Privacy Policy

1. Who We Are

OffMarket is operated by AH360 Photography LLC ("we," "us," "our"), located in Coconut Creek, Florida. OffMarket is a broker-to-broker matching platform for off-market yacht and boat transactions. The platform is exclusively for licensed yacht brokers — it is not a consumer-facing service.

Contact: steve@ah360views.com

2. Information We Collect

We collect the following personal information during registration and platform use:

• Account information: First name, last name, email address, phone number, firm name
• Professional credentials: Florida DBPR license number, IYBA/YBAA/CPYB membership status
• Vessel listing data: Builder, model, year, specifications, pricing, location region
• Buyer mandate data: Purchase criteria, budget parameters, preferences
• Platform activity: Match interactions, messages, file attachments, timestamps
• Technical data: IP address, user agent, device information (for security and rate limiting)

3. How We Use Your Information

• To verify your identity as a licensed broker and maintain platform integrity
• To match vessel listings with buyer mandates based on your specified criteria
• To facilitate anonymous and revealed communication between matched brokers
• To maintain the introduction registry for commission protection documentation
• To send transactional notifications about matches, messages, and account activity
• To enforce rate limits, detect suspicious activity, and prevent platform abuse
• To maintain an immutable activity log for dispute resolution

4. Information Visibility and the Reveal System

OffMarket uses a controlled identity reveal system. Before either broker reveals their identity:

• Other brokers see only your platform tier, reputation score, and verified transaction count
• Your name, firm, email, phone, and license number are hidden
• Vessel listings show specifications only — no vessel name, marina, or owner details

When you choose to reveal your identity to a specific counterparty broker, they gain access to your name, firm name, email, and phone number for that match only. Reveals are permanent and cannot be undone.

When both brokers reveal, an introduction is automatically registered with an 18-month grace period for procuring cause documentation.

5. Data Storage and Security

Your data is stored in Supabase (PostgreSQL), which provides encryption at rest and in transit. We implement:

• Row-level security on all database tables
• HTTPS enforcement with HSTS preloading
• Content Security Policy to prevent cross-site scripting
• Server-side field whitelisting on all API responses
• Private storage buckets for file attachments with time-limited signed URLs

6. Data Sharing

We do not sell, rent, or share your personal information with third parties for marketing purposes. Your data is shared only in the following circumstances:

• With matched brokers: Only after you explicitly choose to reveal your identity
• Service providers: Supabase (database), Twilio (phone verification), Resend (email delivery), Vercel (hosting)
• Legal compliance: When required by law, court order, or regulatory authority

7. Data Retention

• Active listings: Retained while active; auto-paused after 90 days without reconfirmation
• Buyer mandates: Expire automatically after 90 days
• Introduction registry: Retained for the duration of the 18-month grace period
• Activity logs: Retained indefinitely as an immutable audit trail for dispute resolution
• Messages: Retained indefinitely as part of the platform audit trail
• Account data: Retained while account is active; available for deletion upon request

8. Your Rights

You may request access to, correction of, or deletion of your personal information by contacting us at steve@ah360views.com. Please note that certain data (introduction registry records, activity logs) may be retained for legal and dispute resolution purposes even after account deletion.

9. Changes to This Policy

We may update this privacy policy from time to time. Active brokers will be notified of material changes via email. Continued use of the platform after changes constitutes acceptance of the updated policy.