01Scope
This Privacy Policy describes how Watch Safe, Inc., a Delaware corporation with its principal place of business in Miami, Florida (“Watch Safe,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information in connection with the websites operated at watchsafe.io and its subdomains, the Watch Safe registry, the collector vault, the partner portal, and related features (collectively, the “Services”). Capitalized terms used but not defined in this Privacy Policy have the meanings given in the Watch Safe Terms of Service.
Two design principles of the Services bear directly on privacy. First, the Registry uses owner-controlled release: a public serial number lookup returns only a status, and the full Registry Record is released only when the Owner shares a Verification Code. Second, we do not write personal information to any blockchain, as described in Section 5.
02Information We Collect
2.1 Information you provide.
(a) Waitlist. Your email address when you join the waitlist.
(b) Account information. Your name, email address, and password when you create an account, and your phone number if you provide one for notifications or verification. If you sign in with Google, we receive your name and email address from Google.
(c) Registry Record information. When a watch is registered: the Owner’s display name and contact details (email address and phone number) used for Owner Alerts and Verification Codes; watch details (brand, model, reference, serial number, condition, and unique physical markers); photographs; provenance, ownership, and service history; and, where the Owner elects an insurance appraisal, the appraisal details recorded by the Partner.
(d) Partner information. For applicants to and members of the partner network: identity, business, credential, reference, and insurance information; government identification details and tax information (which may include a Social Security number or employer identification number); and payout account details collected and processed by Stripe. Some of this is sensitive personal information, as described in Section 2.4.
(e) Communications. Information you provide when you contact us or submit a form.
2.2 Information collected automatically.
(a) Lookup data. When a serial number is submitted to the lookup function, we log the lookup event, including the IP address and the approximate (city-level) location derived from it. This data powers Owner Alerts, rate limiting, and abuse prevention. We do not collect precise geolocation.
(b) Usage and device data. IP address, browser type, device information, pages viewed, referring URLs, and timestamps, collected through server logs, used for security, abuse prevention, and operation of the Services.
(c) Cookies and similar technologies. We use cookies and similar technologies that are strictly necessary to provide the Services, including for sign-in sessions, security, and core site operation. We also measure how visitors use the Services. That measurement comes from two sources: Google Analytics, which sets cookies on your device and shares usage data with Google LLC as described in Section 6.1, and cookieless analytics provided by Vercel, our hosting provider, which sets no cookies and does not identify you individually. We have disabled the Google Analytics advertising features known as Google Signals, so your visit is not used to build advertising audiences and is not linked to your activity on other websites. You can opt out of Google Analytics on any website by installing the browser add-on Google publishes at tools.google.com/dlpage/gaoptout. Advertising measurement, which does use cookies and pixels from two advertising companies, is described in paragraph (d) below. If our use of cookies materially changes, we will update this Privacy Policy and provide any legally required notices and choices.
(d) Advertising measurement. On our marketing pages we load the Meta Pixel, provided by Meta Platforms, Inc., and the TikTok Pixel, provided by TikTok Inc. The marketing pages are the home page, the register, pricing, waitlist, passport, how it works, about, and sell with confidence pages, the authenticator program page, the journal, the glossary, the reference library, the comparison pages, the serial number lookup tool, and the city pages. We do not load these pixels for visitors in the European Economic Area, the United Kingdom or Switzerland. These pixels set cookies on your device and send page views and registration events to those two companies. When a free registration is completed, we may also send a server-side CompleteRegistration event to Meta and TikTok from our own systems. That event contains a one-way hash of the email address and phone number on the account, the IP address, and the browser user agent, so that those companies can measure which of their advertisements led to the registration. We do not load these pixels on sign-in, vault, booking, certificate, record, transfer, or any other page that can carry a private value in its address. The server-side event is tied to the completion of a registration, not to a page: it is sent once, when the registration becomes complete, whichever page you finished it on, unless you have opted out. Under California law, this activity may count as sharing personal information for cross-context behavioral advertising. We never sell personal information. You can opt out at any time at watchsafe.io/do-not-share, the page titled Do Not Sell or Share My Personal Information, or by turning on Global Privacy Control in your browser. We treat the Global Privacy Control signal as a valid opt-out request. After you opt out, the pixels do not load and the server-side event is not sent from that browser.
