Privacy Policy

Grafe Auction Privacy Policy

This privacy policy has been compiled to better serve those who are concerned with how their personal information is being used online. "Personal Data" or "Personal Information," as used in U.S. privacy law and information security, includes any information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. This includes, but is not limited to, names, email addresses, mailing addresses, phone numbers, credit card information, device identifiers, browsing history, and IP addresses. Please read our privacy policy carefully to get a clear understanding of how we collect, use, protect, or otherwise handle your Personal Data in accordance with our website.

1. What personal information do we collect from the people that visit our website?

When purchasing or registering on our site, as appropriate, you may be asked to enter your name, email address, mailing address, phone number, credit card information, bank account information (such as account and routing numbers for ACH payments), government-issued identification (such as a driver's license), device information (such as IP address or device type), or other details to help you with your experience.

Biometric Information: During account registration, we collect biometric information in the form of a selfie photograph and facial geometry data. This biometric data is used solely to verify that the person creating the account matches the photo on the government-issued ID document submitted during registration. See Section 1.A below for additional details on biometric data handling.

1.A. Biometric Data Notice

This notice applies to biometric information collected during identity verification, including facial geometry derived from selfie photographs.

Purpose: Biometric data is collected and processed solely to verify your identity during account registration by comparing your selfie to the photo on your government-issued ID document. This helps prevent fraud and ensures the security of our auction platform.

Third-Party Processing: Biometric data is collected and processed by our third-party identity verification provider, Stripe Identity (operated by Stripe, Inc.). Stripe's use of your biometric data is governed by their Privacy Policy.

Storage and Retention: Biometric data used for identity verification is processed by Stripe Identity and is not stored on Grafe Auction's servers. Stripe retains verification data in accordance with their data retention policies and applicable law. You may request deletion of your biometric data by contacting us (see Section 15), subject to legal retention requirements.

Consent: By creating an account and completing identity verification, you consent to the collection and processing of your biometric data for identity verification purposes. If you do not consent, you may contact us to discuss alternative verification methods, though this may limit your ability to participate in auctions.

Your Rights: Depending on your state of residence, you may have additional rights regarding your biometric data. See Section 12 (U.S. State Privacy Rights) for details on how to exercise your rights.

2. When do we collect information?

We collect information from you when you register on our site, complete identity verification, place a bid, or enter information on our site. Identity verification information (including government-issued ID images, selfie photographs, and phone number) is collected during the account registration process.

3. How do we use your information?

We may use the information we collect from you when you register, make a purchase, sign up for our newsletter, respond to a survey or marketing communication, surf the website, or use certain other site features in the following ways:

  • To personalize your experience and to allow us to deliver the type of content and product offerings in which you are most interested.
  • To improve our website in order to better serve you.
  • To allow us to better service you in responding to your customer service requests.
  • To quickly process your transactions and verify bidder eligibility.
  • To detect and prevent fraud, bid rigging, and other illegal activity.
  • To comply with legal obligations, including tax law and the Uniform Commercial Code.
  • To send periodic emails regarding your purchases or other products and services.
  • To follow up with you after correspondence (live chat, email, or phone inquiries).

4. How do we protect visitor information?

Our website is scanned on a regular basis for security holes and known vulnerabilities in order to make your visit to our site as safe as possible. Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential. In addition, all sensitive/credit information you supply is encrypted via Secure Socket Layer (SSL) technology.

We implement a variety of security measures when a user places a bid, purchases, enters, submits, or accesses their information to maintain the safety of your personal information.

All transactions are processed through a gateway provider and are not stored or processed on our servers.

5. Do we use 'cookies'?

Yes. Cookies are small files that a site or its service provider transfers to your computer's hard drive through your Web browser (if you allow) that enables the site's or service provider's systems to recognize your browser and capture and remember certain information.

Types of Cookies:

  • Essential Cookies: These cookies are necessary for the auction platform to function properly (e.g., login, bid placement). You cannot disable these without losing access to core features.
  • Advertising/Targeting Cookies: These cookies help us understand your preferences and enable third-party advertising networks to serve you personalized ads across other websites. You may disable these through your browser settings or by opting out in Section 8 (Behavioral Remarketing).

We use cookies to:

  • Help remember and process your purchases.
  • Understand and save user's preferences for future visits.
  • Compile aggregate data about site traffic and site interactions in order to offer better site experiences and tools in the future. We may also use trusted third-party services that track this information on our behalf.

You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser settings. Each browser is a little different, so look at your browser's Help menu to learn the correct way to modify your cookies.

If you disable essential cookies, some features will be disabled and may affect your ability to participate in auctions or access your account. If you disable advertising cookies, you will see fewer personalized ads, but the auction site will continue to function normally.

6. Third-party disclosure

We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information unless we provide users with advance notice. This does not include website hosting partners and other parties who assist us in operating our website, conducting our business, or serving our users, so long as those parties agree to keep this information confidential. We may also release information when its release is appropriate to comply with the law, enforce our site policies, or protect our or others' rights, property, or safety.

