Privacy Policy

This Privacy Policy describes how MET Liquidation LLC, a Michigan limited liability company that operates the website at shopsneakypetes.com (the "Site") and does business under the trade name (d/b/a) "Sneaky Pete's Bins & Auctions" (collectively, "Sneaky Pete's," "we," "us," or "our"), collects, uses, shares, and protects information about you when you use our Site or visit our physical store at 69651 US Hwy 131, White Pigeon, MI 49099. This Policy applies to information collected through the Site, our SMS and email communications, our physical store, and our consignment intake process. It does not apply to information collected by third parties whose services are linked from the Site (see Section 17). Geographic Scope: We are a Michigan-based business with a single physical location. All purchases require in-person pickup at our White Pigeon, MI store — we do not ship items. While our website is publicly accessible, our services are practically limited to customers who can physically visit our store, typically those located in Michigan, Indiana, Ohio, Illinois, and surrounding regions. The state-specific privacy rights described in Sections 14 and 15 of this Policy are extended to all U.S. users as a courtesy, regardless of whether the underlying state law strictly applies to a business of our size. By using our services, you agree to the practices described in this Policy. If you do not agree, please do not use our services. This Policy is incorporated into and forms part of our Terms & Conditions.

Effective Date: May 13, 2026 We may update this Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. The "Effective Date" above will reflect the most recent revision. For material changes — such as new categories of personal information collected, new third-party recipients, or changes to your privacy rights — we will provide at least 30 days' advance notice by email to your account address and by prominent notice on the Site. For non-material changes, the updated Policy takes effect on posting. We review this Policy at least once every twelve months. Your continued use of our services after the Effective Date of any change constitutes acceptance of the revised Policy.

We collect the following categories of information: (a) Account Information. When you create an account, we collect your name, username, email address, phone number (if you choose to provide one), and a password (which we store only as a salted hash — never in plain text). (b) Transactional Information. As you use our services, we collect information about your activity: bids placed, items watched, items won or lost, purchases, scheduled pickup appointments, and notification preferences. (c) Payment Information. When you add a payment card, the card information is collected and tokenized by our payment processor, Square (Block, Inc.). We receive only a payment token, the card brand (Visa, Mastercard, etc.), the last four digits, and the expiration date. We never see or store full card numbers, CVV codes, or any sensitive cardholder data. (d) Communications. When you opt in to email or SMS notifications, we record your opt-in event, the date and time, your IP address at the time of opt-in, and your preferences for each notification type. We also maintain logs of messages sent to you (subject line, type, delivery status). (e) Consignment Submissions. If you submit items through our "Sell With Us" page, we collect your name, contact information, item descriptions, and any photos you upload. Photos may contain incidental personal information; please do not include images of identification documents or other sensitive items. (f) Automatic Information. When you visit the Site, we automatically collect technical information including your IP address, browser type and version, operating system, referring URL, pages visited, and the date and time of your visit. We collect this information through standard server logs and through cookies (described in Section 7). (g) In-Store Observations. If you visit our physical store, we may use security cameras for safety and loss-prevention purposes. Footage is retained for a limited period and reviewed only as needed for security incidents. We do not collect biometric information, government identification numbers, health information, precise geolocation, or other categories of "sensitive personal information" as defined under California law.

We use your information for the following purposes: • Account Management: To create and maintain your account, authenticate you, and provide customer support. • Auction Operation: To accept bids, run auctions, determine winners, generate invoices, and facilitate pickup. • Payment Processing: To charge your card on file when you win an auction or complete a purchase. Payment processing is performed by Square; we do not process payments directly. • Communications: To send you transactional notifications (outbid alerts, win confirmations, pickup reminders, appointment reminders, refund/return request confirmations, refund decision notices, account updates) and marketing communications by email (you can opt out at any time, see Section 6). For marketing SMS, your separate, explicit opt-in is required and a transactional SMS opt-in does not count as marketing consent. • Personalization: To remember your watchlist, your preferences, and your A/B test variant assignment (see Section 7). • Security & Fraud Prevention: To detect and prevent fraud, abuse, unauthorized access, shill bidding, and violations of our Terms & Conditions. • Analytics: To understand how the Site is used so we can improve it. We use only aggregated, first-party analytics provided by Vercel. • Legal Compliance: To comply with applicable laws, respond to lawful requests from government authorities, enforce our Terms & Conditions, and protect our rights and the rights of others. We do not use your information for cross-context behavioral advertising, profiling for automated decision-making that produces legal effects, or any other purpose not described in this Policy.