2.3 Information from third parties. Stripe provides us confirmation of payment status for Orders. Google provides your name and email address if you choose to sign in with Google. We do not receive or store full payment card numbers.
2.4 Sensitive personal information. From Partner applicants and Partners, we collect sensitive personal information, specifically government identification details and tax identification numbers, and we collect account log-in credentials from account holders. We use this information only to onboard and verify Partners, administer payouts, secure accounts, and comply with legal obligations. We do not use or disclose sensitive personal information to infer characteristics or for any purpose that would give rise to a right to limit its use under applicable law, and we do not sell it.
2.5 Categories of personal information. Over the past 12 months we have collected the following categories of personal information, as those categories are defined under California law: identifiers (such as name, email address, phone number, and IP address); commercial information (such as Orders and transaction status); internet or network activity (such as server log and usage data); approximate (city-level) geolocation derived from IP address; visual information (watch photographs and uploaded documents); professional or employment-related information (from Partner applicants); and sensitive personal information as described in Section 2.4. We collect these categories from you, from your device automatically, and from Stripe and Google as described above. We do not knowingly collect or create inferences used for profiling.
03How We Use Information
We use personal information to:
(a) operate the Registry, including creating and maintaining Registry Records, recording ownership transfers, and recording theft or loss flags;
(b) deliver Owner Alerts and Verification Codes;
(c) create, authenticate, and manage accounts and secure the Services;
(d) process payments and Partner payouts through Stripe;
(e) communicate with you about your Registry Records, Orders, account, and the Services, including contacting waitlist members about availability;
(f) review Partner applications and administer the partner network;
(g) detect, investigate, and prevent fraud, abuse, harassment, and security incidents, and enforce rate limits and our Terms of Service;
(h) comply with legal obligations; and
(i) maintain and improve the Services.
We do not sell personal information. The advertising measurement described in Section 2.2(d) may count as sharing personal information for cross-context behavioral advertising under California law, and you can opt out of it as described there and in Section 11.6. Apart from that measurement, we do not use personal information for third-party advertising.
04Owner Alerts and Lookup Data
4.1 Owner Alerts. When a registered serial number is submitted to the lookup function, the Owner receives an Owner Alert. The Owner Alert may include the approximate city associated with the lookup, derived from the IP address of the person performing it. The Owner Alert does not include the name, precise location, or contact information of the person performing the lookup. If you are an Owner, you control whether the full Registry Record is released by choosing whether to share a Verification Code.
4.2 If you perform a lookup. If you submit a serial number to the lookup function, you should expect that the registered Owner will be notified that a lookup occurred and that the lookup event, including your IP address and the approximate city derived from it, will be logged for notification, security, and abuse-prevention purposes. We present a notice to this effect at the point of lookup. We do not disclose your name or contact information to the Owner. If you have questions about a lookup or wish to exercise your rights with respect to lookup data, contact us at privacy@watchsafe.io.
05Blockchain Records
We do not write names, contact details, plain-text serial numbers, photographs, or any other personal information to any blockchain. The on-chain components of a Digital Certificate consist only of a salted cryptographic hash and non-identifying certificate data, which are designed so that they cannot, by themselves, be used to identify a person. Because we do not write personal information to any blockchain, the permanence of blockchain records does not limit the deletion rights described in Section 11.