Identity Verification Provider: We use Stripe Identity (operated by Stripe, Inc.) to verify user identities during account registration. When you complete identity verification, your government-issued ID images, selfie photographs, facial geometry data, and phone number are transmitted to Stripe for processing. Stripe's handling of this information is governed by their Privacy Policy. Stripe uses this information solely to verify your identity and does not use it for marketing purposes.

Text Messaging Data (10DLC Compliance): Mobile phone numbers collected for SMS communications will not be shared with third parties or affiliates for marketing or promotional purposes. All mobile information used for transactional SMS (such as outbid alerts or auction notifications) will not be transferred to any third parties.

However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.

Occasionally, at our discretion, we may include or offer third-party products or services on our website. These third-party sites have separate and independent privacy policies. We, therefore, have no responsibility or liability for the content and activities of these linked sites. Nonetheless, we seek to protect the integrity of our site and welcome any feedback about these sites.

8. Behavioral Remarketing & Targeted Advertising

We use remarketing services to advertise on third-party websites to you after you have visited our site. We and our third-party vendors use cookies and other tracking technologies to inform, optimize, and serve ads based on your past visits to our site.

Global Privacy Control (GPC) & Universal Opt-Out:
Our website is configured to recognize and honor "Global Privacy Control" (GPC) signals or other universal opt-out mechanisms. If your browser broadcasts a GPC signal, we will automatically treat this as a request to opt out of the "sale" or "sharing" of your personal information for targeted advertising purposes.

Google Ads (AdWords)

Google Ads remarketing service is provided by Google Inc. You can opt out of Google Analytics for Display Advertising and customize the Google Display Network ads by visiting the Google Ads Settings page.

Google also recommends installing the Google Analytics Opt-out Browser Add-on for your web browser. This provides visitors with the ability to prevent their data from being collected and used by Google Analytics.

For more information on the privacy practices of Google, please visit the Google Privacy Terms web page.

Meta (Facebook & Instagram)

Meta remarketing service is provided by Meta Platforms, Inc. You can learn more about interest-based advertising from Meta by visiting this page. To opt out from Meta's interest-based ads, follow these instructions.

Meta adheres to the Self-Regulatory Principles for Online Behavioral Advertising. You can also opt out from Meta and other participating companies through the Digital Advertising Alliance in the USA http://www.aboutads.info/choices/, the Digital Advertising Alliance of Canada http://youradchoices.ca/ or the European Interactive Digital Advertising Alliance http://www.youronlinechoices.eu/, or opt out using your mobile device settings.

For more information on the privacy practices of Meta, please visit Meta's Data Policy.

9. Payments

We use third-party services for payment processing, including credit card and ACH (bank transfer) payments. We will not store or collect your payment card details or bank account credentials on our servers. That information is provided directly to our third-party payment processors whose use of your personal information is governed by their Privacy Policy.                                                                         

Credit Card Payments: Our payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council. PCI-DSS requirements help ensure the secure handling of payment card information.

ACH Payments: For ACH (bank transfer) payments, your bank account and routing numbers are transmitted securely to our payment processor. ACH transactions are governed by Nacha Operating Rules. Your bank account information is encrypted in transit and is not stored on our servers.

10. Children Online Privacy Protection Act (COPPA)

Our services are intended solely for users 18 years of age or older. We strictly prohibit registration and participation by anyone under 18. By registering or using our services, you represent and warrant that you are at least 18 years old.

We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with Personally Identifiable Information, please contact us. If we become aware that we have collected Personally Identifiable Information from children, we take steps to remove that information from our servers.

11. Data Retention

We retain your personal information for as long as necessary to provide our services, comply with our legal obligations, resolve disputes, and enforce our agreements. Generally, transaction records are retained for a minimum of seven (7) years for tax compliance and audit purposes, as required by federal and state law. Auction records, including consignment documentation, bidding history, and buyer information, are maintained in accordance with the Uniform Commercial Code (UCC) and state auction licensing requirements.

12. U.S. State Privacy Rights (California, Minnesota, and Other States)

This section applies to residents of California, Minnesota, Virginia, Colorado, Connecticut, Texas, Utah, Oregon, Montana, Iowa, Tennessee, New Jersey, Delaware, Indiana, Kentucky, and Rhode Island.

Effective July 31, 2025, the Minnesota Consumer Data Privacy Act (MCDPA) grants specific rights to our home state residents. Similarly, the California Privacy Rights Act (CPRA) and other state laws provide rights regarding your "Personal Information" or "Personal Data."