When you opt in to receive SMS (text message) notifications, the following applies: Sender Identification: SMS messages are sent on behalf of Sneaky Pete's Bins & Auctions (a d/b/a of MET Liquidation LLC). Every message we send begins with our brand identifier "Sneaky Pete's:" so you know who the message is from. What You Will Receive: Transactional messages related to your account and bidding activity, including outbid alerts, win notifications, auction-ending reminders, pickup deadline reminders, appointment reminders, refund/return request confirmations, refund approval and denial notices, and account updates. With separate consent, you may also receive occasional marketing or promotional messages. Sample Messages: • "Sneaky Pete's: You were outbid on Bose Soundbar. Current bid $42. Bid again: shopsneakypetes.com/auctions/item/abc123" • "Sneaky Pete's: You won Bose Soundbar for $87! Pickup by Fri May 22. Schedule: shopsneakypetes.com/dashboard/pickups" • "Sneaky Pete's: Your pickup appointment is Wed May 21 at 2:00 PM. See you at 69651 US Hwy 131, White Pigeon, MI." • "Sneaky Pete's: We received your refund request for Bose Soundbar. Bring the item in by Fri May 29, 5:00 PM. Details: shopsneakypetes.com/dashboard/returns" How to Opt In: You may opt in to SMS by (a) checking the unchecked-by-default SMS consent box when you provide your phone number during account creation on our sign-up page, or (b) checking the SMS toggle on the Communication Preferences page (/dashboard/preferences) inside your account, after the master SMS toggle has been enabled. Both opt-in points prominently display the consent language, the verbatim "Msg & data rates may apply" disclosure, message-frequency disclosure, STOP/HELP keyword instructions, and a link to this Privacy Policy. You may also opt in through other channels we offer (in-store sign-up, contest entries) where the consent language and this Policy are clearly disclosed at the point of opt-in. Message Frequency: Frequency varies based on your activity. A typical bidder receives 0–10 messages per week during active bidding; non-bidding accounts may receive fewer than one message per month. Costs: Message and data rates may apply, depending on your mobile carrier and plan. We do not charge you for messages. How to Opt Out: Reply STOP, STOPALL, UNSUBSCRIBE, OPTOUT, CANCEL, END, REVOKE, or QUIT to any SMS we send to stop further messages. Reply HELP for help. You can also turn off SMS notifications at any time on the Communication Preferences page in your account. Opt-out is immediate. No Third-Party Sharing of Mobile Information: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All categories of information described in this Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Service Providers: We use third-party providers (currently Twilio, and potentially Plivo or another qualified provider in the future) to deliver SMS on our behalf. These providers process your phone number and message content only to deliver the messages we send. They are contractually prohibited from using your information for their own marketing or sharing it with third parties. First-Party Consent: We collect SMS opt-in directly from you through our Site and store. We do not purchase, lease, accept, or otherwise use opt-in lists from third parties. Consent Is Not a Condition: Your consent to receive SMS is not required to create an account, place a bid, or make a purchase. Records of Consent: We retain records of your opt-in (including timestamp and IP address) and any opt-outs for the period required by the federal Telephone Consumer Protection Act (TCPA), currently four years.