06How We Disclose Information
We disclose personal information only as follows:
6.1 Service providers. To vendors that process information on our behalf under contractual confidentiality and data protection obligations: Supabase, Inc. (database, authentication, and file storage); Stripe, Inc. (payment processing and payouts); Twilio Inc. (SMS delivery); Resend, Inc. (email delivery); Vercel Inc. (hosting); Mapbox, Inc. (maps); Google LLC (account authentication and website analytics); and Anthropic PBC (automated review of uploaded photos and documents, described in Section 6.7). Decentralized storage providers, including Pinata Technologies, Inc., and blockchain infrastructure receive only the non-identifying data described in Section 5. Separately, two advertising measurement partners receive the data described in Section 2.2(d): Meta Platforms, Inc. and TikTok Inc. each receive page views on our marketing pages and registration events from their pixels, and, when a free registration is completed, a server-side event containing a one-way hash of the email address and phone number on the account, the IP address, and the browser user agent. They use that data to measure their advertisements under their own privacy policies, and you can opt out as described in Section 2.2(d).
6.2 Partners. When you book an Inspection, the Partner performing it receives the information needed to perform it, including your name, contact information, and watch details. Partners are independent professionals who process that information under their agreements with Watch Safe.
6.3 At your direction. The full Registry Record for your watch is released to a person only when you share a Verification Code with that person.
6.4 Public lookup status. A person who searches a serial number sees only the watch’s status (Registered, Not Found, or Flagged Stolen) and minimal identifying details about the watch. Owner identity is not displayed in lookup results.
6.5 Legal and safety. To comply with applicable law, regulation, legal process, or enforceable governmental request; to enforce our Terms of Service; or to protect the rights, property, or safety of Watch Safe, our users, or the public. For watches flagged stolen, we may cooperate with law enforcement.
6.6 Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case the recipient’s use of personal information remains subject to this Privacy Policy or a successor policy with notice of material changes.
6.7 Automated review of uploads. Two features send files to Anthropic PBC for automated analysis as our service provider. Authentication is always performed in person by an independent authenticator who physically examines the watch. These checks look at the quality of the files that document that examination; they never perform it, assist with it, or replace it. When an authenticator uploads the photographs recording an in-person Inspection, the images are checked for focus, framing, lighting, and whether each photograph shows the subject its slot calls for, so that an unusable image is caught while the watch is still in hand. When you upload a police report for a watch that is already flagged stolen, the document is read to confirm that it is a police report and to extract the issuing jurisdiction, report date, and case number, so that you do not have to enter them by hand. These checks affect only whether an upload is accepted for review. They do not authenticate a watch, determine whether a watch is flagged stolen, or decide whether a police report is treated as verified. Anthropic returns the result to us and processes the content under contractual confidentiality and data protection obligations.
07SMS Program Terms
7.1 If you opt in to SMS, we send transactional messages, including Owner Alerts, Verification Codes, and security notifications. Consent to receive SMS messages is not a condition of purchasing any good or service.
7.2 Message frequency varies with activity relating to your Registry Records and account. Message and data rates may apply. Mobile carriers are not liable for delayed or undelivered messages.
7.3 Reply STOP to any message to opt out, or HELP for assistance. You can also contact us at privacy@watchsafe.io to change how we contact you. If you opt out, Owner Alerts will not be sent to you by SMS; messages you initiate, such as a Verification Code you request, may still be delivered.
7.4 We maintain records of SMS consent and opt-out as required by law. We do not share mobile numbers or SMS consent information with third parties for their marketing purposes. The Owner Alert channel is not used for marketing.
08Data Retention
We retain personal information for as long as needed to provide the Services and for the additional purposes described below. We determine retention periods based on the type of information, the purpose for which it was collected, the sensitivity of the information, our legal and regulatory obligations, and applicable limitation periods for legal claims.
8.1 Waitlist email addresses are retained until launch communications conclude or you ask to be removed.
8.2 Account information is retained while your account is active and for a limited period afterward as reasonably necessary for legal, security, dispute resolution, tax, and recordkeeping purposes. Financial and tax records are retained for the period required by applicable law.
8.3 Registry Records are designed to be durable records associated with the watch rather than with any individual. When ownership changes or your account is deleted, your personal information is deleted or disassociated from the Registry Record as described in Section 11.3, and the watch’s inspection, provenance, and status record may persist.
8.4 Lookup and security logs are retained for a limited period consistent with fraud prevention, abuse prevention, and legal requirements, ordinarily not longer than 24 months, after which they are deleted or de-identified unless a longer period is required for an active investigation or legal hold.
