy

View sections

1. Overview

2. Data Controller

3. Data We Collect

4. Legal Basis for Processing

5. How We Use Your Data

6. How Data Is Shared

7. Saved Drafts and Connected Apps

8. Platform Messenger and Browser Notifications

9. Cookies and Similar Storage

10. Optional Preferences

11. Strictly Necessary Cookies We Set

12. Data Security

13. Retention and Control

14. Your Rights

15. Changes to This Policy

16. Contact Us

Cookie preferences

Privacy Policy

View sections

1. Overview

2. Data Controller

3. Data We Collect

4. Legal Basis for Processing

5. How We Use Your Data

6. How Data Is Shared

7. Saved Drafts and Connected Apps

8. Platform Messenger and Browser Notifications

9. Cookies and Similar Storage

10. Optional Preferences

11. Strictly Necessary Cookies We Set

12. Data Security

13. Retention and Control

14. Your Rights

15. Changes to This Policy

16. Contact Us

Cookie preferences