1) Scope & Who We Are

This Privacy Policy applies to information collected through nmestateauctions.com, our auction platform, our communications with you (email, phone, chat), and any in-person interactions related to our services.

Who we are: Mesilla Valley Estate Sales, LLC, doing business as New Mexico Estate Auctions, a New Mexico limited liability company located in Las Cruces, New Mexico. We provide online estate auction, liquidation, and consignment services.

This policy does not apply to: third-party websites linked from our site, including services we use to deliver our business (Stripe, AuctionWorx, etc.). Those services have their own privacy policies, which we link to where applicable.

2) Information We Collect

We collect the following categories of information. Not all categories apply to every user — what we collect depends on how you interact with us.

Identity & contact information

• Full name
• Postal address (billing and pickup/shipping)
• Email address
• Phone number
• Username (publicly visible when you bid)

Account & bidding information

• Account credentials (password is stored as a one-way hash; we never have access to the plaintext)
• Bid history, watchlist, purchase history
• Communication preferences and notification settings
• Records of correspondence with our team

Payment information

• Credit/debit card details are entered directly into our payment processor (Stripe) and tokenized. MVES does not store, see, or have access to your full card number.
• For ACH, wire transfer, or check payments, we may collect routing and account information as necessary to process the transaction.
• Billing address and transaction history

Identity verification information

The credit card you provide at registration is used to authenticate you as a bidder. We may also collect additional identity verification information when required for higher-value transactions (e.g., vehicle purchases requiring titled-asset documentation).

Tax information

For consignors, we may collect Social Security Number or Tax ID for required 1099 reporting when sale proceeds meet IRS thresholds.

Device & usage information

• IP address
• Browser type and version, operating system, device type
• Pages viewed, lots watched, search queries on our site
• Date and time of access, referring page
• Cookies and similar tracking technology (see Cookies & Tracking)

Information we do not collect

• We do not collect biometric data, precise geolocation, religious affiliation, political views, health information, or other sensitive personal information categories defined by law.
• We do not knowingly collect any information from children under 13 (see Children's Privacy).

3) How We Collect Information

• Directly from you — when you register, bid, pay, contact support, or correspond with us.
• Automatically — through cookies, server logs, and similar technology when you use our website.
• From service providers — for example, our payment processor confirms whether your card is valid; our auction platform records your bidding activity.
• From public sources — for fraud prevention and identity verification, we may consult publicly available records when investigating suspicious activity.

4) How We Use Information

We use the information we collect to:

• Operate your account — register you, authenticate logins, manage bids and purchases, send invoices and notifications.
• Process payments — charge cards, process other approved payment methods, issue refunds, generate settlement statements for consignors.
• Coordinate pickup and shipping — share necessary information with our team and (if applicable) shipping vendors of your choice.
• Communicate with you — auction reminders, outbid notifications, invoice delivery, pickup coordination, and customer support.
• Send marketing — only with your consent or where allowed by law. You can opt out at any time.
• Prevent fraud and abuse — verify bidder identity, investigate suspicious activity, enforce our Terms & Conditions, and protect against unauthorized access.
• Comply with legal obligations — tax reporting (including 1099 issuance to consignors), record-keeping for state Gross Receipts Tax, response to lawful subpoenas or court orders.
• Improve our services — analyze how the site is used, fix problems, develop new features.

We do not use your information for purposes you wouldn't reasonably expect from the categories above without first asking your permission.

5) Who We Share Information With

We do not sell your personal information. We do not share your personal information with third parties for their own marketing or advertising purposes. We do share information in the following limited circumstances:

Service providers who help us operate

The following third parties process data on our behalf, under contractual obligations to keep it secure and use it only for the services they provide to us:

Shipping vendors of your choice

When you opt to have items shipped, we provide your contact information and pickup details to UPS, FedEx, or another shipping vendor you select. Those vendors handle your shipment under their own terms and privacy policies.

Local delivery contractors

If you choose to use one of the independent local delivery contractors referenced on our Help page, you contact them directly. We do not share your information with them unless you ask us to.

Legal and safety

We may share information when required by law (subpoena, court order, tax authority request), to enforce our Terms & Conditions, to protect the rights, property, or safety of MVES, our users, or others, or in connection with an investigation of suspected fraud or illegal activity.

Business transfers

If MVES is acquired by, merged with, or sells substantially all of its assets to another company, your information may be transferred to the new owner as part of that transaction. Any new owner would be bound by the commitments in this Privacy Policy or provide equivalent protections.

6) Cookies & Tracking

Cookies are small data files placed on your device that help websites function and remember your preferences. We use cookies and similar tracking technologies for:

• Essential operation — keeping you logged in, remembering items in your watchlist, processing payments. These cannot be disabled without breaking site functionality.
• Security — fraud detection, bot prevention (provided by Cloudflare).
• Analytics — understanding how users navigate the site so we can improve it. (Note: confirm whether MVES uses Google Analytics, Plausible, Fathom, or another analytics tool, and update this section accordingly.)

