Privacy policy

Last updated: July 22, 2026

This Privacy Policy explains how CDX Auction (cdxauction.com and related marketplace domains), operated as part of the SpotPro / Coin Dealer X network (“we,” “us”), collects, uses, shares, and protects personal information when you use our buyer marketplace, APIs, emails, and related services (the “Service”).

By using the Service, you acknowledge this Policy and our Terms of Service. SpotPro seller accounts, ExtraCoins stores, and other network products may have additional notices.

1. Who we are

CDX Auction is a marketplace product in the SpotPro / Coin Dealer X network. Operational contact for privacy requests: info@spotpro.us. The Service is hosted primarily in the United States.

2. Information we collect

2.1 You provide

2.2 Collected automatically

• Device & log data — IP address, browser user agent, approximate request times, pages/API endpoints hit, referrers
• Session cookies — e.g. cdxauction_sess for login, CSRF tokens for form security
• Device fingerprint identifier — a browser-stored identifier (and related coarse signals) used to detect multi-account abuse
• Risk & security telemetry — risk scores/flags, fraud event logs (e.g. registration attempts, login failures, card declines, holds), rate-limit counters

2.3 From sellers and SpotPro systems

When you interact with a dealer’s lot, we associate activity with that seller’s SpotPro subscription data needed for the listing (company name, store slug, public profile fields the dealer chose to show, payment method configuration, store location ZIP for pickup distance checks).

2.4 From service providers

Delivery and processing partners may return limited status data (e.g. email accepted/bounced, SMS sent/failed, payment gateway approve/decline codes and transaction references—not full card numbers stored by us).

3. How we use information

• Provide the Service — accounts, bidding, offers, invoices, watchlists, favorites, seller stores, help content
• Transactional communications — verification links, outbid, ending soon, won/pay, shipping/payment updates, offer updates, security notices
• In-app notifications — optional inbox/bell messages related to your account activity
• Fulfillment — share win, shipping, phone, and payment-status details with the selling dealer so they can collect payment and ship or arrange pickup
• Trust & safety — prevent fraud, card testing, fake addresses, multi-accounting, and abuse; apply security holds; enforce Terms
• Operations & improvement — debugging, analytics of feature use in aggregate, capacity planning, beta quality
• Legal compliance — respond to lawful requests, protect rights, and maintain records

We do not sell personal information for money. We do not use buyer contact lists for unrelated third-party marketing without a separate opt-in.

4. How we share information

4.1 Selling dealers

If you bid on, win, or pay for a lot, the seller receives information needed to complete the transaction, which may include display name, email, phone, shipping address, invoice amounts, payment method/status, billing ZIP/name when you paid by card, risk notes/flags related to that payment, pickup distance estimates, and identity attestation status (not necessarily full ID numbers).

4.2 Service providers

• Email delivery (e.g. SMTP providers) to send transactional mail branded as CDX Auction
• SMS providers (e.g. Twilio) to send phone verification codes when SMS is enabled
• Hosting / infrastructure for servers, backups, and security monitoring
• Seller payment processors when you pay by card on a seller’s merchant account (Authorize.Net, CARDZ3N/NMI, PayPal, etc.)

4.3 Legal and safety

We may disclose information if we believe it is required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of users, dealers, or the public.

4.4 Business transfers

If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction under appropriate confidentiality.

4.5 Public areas

Some information may be visible to other users by design (e.g. public lot pages, limited bidder masking rules, seller store profiles, feedback you leave). Do not post secrets in public fields.

5. Cookies & similar technologies

• Essential session cookie — cdxauction_sess (and related session storage) to authenticate buyers and maintain CSRF protection
• Local storage — e.g. a device fingerprint key used for fraud signals

You can clear cookies and site data in your browser; you will need to log in again and may look like a new device for fraud checks. We do not currently use third-party advertising cookies on the core auction checkout flow for cross-site ad retargeting. If that changes, we will update this Policy.

6. Fraud prevention & automated signals

To protect sellers and the marketplace, we use a combination of rules and automated scoring. Signals may include account age, email/phone verification status, address/ZIP consistency, billing vs shipping match, card velocity and declines, device fingerprint multi-account links, IP reputation-style rate limits, and historical risk flags.

Outcomes can include blocking registration or login attempts, requiring SMS or identity steps, refusing a payment method, placing a card payment in a security hold for seller review, or suspending accounts. These systems are imperfect; contact us if you believe a decision was made in error.

7. Payments & financial data

• CDX Auction invoices track amounts, status, method labels, and processor transaction references.
• Full card numbers and CVV are not stored in CDX Auction databases. Card data is tokenized in the browser to the seller’s processor where card pay is offered.
• Offline methods (Zelle, wire, etc.) may store the reference text you enter when you report payment.
• We are not your bank and do not provide consumer credit.

8. Retention

We retain information for as long as needed to:

• Operate your account and complete transactions;
• Meet legal, tax, accounting, and dispute needs;
• Maintain fraud and security records (which may outlast a single auction);
• Honor backup and disaster-recovery cycles.

Short-lived data (password reset/verify tokens, SMS OTPs) is designed to expire quickly. When you request deletion, we will delete or de-identify personal data where feasible, except where we must keep records (e.g. completed sales, fraud investigations, legal holds).

9. Security

We use industry-reasonable measures such as HTTPS, password hashing, access controls, and operational monitoring. No online service is completely secure. You can help by using a unique password, keeping verification codes private, and reporting suspicious activity to info@spotpro.us.

10. Your choices & rights

• Profile & shipping — update under My account → Settings
• Email preferences — toggle outbid, ending soon, won, favorites, and digest emails in Settings
• Phone verification — request or complete SMS verification in Settings when required for payments
• Access / correction / deletion — email info@spotpro.us from your account email; we may verify identity before fulfilling
• Marketing — transactional auction mail is part of the Service; optional digests can be turned off in Settings

11. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from children under 13 (or under 16 where that standard applies). If you believe a child provided information, contact us and we will take appropriate steps to delete it.

12. International users

If you access the Service from outside the United States, you understand that your information may be processed in the U.S. and other countries that may have different data-protection rules than your country. Where required, we rely on appropriate contractual or other transfer mechanisms with processors.

13. U.S. state privacy (including California)

Depending on your state, you may have rights to request access, correction, deletion, or a copy of certain personal information, and to appeal a denial. California residents may also have rights under the CCPA/CPRA regarding “sale” or “sharing” for cross-context behavioral advertising. We do not sell personal information as we understand that term, and we do not share it for cross-context behavioral advertising in the ordinary operation of CDX Auction.

Categories of personal information we collect (for CCPA-style disclosures) include identifiers (email, IP, account ID), commercial information (bids, invoices), internet/network activity (logs, device id), geolocation derived from ZIP for pickup distance, and sensitive information only to the limited extent you provide it for verification (e.g. phone, government ID last four for attestation)—used for security and fulfillment, not for selling.

To exercise rights, email info@spotpro.us with the subject “Privacy request.” We will not discriminate against you for exercising privacy rights.

14. Changes

We may update this Policy from time to time. The “Last updated” date will change when we do. Material changes may also be highlighted on the site or by email. Continued use after the effective date means you accept the updated Policy.

15. Contact

Privacy questions or requests:
info@spotpro.us
CDX Auction · SpotPro / Coin Dealer X network
Web: cdxauction.com · Docs: docs.cdxauction.com · Terms: Terms of Service