A. Your Rights

Depending on your state of residence, you may have the following rights:

  1. Right to Know and Access: You have the right to confirm whether we are processing your personal data and to access a copy of that data in a portable and, to the extent technically feasible, readily usable format.
  2. Right to Correct: You have the right to request that we correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing.
  3. Right to Delete: You have the right to request that we delete personal data provided by or obtained about you.
    • Auctioneer's Exemption: Please note that as a licensed auction firm, Grafe Auction is required by the Uniform Commercial Code (UCC), state auction statutes, and tax laws to maintain records of bids, sales, and consignments for specific periods (generally seven years). We may deny a deletion request if maintaining the information is necessary to comply with these legal obligations, resolve disputes, or enforce our agreements.
  4. Right to Opt-Out: You have the right to opt out of the processing of your personal data for purposes of:
    • Targeted Advertising: Displaying advertisements to you based on personal data obtained from your activity across non-affiliated websites (e.g., remarketing).
    • Sale of Personal Data: We do not sell your personal information to third parties for money. However, under definitions in California (CPRA) and Minnesota (MCDPA), sharing data with advertising networks (like Google or Meta) for targeted advertising may be considered a "sale" or "sharing." You may opt out of this.
    • Profiling: Automated processing of personal data to evaluate, analyze, or predict personal aspects concerning your economic situation, health, personal preferences, interests, reliability, behavior, location, or movements, specifically where such profiling produces legal or similarly significant effects.
  5. Right to Limit Use of Sensitive Personal Information: (California Residents) You have the right to limit the use of your "sensitive" personal information (such as government ID numbers, financial account credentials, or precise geolocation) to that which is necessary to perform the services or provide the goods reasonably expected by an average consumer.
  6. Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights. We will not deny you goods or services, charge you different prices, or provide a different level or quality of goods or services.
  7. California Shine the Light Disclosure: California residents may request a list of categories of personal information that Grafe Auction disclosed to third parties during the immediately preceding calendar year for those third parties' direct marketing purposes. To make this request, please contact us using the methods in Section 12.B and include "Shine the Light Request" in your communication.

B. How to Exercise Your Rights

To exercise any of the rights listed above, please submit a verifiable consumer request to us by:

C. Verification Process

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. To protect your security, we must verify your identity before fulfilling your request.

  • Password Protected Accounts: If you have a password-protected account with us, we may verify your identity through our existing authentication practices for your account.
  • Non-Account Holders: We may require you to provide information that matches the data we have on file (such as your email address, phone number, or recent bid history) to verify your identity.

D. Authorized Agents

You may designate an authorized agent to make a request on your behalf. To do so, you must provide the agent with written permission to do so or a power of attorney. We may deny a request from an agent that does not submit proof that they have been authorized by you to act on your behalf.

E. Right to Appeal

If we decline to take action regarding your request, we will inform you of our decision and the justification. You have the right to appeal our decision. To initiate an appeal, please contact us at info@grafeauction.com with the subject line "Privacy Appeal." If your appeal is denied, you may contact your state's Attorney General to submit a complaint.

13. CAN-SPAM Act

The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.

We collect your email address in order to:

  • Send information, respond to inquiries, and/or other requests or questions.
  • Process purchases and to send information and updates pertaining to purchases.
  • We may also send you additional information related to your purchases and/or our services.
  • Market to our mailing list or continue to send emails to our clients after the original transaction has occurred.

To be in accordance with CAN-SPAM we agree to the following:

  • NOT use false or misleading subjects or email addresses.
  • Identify the message as an advertisement in some reasonable way.
  • Include the physical address of our business or site headquarters.
  • Monitor third-party email marketing services for compliance, if one is used.
  • Honor opt-out/unsubscribe requests quickly.
  • Allow users to unsubscribe by using the link at the bottom of each email.

If at any time you would like to unsubscribe from receiving future emails, you can follow the instructions at the bottom of each email and we will promptly remove you from ALL correspondence.

Disclosure for Law Enforcement

Under certain circumstances, Grafe Auction may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency).

Grafe Auction may disclose your Personal Data in the good faith belief that such action is necessary to:

  • To comply with a legal obligation.
  • To protect and defend the rights or property of Grafe Auction.
  • To prevent or investigate possible wrongdoing in connection with the Service.
  • To protect the personal safety of users of the Service or the public.
  • To protect against legal liability.

15. Contacting Us

If there are any questions regarding this privacy policy, you may contact us using the information below.

Grafe Auction
261 Yeadon Ln NW
Stewartville, MN 55976

Phone: 800-328-5920

Email: info@grafeauction.com

Last Updated: January 23, 2026

Update History:

  • January 23, 2026 – Added identity verification disclosures for Stripe Identity integration. Added Section 1.A (Biometric Data Notice) covering collection, purpose, third-party processing, retention, consent, and user rights for facial geometry data collected during selfie verification. Updated Sections 1, 2, and 6 to reflect identity verification process including government-issued ID documents, selfie photographs, and phone verification. Removed address verification requirement for account creation.
  • January 22, 2026 – Added information regarding ACH payment acceptance and data collection regarding said payment.
  • January 12, 2026 – Comprehensive rewrite to reflect Minnesota Consumer Data Privacy Act (MCDPA, effective July 31, 2025), California Privacy Rights Act (CPRA), and 14 other active state privacy laws. Updated to include Global Privacy Control (GPC) support, clarified cookie types, expanded fraud/legal compliance disclosures, removed outdated "Fair Information Practices" and "Do Not Track" sections, strengthened COPPA/age verification language, removed specific payment processor names, added auctioneer exemption documentation, and reformatted for clarity and accessibility.
  • March 2, 2021 – Added California Shine the Light disclosure and California Consumer Privacy Act Notice.