Privacy Policy

This Privacy Policy explains how Daytime Consulting ("we", "us") collects, uses, stores and shares personal information when you use Soda at soda.watches. It applies to dealers, applicants, their staff and anyone who contacts us. Soda is a business-to-business service, but the people behind each business still have privacy rights and we take them seriously.

1. Who is responsible

Daytime Consulting is the controller of your personal information for the purposes described here. You can reach us, including our privacy lead, at support@soda.watches. We have not appointed a Data Protection Officer or an EU or UK representative because the law does not currently require us to; if that changes, we will add their details here.

2. Information we collect

Account and contact information. Full legal name, preferred name, email address (verified), mobile phone number, WhatsApp number, country of residence, job title and your role in the business, and the employees you invite.

Verification (KYC/KYB) information. To keep the network trade-only and safe we verify every dealer. This includes:

Identity: government-issued photo ID (front and back), a selfie of you holding that ID, date of birth, residential address and a recent proof of address (such as a utility bill or bank statement). Selfies are currently reviewed manually by our team; we may later use a specialist identity-verification provider (see section 4).
Business: legal and trading name, business type, business registration number and registration document, tax/VAT/GST number, business address and business proof of address, whether you trade from a physical store or online only, and for brick & mortar stores, photos of the storefront and interior if you add them. Also years in business, brands you deal in and estimated volume.
Trust signals: the dealer groups you are active in (for example WhatsApp, Facebook or Signal groups), your profiles on other platforms (such as Chrono24 or eBay), your website and social media accounts, and how you heard about us or who referred you.
Screening: where we carry it out, results of sanctions, politically-exposed-person (PEP) and adverse media screening, and information about beneficial owners and directors.
Consistency checks: we compare details across your application (for example the name, country and address on your payment card against your application). A mismatch is flagged for manual review by our team, never used to reject you automatically, because business owners often pay with a personal card.

When you give us information about other people, such as employees, please make sure they know you are sharing it.

Payment and shipping details for trades. The bank, Zelle, crypto or other details your company uses to receive payment from other dealers (including the account holder name), and your shipping addresses. These are shown only to the other party inside a deal.

Subscription billing. When you apply you add a payment card through Stripe. The card is saved but not charged until your account is approved, and is removed if your application is declined. We receive limited details from Stripe (such as the cardholder name, card brand, last four digits, expiry and billing country and address); we never see or store your full card number.

Activity on the Platform. Listings (including photos and videos), private inventory fields such as cost price and notes, Mark as Sold actions, offers, trade offers and "Sold to a dealer" sales, bids and auction activity, Looking For posts, deals, tracking numbers and packaging photos or videos, deal documents, messages, reviews, vouches, follows, reports, referrals, feedback and support conversations.

Deal documents. Files that either business attaches to a deal (for example invoices, receipts or shipping documents, as PDF, JPG or PNG) with their label and note, every replaced version, and a record of each time someone opens or downloads one (who and when).

Feedback. When you use "Send feedback" we keep what you write (the type, your message and any rating), up to 3 screenshots you choose to add, and details attached automatically to help us understand the problem: the address of the page you were on, a summary of your device and browser (including the browser's technical "user agent" text), your window size, and your user and business numbers. We also keep the conversation with our team about it, and our staff may add internal notes and tags.

Referrals. When someone applies through a referral link we record the referral code, which team member's link was used (if any), when the referral was attached to the application, and the referral's progress (applied, approved, paid, rewarded or reversed). To prevent self-referrals we compare details of the referrer and the referred business (see "Consistency checks" above and section 3).

Billing status. Whether your company's subscription payments are up to date, failed payments and retries, grace-period and restriction dates, card expiry dates (from Stripe) and any grace extension our staff give, with its reason.

Technical information. IP address, device and browser type, log data, approximate location derived from IP, and cookie data as described in our Cookie Policy, including the referral cookie that remembers which referral link you opened.

3. How we use it

To verify you and keep the Platform trade-only (legal obligation and legitimate interests in preventing fraud).
To provide the Platform and its features, and to bill you (performance of our contract with you).
To keep the Platform secure: detecting fraud, counterfeit activity, shill bidding and account takeover, including sending email confirmations when payment details change (legitimate interests; legal obligation).
To moderate content, provide support and resolve disputes, including through staff access to accounts as described in section 5 (legitimate interests; contract).
To communicate with you about your account, auctions you take part in and changes to our terms (contract; legitimate interests). This includes account-critical billing alerts: if a subscription payment fails we email you when the grace period starts and 24 hours before your account would be restricted, and when it is restricted and when cards are about to expire. These alerts are sent even if you have switched off other emails, because they protect your access to the Platform; they never contain marketing.
To run the referral program: crediting the right referrer, showing the referrer on their referral page (section 6), and checking referrals for abuse by comparing the referrer's and the new applicant's details (such as registration or tax number, addresses, phone numbers, email domain, website, business name, team members, payment details and the fingerprint of the payment card that Stripe gives us, not the card number). A match is flagged for review by our team, never used to reject anyone automatically (contract; legitimate interests in preventing fraud).
To read, answer and act on feedback you send us, and to improve the Platform (legitimate interests).
To send product news and offers, where you have agreed or where the law allows, with an easy opt-out (consent or legitimate interests).
To comply with law, respond to lawful requests and enforce our terms (legal obligation; legitimate interests).

We do not sell your personal information, and we do not use your verification documents for marketing.

Contact forms and marketing emails. When you use our contact, help or demo forms we keep your name, email, phone number, business name and message to answer your request and follow up on it. Whether we may also send you product news and offers depends on where you are, which we work out from your phone number's country code (or, if that isn't clear, the country of your internet connection):

United States: the "Send me updates and offers" box starts ticked; you can untick it.
Canada: if you tick the box, we may email you until you unsubscribe. If you don't, but you sent us an enquiry or asked for a demo, we may email you for 6 months from that enquiry (implied consent under Canada's anti-spam law).
United Kingdom, European Economic Area and everywhere else: only if you tick the box.

Every marketing email has an unsubscribe link, and unsubscribing always takes effect, whatever the basis.

4. How verification data is stored and who can see it

Verification data is the most sensitive information we hold, so it gets the strictest handling:

Encrypted. Documents and images are encrypted in transit (TLS) and at rest.
Private storage. Files are kept in private storage buckets that are never publicly accessible. They are served only through short-lived, signed links generated for an authorised request.
Need-to-know access. Only a small number of authorised staff in our trust and compliance team can view verification documents, and only when needed to review an application, investigate a report or meet a legal obligation.
Access logging. Every view of a verification document is logged with who viewed it, when and why. Logs are reviewed regularly.
Other dealers never see your documents. They see only that you are verified and the business profile details you choose to publish.
Verification providers. Selfie and ID checks are currently reviewed manually by our team. We may later use a specialist identity-verification provider to check documents, run liveness checks and screening. Any provider acts as our processor under a written contract.

5. Staff access to accounts, messages and documents

Our authorised staff may access any account, including its messages, listings, deals, private inventory fields and documents, for moderation, customer support, fraud prevention and investigation, and dispute resolution, and where the law requires.

Staff must select a stated reason (for example a dispute, support ticket or fraud investigation) and link the related case where there is one before opening an account.
Every access and action is logged in an audit log (who, what, when and why). Access is limited by staff role and the logs are reviewed.
Staff open deal documents with a recorded reason, and each opening is logged. Feedback and its screenshots can be read only by the person who sent it and by staff with permission to view feedback.
Staff view accounts read-only by default. Acting on your behalf, for example correcting contact details at your request, requires an extra confirmation and is logged.
Deletions are soft deletes. When content or records are deleted, by you or by staff, they are hidden first and may be kept for a period so authorised staff can restore them if needed, for example after a mistake or for a dispute. We permanently delete soft-deleted data when it is no longer needed for those purposes, or when you exercise your right to deletion and no legal duty requires us to keep it.

Other dealers. Your name is shown with your company, your company rank (Owner, Admin or Employee) and the flag of your country as Full Name (Company Name) [Rank] on listings, bids, messages, reviews, vouches and the dealer directory. Auction bid histories show every bidder's real name, company and rank, the amount and the time. Your public business profile (including your city, postal code where shown, country, website and socials you add) is visible to verified dealers. Your phone numbers and email address are never shown on your profile, listings, the directory or in search: other dealers message you on the Platform. Your phone number and email, payment details and shipping details are shown only to the other party inside a confirmed deal (and, while a middleman works on a booking, to that middleman).
Your referral page. Every referral link opens a public page that shows the person who shared it (for a company's own link, the company's Owner or an Admin), with their name, profile photo, company name, company logo, country and badges (such as Verified or Founding Member), to anyone who has the link, whether or not they are a member. When the link is shared in a messaging app, a preview image with the same name and photo or logo may be shown. These pages are not indexed by search engines. Sharing your link is your choice to show these details to the people you send it to; if you do not want them shown, do not share the link. Pages stop working when the business or person is no longer active.
Other dealers in a deal or trade. A private inventory item you include in a trade offer is shown to the other party in that offer only. Deal documents are visible to both businesses in the deal (and to our authorised staff), and the other business can see when a document was opened.
Counterparties when payment details change. If your company changes its payment details while it has open deals, the other dealers in those deals are notified and the deal page shows the date of the change.
Your connected stores (Shopify, eBay, Chrono24). If you connect a store on the Team plan, we send it the watch details, photos and prices you choose to publish. From that store we receive only what we need to keep your inventory in step: order numbers, amounts, item codes and stock levels. We never request or store the names, emails, phone numbers or addresses of your store's customers. Store access keys are encrypted.
Service providers acting on our instructions: hosting and database, file storage, payments (Stripe), email delivery, identity verification, analytics and customer support tools.
Professional advisers, such as lawyers and auditors.
Authorities, where the law requires, or where we believe in good faith it is necessary to prevent fraud, crime or harm.
A buyer or successor if our business is sold or reorganised, subject to this policy.

7. International transfers

We serve dealers in North America, the Middle East and Asia and our providers may process data in countries other than yours, including the United States. Where we transfer personal information across borders we use appropriate safeguards, such as standard contractual clauses or equivalent mechanisms, and we assess the protections of the destination country. Our main database and file storage are hosted in the United States (US East).

8. How long we keep it

Account data: for as long as your account is open and for 3 years afterwards, to deal with queries and disputes.
Verification data and screening results: for 5 years after the end of our relationship, or longer if anti-money-laundering or other laws require.
Rejected applications: documents and verification data from declined applicants are kept for 1 year after the decision (so we can handle re-applications, appeals and fraud checks) and then deleted automatically. The payment card saved at signup is removed when the application is declined.
Soft-deleted content: only as long as needed to restore mistakes, handle disputes or meet legal duties, then permanently deleted (see section 5).
Messages and transaction records: for 6 years, to help with disputes, fraud investigations and tax and accounting duties.
Deal documents: stored in private storage and served only through short-lived signed links. Documents a business removes are hidden from both businesses but kept, with their view records, for 6 years for disputes and investigations.
Feedback and screenshots: screenshots are stored in private storage, readable only by the sender and authorised staff. Feedback is kept for 3 years.
Referral records: for as long as either business's account is open and for 2 years afterwards, to handle reward and abuse questions.
Connected-store data: kept while the store is connected; deleted when you disconnect or uninstall our app (or when the store asks us to erase it). Sales already recorded in your inventory stay in your records.
Billing records: as long as tax law requires.
Access logs: 2 years.

When data is no longer needed we delete or anonymise it securely.

9. Your rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you and receive a copy.
Correct inaccurate or incomplete information.
Delete your information, subject to legal retention duties.
Restrict or object to certain processing, including processing based on legitimate interests and direct marketing.
Portability: receive information you provided in a machine-readable format.
Withdraw consent at any time, where we rely on consent.
Not be discriminated against for exercising your rights (for example under the California Consumer Privacy Act, CCPA/CPRA).
Know and opt out: California residents may request details of the categories of information we collect and share. We do not sell or "share" personal information for cross-context behavioural advertising.
Canadian residents have rights of access and correction under PIPEDA and may withdraw consent subject to legal or contractual restrictions.
Complain to your local data protection authority, such as a supervisory authority in the EU/UK, the Office of the Privacy Commissioner of Canada, or the relevant authority in your country.

To exercise any right, email support@soda.watches. We will verify your identity before acting and respond within the time the law requires (usually 30 days, or 45 days in California).

10. Security

Besides the controls in sections 4 and 5, we keep deal documents and feedback screenshots in private storage that is never publicly accessible, and we use role-based access controls, email confirmation of payment-detail changes, row-level security in our database, two-factor authentication for staff, regular backups, and monitoring. No system is perfectly secure; if a breach affects you we will notify you and the relevant authorities as the law requires.

11. Children

The Platform is for businesses and is not directed at anyone under 18. We do not knowingly collect information from children.

12. Changes to this policy

We will post any changes here and update the "Last updated" date. If changes are significant we will notify you by email or in the Platform.

13. Contact

Daytime Consulting, Edmonton, Alberta, Canada. Email: support@soda.watches.