Browser settings: Most browsers allow you to control cookies through settings. Disabling essential cookies will prevent the site from working correctly. Disabling analytics cookies has no effect on functionality.

Do Not Track signals: We currently treat all users consistently and do not change our practices in response to Do Not Track browser signals. We do not sell personal information regardless of these signals.

Global Privacy Control (GPC): Where applicable state laws require, we honor opt-out preference signals communicated by the Global Privacy Control or similar tools.

7) Data Retention

We keep your information only as long as we need it for the purposes described in this policy, or as required by law:

• Account information: for as long as your account is active. If you close your account, we retain certain records as described below.
• Transaction records (invoices, payments, settlement statements): seven (7) years, to comply with tax and audit requirements.
• Consignor 1099 information: seven (7) years per IRS retention rules.
• Communications and correspondence: up to three (3) years.
• Website logs and analytics: typically 90 days to 13 months depending on the source.
• Suspended account records: indefinitely, for fraud prevention and to prevent re-registration by suspended users.

When we no longer have a business or legal reason to keep your information, we securely delete or anonymize it.

8) Data Security

We take reasonable steps to protect your information from unauthorized access, alteration, disclosure, or destruction:

• Encryption in transit — all communication with our website uses HTTPS/TLS encryption.
• Payment isolation — credit card details are handled directly by Stripe (PCI-DSS Level 1 certified) and are not stored on our systems.
• Access controls — staff access to customer data is limited to those with a legitimate need, and access is logged.
• Password security — your password is stored as a one-way cryptographic hash; even our staff cannot see your password.
• Vendor security — service providers we use are required by contract to maintain industry-standard security practices.

No system is perfectly secure. While we work to protect your information, we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and applicable authorities as required by law, typically within 30 days of discovery.

9) Your Rights & Choices

Regardless of where you live, you can:

• Access the personal information we have about you.
• Correct inaccurate information through your account settings or by contacting us.
• Delete your account and associated personal information, subject to records we are required to retain by law (e.g., transaction records for tax purposes).
• Receive a copy of your information in a portable format.
• Opt out of marketing emails by clicking "unsubscribe" in any marketing email, or by updating your notification preferences. Transactional emails (invoices, pickup notifications, account security) cannot be opted out of without closing your account.
• Object to certain uses of your information.

How to exercise these rights: Email [email protected] with your request, or call 575-639-0213. We will verify your identity (typically by confirming details from your account) before fulfilling the request. We aim to respond within 30 days; complex requests may take up to 45 days, in which case we will notify you.

No retaliation: We will not deny you service, charge different prices, or provide a lower quality of service because you exercised any of these rights.

10) State-Specific Rights

Residents of certain U.S. states have additional rights under state privacy laws:

California (CCPA / CPRA)

If you are a California resident, you have the rights described in Section 9 above plus the right to:

• Know the specific categories of personal information collected, the sources, the purposes, and the categories of third parties with whom it is shared (all of which are described in this policy).
• Limit the use and disclosure of "sensitive personal information" as defined by the CCPA. We do not collect sensitive personal information as defined by the law.
• Opt out of any "sale" or "sharing" of personal information. We do not sell or share your personal information for cross-context behavioral advertising.
• Designate an authorized agent to make requests on your behalf.

To exercise California rights, email [email protected]. Verification will be required.

Colorado, Connecticut, Texas, Virginia, Utah, Oregon, Delaware, Iowa, New Hampshire, New Jersey, Montana, Tennessee, Indiana, Kentucky, Rhode Island, Maryland, Minnesota, Nebraska

Residents of these states have rights similar to those described in Section 9, including access, correction, deletion, portability, and opt-out of targeted advertising and sale of personal information. Some states allow you to appeal a denial of your request; if we deny your request, we will explain how to appeal.

To exercise these rights, use the contact methods in Section 9. Verification will be required.

Other states

Even if your state does not have a comprehensive privacy law, we extend the rights described in Section 9 to all users.

11) Children's Privacy

Our services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are under 13, please do not register, bid, or provide us with any personal information.

Bidders must be at least 18 years of age to register or bid (see our Terms & Conditions).

If we learn that we have collected personal information from a child under 13, we will delete it. If you believe we may have inadvertently collected such information, contact [email protected].

12) Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Post the updated policy on this page with a new "Last updated" date.
• For material changes, notify registered users by email and/or by posting a notice on our site at least 30 days before the changes take effect.
• Maintain the version in effect at the time of any transaction as the version that governs that transaction.

Continued use of our services after the effective date of an updated policy constitutes acceptance of the updates.

13) Contact Us

For questions about this Privacy Policy or to exercise any of the rights described above: