01Scope
This Privacy Policy describes how Watch Safe, Inc., a Delaware corporation with its principal place of business in Miami, Florida (“Watch Safe,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information in connection with the websites operated at watchsafe.io and its subdomains, the Watch Safe registry, the collector vault, the partner portal, and related features (collectively, the “Services”). Capitalized terms used but not defined in this Privacy Policy have the meanings given in the Watch Safe Terms of Service.
Two design principles of the Services bear directly on privacy. First, the Registry uses owner-controlled release: a public serial number lookup returns only a status, and the full Registry Record is released only when the Owner shares a Verification Code. Second, we do not write personal information to any blockchain, as described in Section 5.
02Information We Collect
2.1 Information you provide.
(a) Waitlist. Your email address when you join the waitlist.
(b) Account information. Your name, email address, and password when you create an account, and your phone number if you provide one for notifications or verification. If you sign in with Google, we receive your name and email address from Google.
(c) Registry Record information. When a watch is registered: the Owner’s display name and contact details (email address and phone number) used for Owner Alerts and Verification Codes; watch details (brand, model, reference, serial number, condition, and unique physical markers); photographs; provenance, ownership, and service history; and, where the Owner elects an insurance appraisal, the appraisal details recorded by the Partner.
(d) Partner information. For applicants to and members of the partner network: identity, business, credential, reference, and insurance information; government identification details and tax information (which may include a Social Security number or employer identification number); and payout account details collected and processed by Stripe. Some of this is sensitive personal information, as described in Section 2.4.
(e) Communications. Information you provide when you contact us or submit a form.
2.2 Information collected automatically.
(a) Lookup data. When a serial number is submitted to the lookup function, we log the lookup event, including the IP address and the approximate (city-level) location derived from it. This data powers Owner Alerts, rate limiting, and abuse prevention. We do not collect precise geolocation.
(b) Usage and device data. IP address, browser type, device information, pages viewed, referring URLs, and timestamps, collected through server logs, used for security, abuse prevention, and operation of the Services.
(c) Cookies and similar technologies. We use cookies and similar technologies that are strictly necessary to provide the Services, including for sign-in sessions, security, and core site operation. We do not use cookies or similar technologies for advertising, and we do not permit third-party advertising networks, cross-context behavioral tracking, or third-party tracking pixels on the Services. Where we use analytics, it is limited to first-party, privacy-preserving measurement of aggregate usage that does not track you across other websites. If our use of cookies materially changes, we will update this Privacy Policy and provide any legally required notices and choices.
2.3 Information from third parties. Stripe provides us confirmation of payment status for Orders. Google provides your name and email address if you choose to sign in with Google. We do not receive or store full payment card numbers.
2.4 Sensitive personal information. From Partner applicants and Partners, we collect sensitive personal information, specifically government identification details and tax identification numbers, and we collect account log-in credentials from account holders. We use this information only to onboard and verify Partners, administer payouts, secure accounts, and comply with legal obligations. We do not use or disclose sensitive personal information to infer characteristics or for any purpose that would give rise to a right to limit its use under applicable law, and we do not sell it.
2.5 Categories of personal information. Over the past 12 months we have collected the following categories of personal information, as those categories are defined under California law: identifiers (such as name, email address, phone number, and IP address); commercial information (such as Orders and transaction status); internet or network activity (such as server log and usage data); approximate (city-level) geolocation derived from IP address; visual information (watch photographs and uploaded documents); professional or employment-related information (from Partner applicants); and sensitive personal information as described in Section 2.4. We collect these categories from you, from your device automatically, and from Stripe and Google as described above. We do not knowingly collect or create inferences used for profiling.
03How We Use Information
We use personal information to:
(a) operate the Registry, including creating and maintaining Registry Records, recording ownership transfers, and recording theft or loss flags;
(b) deliver Owner Alerts and Verification Codes;
(c) create, authenticate, and manage accounts and secure the Services;
(d) process payments and Partner payouts through Stripe;
(e) communicate with you about your Registry Records, Orders, account, and the Services, including contacting waitlist members about availability;
(f) review Partner applications and administer the partner network;
(g) detect, investigate, and prevent fraud, abuse, harassment, and security incidents, and enforce rate limits and our Terms of Service;
(h) comply with legal obligations; and
(i) maintain and improve the Services.
We do not sell personal information, we do not share personal information for cross-context behavioral advertising, and we do not use personal information for third-party advertising.
04Owner Alerts and Lookup Data
4.1 Owner Alerts. When a registered serial number is submitted to the lookup function, the Owner receives an Owner Alert. The Owner Alert may include the approximate city associated with the lookup, derived from the IP address of the person performing it. The Owner Alert does not include the name, precise location, or contact information of the person performing the lookup. If you are an Owner, you control whether the full Registry Record is released by choosing whether to share a Verification Code.
4.2 If you perform a lookup. If you submit a serial number to the lookup function, you should expect that the registered Owner will be notified that a lookup occurred and that the lookup event, including your IP address and the approximate city derived from it, will be logged for notification, security, and abuse-prevention purposes. We present a notice to this effect at the point of lookup. We do not disclose your name or contact information to the Owner. If you have questions about a lookup or wish to exercise your rights with respect to lookup data, contact us at privacy@watchsafe.io.
05Blockchain Records
We do not write names, contact details, plain-text serial numbers, photographs, or any other personal information to any blockchain. The on-chain components of a Digital Certificate consist only of a salted cryptographic hash and non-identifying certificate data, which are designed so that they cannot, by themselves, be used to identify a person. Because we do not write personal information to any blockchain, the permanence of blockchain records does not limit the deletion rights described in Section 11.
