Privacy Policy

This Privacy Policy explains how HDC Brands LLC ("we") collects, uses, and shares information when you use PilotMarket. PilotMarket is owned and operated by HDC Brands LLC and is developed and produced under the Carbon Grey Labs brand, which is not a separate legal entity. By using the service you agree to this Policy. We do not sell your personal information, and we do not sell your content for AI training.

1. Who is responsible

HDC Brands LLC, New Jersey, USA, powered by carbongreylabs.com. Privacy contact: support@carbongreylabs.com.

2. What we collect

• Account data: email, name, phone (optional), and login identifiers if you use social sign-in.
• Listing data from the Pilot apps: when a seller publishes from VinPilot, HomiPilot, or BoatPilot, the source app transmits the approved listing package to us: title, description, price, location, item or property attributes, photos with their enhancement labels, provenance statements, and the app account reference needed to link the listing to its seller. Each source app's own privacy policy governs what happens inside that app.
• Buyer inquiry data: when you contact a seller, the name, contact information, and message you enter, plus related submission metadata.
• Saved searches & alerts: the email address and search criteria you save, where offered.
• Advertiser data: company, contact details, campaign settings, and billing records for advertising products.
• Payment data: processed entirely by Stripe. We never see or store full card numbers.
• Usage & device data: logs, IP address, approximate location, device/browser info, and identifiers needed to operate, secure, and (with consent) analyze the service.
• Support & communications: messages, attachments, support requests, feedback, consent records, and administrative communications with us.

3. How we use it

We use data to operate, secure, and improve the marketplace; display published listings; relay buyer inquiries to sellers; run and measure advertising products; compute informational features such as deal ratings; process payments; prevent abuse and fraud (including listing review and duplicate detection); comply with law; and respond to support requests. With your separate opt-in, we may send saved-search alerts, newsletters, and promotions. Our legal bases, where applicable, are performance of our contract with you, your consent, and our legitimate interests in operating and securing the service.

4. Who we share it with

We share data only as needed to operate the marketplace:

• Supabase (database, authentication, file storage)
• Vercel (web hosting)
• Stripe (payments)
• The Pilot apps (VinPilot, HomiPilot, BoatPilot): listing status updates and buyer leads flow back to the source app so the seller sees them where they manage the listing
• Analytics providers, where enabled, under consent as described in Section 8
• Sellers: when you send an inquiry on a listing, we share your entered name, contact details, and message with that listing's seller. We do not sell or share a listing's leads with other sellers or advertisers.

Service providers are bound by contract to process data only on our behalf and only to deliver the service. If you want to know the specific providers behind any category above, email support@carbongreylabs.com. We may also disclose information to comply with law or legal process, to enforce our Terms, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice where required).

4A. Government & public-authority data requests

When a government or public authority asks us for your information, we require the request to be made in writing and we review it for legal validity, proper jurisdiction, scope, and authority before disclosing anything. We reject or challenge requests that are unlawful, invalid, excessively broad, or inconsistent with applicable law. Where disclosure is legally required, we disclose only the minimum information necessary to comply with the valid request. We document each request and, where appropriate, consult qualified legal counsel before responding. Where the law permits, we will notify you of a request affecting your information.

5. Public content

Published listings are public: their content, photos, price, approximate location, seller display name, and status are visible to anyone and may be indexed by search engines once the site is open to indexing. Sellers control listing privacy options offered in the source app (for example hiding an exact address). Unpublishing or removal takes a listing off PilotMarket, but we cannot guarantee that a third party or search engine never copied or archived content while it was public.

6. Your privacy rights

Depending on where you live (including under the CCPA/CPRA in California and similar U.S. state laws), you may have the right to know, access, correct, delete, or obtain a portable copy of your personal information, and to opt out of "sale" or "sharing" of personal information and of targeted advertising. We do not sell or share your personal information for cross-context behavioral advertising. We do not discriminate against you for exercising these rights. To make a request, email support@carbongreylabs.com; we verify requests using your account information and respond within the time the law requires (generally 45 days). You may use an authorized agent where the law allows. We honor Global Privacy Control as an opt-out signal for optional cookies.

6A. Appeals

Where applicable law gives you a right to appeal our decision on a privacy request, email support@carbongreylabs.com with the subject "Privacy Appeal" within a reasonable period after receiving our decision. We will review the appeal and respond within the period required by applicable law. If a New Jersey privacy appeal is denied and applicable law requires it, we will provide a method to contact the New Jersey Division of Consumer Affairs to submit a complaint.

7. Retention

We keep your data while your account or listings are active and as needed to provide the service, then for a limited period to meet legal, tax, accounting, security, and dispute-resolution needs, after which we delete or de-identify it. You can request deletion at any time as described above; some records (for example transaction records) may be retained where the law requires.

8. Security, cookies & local storage

Data is encrypted in transit, database access is controlled with row-level security, and secrets are stored server-side only. No method of transmission or storage is 100% secure. Report concerns to support@carbongreylabs.com. PilotMarket currently uses only the cookies and local storage essential to operate the site. If we introduce optional analytics or marketing cookies, they will run only after you accept them through a consent banner, you will be able to change your choice at any time, and Global Privacy Control signals will keep optional cookies off.

9. Children, U.S.-only service & changes

PilotMarket is for adults (18+) and is not directed to children; we do not knowingly collect personal information from anyone under 18 (or under 13 under COPPA). If you believe a child provided us data, contact us and we will delete it. PilotMarket is intended for users in the United States, and information is processed in the U.S. We may update this Policy; material changes take effect when posted with a new "Last updated" date. Marketing email is optional and never required to use PilotMarket; service messages about your account, listings, inquiries, and purchases are not promotional.