Transactional Emails: When you create an account, you agree to receive transactional emails necessary for the operation of your account, including win notifications, payment confirmations, pickup reminders, account-security alerts, and order-related communications. These messages are exempt from the unsubscribe requirement under the CAN-SPAM Act because they are necessary for our transactional relationship with you. Marketing Emails: After creating an account you may receive marketing or promotional emails about new auctions, special bin store events, and store announcements. This is a default setting on your account that you can change at any time. Every marketing email includes an unsubscribe link in the footer, and you can also turn marketing emails off entirely on the Communication Preferences page at /dashboard/preferences. We honor unsubscribe requests within 10 business days as required by the CAN-SPAM Act. Transactional emails (account, order, refund, pickup, appointment, return decisions) are unaffected by this opt-out — you continue to receive them while your account is active because they are required for the operation of your account. Postal Address Disclosure: All marketing emails include our physical mailing address: Sneaky Pete's Bins & Auctions, 69651 US Hwy 131, White Pigeon, MI 49099. You May Opt Out: of marketing emails at any time by clicking the unsubscribe link in any email, by adjusting your preferences in your account, or by emailing info@shopsneakypetes.com. Opting out of marketing does not opt you out of transactional emails. Service Provider: We use Resend (https://resend.com) as our email delivery provider. Resend processes your email address and message content only to deliver our emails. Email-delivery providers may temporarily access your email metadata for delivery, fraud prevention, and abuse detection purposes.

We use a small number of cookies on the Site, all of which are first-party and either strictly necessary for the Site to function or limited in scope to operational measurement. Cookies We Use: • Authentication Cookies (Supabase). When you sign in, our authentication provider (Supabase) sets cookies prefixed with "sb-" to keep you logged in. These cookies are strictly necessary, HTTP-only, and expire when you sign out or after the session expires. • A/B Test Cookie (ab_signup_cta). When you visit the Site, our middleware may set a first-party cookie named "ab_signup_cta" with a randomly assigned value (e.g., "pink" or "red"). This cookie is used only to ensure you see a consistent version of our Sign-Up call-to-action button during an internal experiment and to measure conversion. It does not contain personal information and is not shared with any third party. The cookie expires after approximately 30 days. • Hosting / Analytics Cookies. Our hosting provider, Vercel, may set first-party cookies to aggregate Site analytics (page views, traffic sources). These are limited in scope, IP-anonymized at the aggregation level, and not used to build user profiles. What We Do NOT Use: • No Google Analytics, Google Ads, or other Google tracking cookies. • No Meta (Facebook) Pixel. • No TikTok Pixel, X (Twitter) Pixel, or other advertising platform trackers. • No third-party advertising cookies. • No cookies that share information with third parties for cross-context behavioral advertising. Managing Cookies: You can disable cookies in your browser settings, but doing so may prevent you from signing in to your account or using key features of the Site. Do Not Track Signals: We do not currently respond to "Do Not Track" browser signals. Because we do not engage in cross-context behavioral advertising, there is no targeted-ad activity to opt out of. Global Privacy Control (GPC): If your browser sends a Global Privacy Control signal, we will treat it as a request to opt out of any "sale" or "sharing" of personal information for purposes of California law — even though we do not engage in such activities.

We share your information only as needed to provide our services or as required by law. We do NOT sell your personal information and we do NOT share it for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act. Service Providers (Data Processors): We share information with the following service providers, which process information on our behalf and under contract: • Supabase (https://supabase.com) — database hosting, authentication, and file storage. Stores account data, bid history, watchlist, preferences, and consignment photos. • Square / Block, Inc. (https://squareup.com) — payment processing and card-on-file storage. Handles all cardholder data on our behalf. • Twilio (https://www.twilio.com) — SMS message delivery. Processes phone numbers and message content for delivery only. • Plivo (https://www.plivo.com) — alternative SMS provider that may be used in addition to or in place of Twilio. Same scope as Twilio. • Resend (https://resend.com) — transactional and marketing email delivery. • Vercel (https://vercel.com) — Site hosting, DNS, and aggregated Web Analytics. Each of these providers is contractually obligated to use your information only to provide their service to us and not for their own purposes. Each maintains its own privacy practices, which you can review on their respective sites. Legal Disclosures: We may disclose information when we believe in good faith that disclosure is necessary to (a) comply with a subpoena, court order, or other legal process; (b) protect the rights, property, or safety of Sneaky Pete's, our users, or the public; (c) detect, prevent, or address fraud, security, or technical issues; or (d) enforce our Terms & Conditions. Business Transfers: If we are involved in a merger, acquisition, sale of assets, financing, or bankruptcy, your information may be transferred as part of that transaction. We will provide notice through the Site and by email to your account address before any such transfer takes effect, and the receiving entity will be bound by this Policy. Aggregated / De-Identified Information: We may share aggregated or de-identified information that cannot reasonably be used to identify you. For example, we may publish statistics about overall site traffic or auction trends.