06How We Disclose Information
We disclose personal information only as follows:
6.1 Service providers. To vendors that process information on our behalf under contractual confidentiality and data protection obligations: Supabase, Inc. (database, authentication, and file storage); Stripe, Inc. (payment processing and payouts); Twilio Inc. (SMS delivery); Resend, Inc. (email delivery); Vercel Inc. (hosting); Mapbox, Inc. (maps); and Google LLC (account authentication). Decentralized storage providers, including Pinata Technologies, Inc., and blockchain infrastructure receive only the non-identifying data described in Section 5.
6.2 Partners. When you book an Inspection, the Partner performing it receives the information needed to perform it, including your name, contact information, and watch details. Partners are independent professionals who process that information under their agreements with Watch Safe.
6.3 At your direction. The full Registry Record for your watch is released to a person only when you share a Verification Code with that person.
6.4 Public lookup status. A person who searches a serial number sees only the watch’s status (Registered, Not Found, or Flagged Stolen) and minimal identifying details about the watch. Owner identity is not displayed in lookup results.
6.5 Legal and safety. To comply with applicable law, regulation, legal process, or enforceable governmental request; to enforce our Terms of Service; or to protect the rights, property, or safety of Watch Safe, our users, or the public. For watches flagged stolen, we may cooperate with law enforcement.
6.6 Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case the recipient’s use of personal information remains subject to this Privacy Policy or a successor policy with notice of material changes.
07SMS Program Terms
7.1 If you opt in to SMS, we send transactional messages, including Owner Alerts, Verification Codes, and security notifications. Consent to receive SMS messages is not a condition of purchasing any good or service.
7.2 Message frequency varies with activity relating to your Registry Records and account. Message and data rates may apply. Mobile carriers are not liable for delayed or undelivered messages.
7.3 Reply STOP to any message to opt out, or HELP for assistance. You can also manage notification preferences in your account settings. If you opt out, Owner Alerts will not be sent to you by SMS; messages you initiate, such as a Verification Code you request, may still be delivered.
7.4 We maintain records of SMS consent and opt-out as required by law. We do not share mobile numbers or SMS consent information with third parties for their marketing purposes. The Owner Alert channel is not used for marketing.
08Data Retention
We retain personal information for as long as needed to provide the Services and for the additional purposes described below. We determine retention periods based on the type of information, the purpose for which it was collected, the sensitivity of the information, our legal and regulatory obligations, and applicable limitation periods for legal claims.
8.1 Waitlist email addresses are retained until launch communications conclude or you ask to be removed.
8.2 Account information is retained while your account is active and for a limited period afterward as reasonably necessary for legal, security, dispute resolution, tax, and recordkeeping purposes. Financial and tax records are retained for the period required by applicable law.
8.3 Registry Records are designed to be durable records associated with the watch rather than with any individual. When ownership changes or your account is deleted, your personal information is deleted or disassociated from the Registry Record as described in Section 11.3, and the watch’s inspection, provenance, and status record may persist.
8.4 Lookup and security logs are retained for a limited period consistent with fraud prevention, abuse prevention, and legal requirements, ordinarily not longer than 24 months, after which they are deleted or de-identified unless a longer period is required for an active investigation or legal hold.
09Security
We apply technical and organizational measures designed to protect personal information, including row-level access controls on database tables; single-use, time-limited Verification Codes generated with cryptographically secure methods; signed, time-limited URLs for photographs and documents; encryption of data in transit; rate limiting; and owner-controlled release of Registry Records. No security measures are infallible, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and applicable regulators as required by law.
10Children
The Services are intended for adults and are not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided personal information to us, contact privacy@watchsafe.io and we will delete it.
11Your Rights and Choices
11.1 Access and portability. Account holders can export their data in JSON format from the account settings in the vault. You may also request a copy of your personal information by contacting us.
11.2 Correction. You can update account information in your account settings or contact us to correct information in a Registry Record associated with you.
11.3 Deletion. You can delete your account from your account settings or by contacting us. Upon a verified deletion request, we delete or de-identify your personal information, subject to legal retention obligations. The Registry Record for a watch, with your personal information removed or disassociated, may persist as described in Section 8.3.
11.4 Communications preferences. You can manage SMS and email preferences in your account settings and opt out of SMS as described in Section 7.3.
11.5 How to exercise rights. Submit requests to privacy@watchsafe.io. We will verify your identity using information associated with your account before acting on a request, and we will respond within the time required by applicable law. You may use an authorized agent where applicable law permits; we will require proof of the agent’s authority. We will not discriminate against you for exercising your rights.
11.6 U.S. state privacy rights. Residents of California and of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, and Utah) may have rights to know, access, correct, delete, and obtain a portable copy of their personal information, and to opt out of sales, sharing for cross-context behavioral advertising, targeted advertising, and certain profiling. Watch Safe does not sell personal information, does not share personal information for cross-context behavioral advertising, and does not engage in targeted advertising or profiling subject to opt-out rights. As described in Section 2.4, we do not use or disclose sensitive personal information for purposes that would trigger a right to limit under California law. If we deny a rights request, you may appeal by replying to our response, and we will explain the outcome of the appeal as required by applicable law.
12Processing in the United States
The Services are operated from the United States and are currently offered in the United States. If you access the Services from another jurisdiction, you understand that your information will be transferred to and processed in the United States. If we begin offering the Services in other countries, we will provide any additional notices and rights required by the laws of those jurisdictions.
13Changes to This Privacy Policy
We may update this Privacy Policy from time to time. For material changes, we will post the updated policy with a new version number and effective date and, where appropriate, provide additional notice by email or through the Services. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.
14Contact
Watch Safe, Inc.
[Street Address]
Miami, Florida [ZIP]
privacy@watchsafe.io