All payment card processing is performed by Square (Block, Inc.), a payment processor validated as a PCI DSS Level 1 service provider. When you add a card to your account or make a purchase: • Your full card number, CVV, and other sensitive payment data are entered directly into a Square-hosted form embedded on our Site. We do not see, transmit, or store this data. • Square returns a secure token to us that represents your card. We store only the token along with non-sensitive details (card brand, last four digits, expiration date) to display in your account and to authorize charges when you win an auction. • When you make a purchase, we send Square the token and the amount; Square charges the card and returns a confirmation. Square's handling of your information is subject to Square's privacy notice, available at https://squareup.com/us/en/legal/general/buyer-features. By using our payment features, you acknowledge that Square processes your payment information under its own privacy practices. Because we use Square in this way, we are PCI DSS compliant by virtue of using a validated provider. We do not store, process, or transmit cardholder data on our own systems.

We retain personal information only as long as needed for the purposes described in this Policy or as required by law: • Account Data: Retained while your account is active. After account closure, we retain account data for 30 days for recovery purposes, then we delete or anonymize it (except as noted below). • Bid History & Transactional Records: Retained for seven (7) years to comply with IRS and Michigan Department of Treasury record-keeping requirements for business transactions. After account closure, this data is retained in anonymized form linked only to the underlying transaction. • Payment Tokens & Order Records: Seven (7) years. • Communication Preferences & Consent Records: Retained as long as your account is active. Records of SMS opt-in are retained for at least four (4) years to comply with the federal Telephone Consumer Protection Act (TCPA) statute of limitations. • Consignment Submissions: Photos and item descriptions are retained for two (2) years after the item sells or is returned, or until you request earlier deletion. • Server Logs & IP Addresses: Approximately 90 days, after which they are deleted or aggregated. • Security Camera Footage (Physical Store): Approximately 30 days unless retained longer for a specific security incident. When information is no longer needed, we securely delete or anonymize it.

We take reasonable measures to protect your information from unauthorized access, use, alteration, and disclosure: • Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS). • Encryption at Rest: Personal information stored in our Supabase database is encrypted at rest using industry-standard encryption. • Password Security: Passwords are stored only as salted hashes, never in plain text. • Tokenized Payments: Payment card data never touches our servers — we store only Square-generated tokens. • Access Controls: Access to personal information is restricted to authorized employees and contractors who need it to perform their work, and they are bound by confidentiality obligations. • Row-Level Security: Our database uses row-level security policies to ensure users can only access their own data. Despite these measures, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security. If we ever experience a data breach affecting your personal information, we will notify you in accordance with applicable law.

Our services are not directed to individuals under the age of 18. Our Terms & Conditions require all account holders to be at least 18 years old. We do not knowingly collect personal information from anyone under the age of 13. If you are a parent or guardian and believe we may have inadvertently collected information from a child under 13, please contact us at info@shopsneakypetes.com and we will delete the information promptly. If you are between 13 and 17 years old, please do not use our services without the supervision and consent of a parent or guardian who is at least 18.

Regardless of where you live in the United States, you have the following rights with respect to your personal information held by Sneaky Pete's: • Right to Access: You may request a copy of the personal information we hold about you. • Right to Correct: You may request that we correct inaccurate or incomplete information about you. You can update most account information directly through your account dashboard. • Right to Delete: You may request that we delete your personal information, subject to legal exceptions (e.g., we may retain transactional records to comply with tax law). • Right to Opt Out of Marketing: You may opt out of marketing emails and SMS at any time through the unsubscribe link, your account's Communication Preferences page, or by emailing info@shopsneakypetes.com. • Right to Portability: You may request a copy of your account data in a portable, machine-readable format. How to Exercise Your Rights: Email your request to info@shopsneakypetes.com with "Privacy Request" in the subject line. Include enough information for us to verify your identity (typically your account email and a description of the request). We will respond within 45 days. We may need to extend the response time by an additional 45 days for complex requests and will notify you if we do. We will not discriminate against you for exercising any of these rights. Authorized Agents: You may designate an authorized agent to make a privacy request on your behalf. We will require written authorization and verification of your identity before processing the request.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with additional rights regarding your personal information. Categories of Personal Information Collected (last 12 months): • Identifiers — name, username, email, phone, IP address, account ID. • Customer Records — name, contact information, payment-related metadata (tokenized). • Commercial Information — bid history, watchlist, purchases, transaction records. • Internet or Electronic Network Activity — pages visited, browsing behavior on the Site, interactions with notifications. • Geolocation Data — approximate location inferred from IP address (city/region level). • Inferences — derived from your activity to recommend items or improve service. Sources of Information: directly from you (account creation, bidding, consignment forms, communications); automatically from your device (cookies, server logs); from service providers (Square — payment confirmations). Business Purposes for Collection: account management, auction operation, payment processing, transactional and marketing communications, security and fraud prevention, legal compliance, internal analytics. See Section 4 for details. Categories of Recipients: service providers (Supabase, Square, Twilio, Plivo, Resend, Vercel — see Section 8); legal authorities upon valid request; successor entities in a business transfer. We do not share information with third-party advertisers, data brokers, or analytics providers that build cross-context profiles. Retention: see Section 10. Your California Rights: • Right to Know what personal information we have collected, used, disclosed, and sold or shared about you. • Right to Delete your personal information, subject to legal exceptions. • Right to Correct inaccurate personal information. • Right to Opt Out of the "sale" or "sharing" of personal information (we do not sell or share, but you can submit a Global Privacy Control signal as your opt-out preference). • Right to Limit Use of Sensitive Personal Information (we do not collect or use sensitive personal information for inferences). • Right to Non-Discrimination for exercising your rights. We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act. How to Exercise California Rights: email info@shopsneakypetes.com with "California Privacy Request" in the subject line. We will respond within 45 days. Authorized agents may submit requests on your behalf with written authorization. Notice at Collection: This Section, together with the rest of this Privacy Policy, serves as our Notice at Collection under the CCPA at the time you provide personal information to us. Shine the Light: California Civil Code §1798.83 permits California residents to request information about our disclosures (if any) of personal information to third parties for direct marketing purposes. We do not make such disclosures.

If you are a resident of Texas, Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Iowa, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota, Indiana, Tennessee, Florida, Rhode Island, Maryland, Kentucky, or any other state with a comprehensive consumer privacy law, you may have rights similar to those granted to California residents under your state's law, including the rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of the sale or targeted advertising use of your information. Although MET Liquidation LLC may not meet the volume thresholds that make those state laws strictly applicable to a business of our size, we honor these rights as a matter of policy upon request. Texas Residents: MET Liquidation LLC does not sell sensitive personal data as defined under the Texas Data Privacy and Security Act (TDPSA). How to Exercise These Rights: email info@shopsneakypetes.com with "Privacy Request" in the subject line and identify your state of residence. We will respond within 45 days.

Our services are intended for users physically located in the United States. We do not currently ship items outside the United States, and we do not direct our services to users in the European Union, the United Kingdom, Canada, or any other jurisdiction outside the United States. If you access the Site from outside the United States, you do so at your own risk and are responsible for compliance with the laws of your jurisdiction. By using our services, you consent to the transfer and processing of your information in the United States. We do not undertake to comply with the General Data Protection Regulation (GDPR), the UK Data Protection Act, the Canadian PIPEDA, or other non-US privacy laws.

The Site may contain links to third-party websites, services, or applications that are not operated by us (for example, links to manufacturer product pages, social media profiles, or our service providers' own privacy policies). We are not responsible for the privacy practices, content, or security of any third-party website or service. This Policy applies only to information we collect through our own services. We encourage you to review the privacy policies of any third-party services you visit.

For questions about this Privacy Policy, to exercise your privacy rights, or to report a concern, contact us: MET Liquidation LLC operating as shopsneakypetes.com and d/b/a Sneaky Pete's Bins & Auctions 69651 US Hwy 131 White Pigeon, MI 49099 Phone: (269) 724-1155 Email: info@shopsneakypetes.com For privacy-specific requests, please use the subject line "Privacy Request" (or "California Privacy Request" for California-specific requests) so we can route them appropriately. Disputes arising under this Privacy Policy are governed by the dispute resolution provisions of our Terms & Conditions.