09Security
We apply technical and organizational measures designed to protect personal information, including row-level access controls on database tables; single-use, time-limited Verification Codes generated with cryptographically secure methods; signed, time-limited URLs for photographs and documents; encryption of data in transit; rate limiting; and owner-controlled release of Registry Records. No security measures are infallible, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and applicable regulators as required by law.
10Children
The Services are intended for adults and are not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided personal information to us, contact privacy@watchsafe.io and we will delete it.
11Your Rights and Choices
11.1 Access and portability. You may request a copy of the personal information we hold about you by contacting us at privacy@watchsafe.io. Where required by applicable law we provide it in a portable, machine-readable format.
11.2 Correction. You may ask us to correct inaccurate personal information, including information in a Registry Record associated with you, by contacting us at privacy@watchsafe.io. Changes to account identity details such as name, email address, or phone number are reviewed by our support team before they take effect.
11.3 Deletion. You may request deletion of your account and personal information by contacting us at privacy@watchsafe.io. Account closure is handled by our support team because registered watches, certificates, police reports, access codes, and transfer controls may be affected. Upon a verified deletion request, we delete or de-identify your personal information, subject to legal retention obligations. The Registry Record for a watch, with your personal information removed or disassociated, may persist as described in Section 8.3.
11.4 Communications preferences. You can opt out of SMS at any time by replying STOP to any message, as described in Section 7.3. For email preferences, including marketing email, use the unsubscribe link in any marketing message or contact us at privacy@watchsafe.io.
11.5 How to exercise rights. Submit requests to privacy@watchsafe.io. We will verify your identity using information associated with your account before acting on a request, and we will respond within the time required by applicable law. You may use an authorized agent where applicable law permits; we will require proof of the agent’s authority. We will not discriminate against you for exercising your rights.
11.6 U.S. state privacy rights. Residents of California and of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, and Utah) may have rights to know, access, correct, delete, and obtain a portable copy of their personal information, and to opt out of sales, sharing for cross-context behavioral advertising, targeted advertising, and certain profiling. Watch Safe does not sell personal information and does not engage in profiling subject to opt-out rights. The advertising measurement described in Section 2.2(d) may count as sharing personal information for cross-context behavioral advertising, or as targeted advertising, under these laws. You can opt out at watchsafe.io/do-not-share, the page titled Do Not Sell or Share My Personal Information, which sets an opt-out preference in your browser, or by turning on Global Privacy Control in your browser, which we honor as a valid opt-out request. The opt-out applies to the browser you set it in, so set it in each browser you use. For questions about it, write to privacy@watchsafe.io. As described in Section 2.4, we do not use or disclose sensitive personal information for purposes that would trigger a right to limit under California law. If we deny a rights request, you may appeal by replying to our response, and we will explain the outcome of the appeal as required by applicable law.
12Processing in the United States
The Services are operated from the United States and are currently offered in the United States. If you access the Services from another jurisdiction, you understand that your information will be transferred to and processed in the United States. If we begin offering the Services in other countries, we will provide any additional notices and rights required by the laws of those jurisdictions.
13European Economic Area, United Kingdom, and Switzerland
13.1 Controller. Watch Safe, Inc. is the controller of the personal information processed through the Services. You can reach us at the address in Section 15 or at privacy@watchsafe.io.
13.2 Legal bases. We process personal information to perform our contract with you, which covers creating your account and maintaining the records you enter; on the basis of our legitimate interests in securing the Services, preventing fraud and abuse, and understanding how the Services are used; on the basis of your consent where we ask for it, which today means marketing email; and to comply with legal obligations. Where we rely on consent you may withdraw it at any time, and withdrawing it does not affect processing carried out before you withdrew.
13.3 Your rights. Subject to the conditions set out in applicable law, you have the right to access the personal information we hold about you, to have inaccurate information corrected, to have information erased, to restrict or object to processing, to receive your information in a portable format, and to withdraw consent. Send requests to privacy@watchsafe.io. We verify identity before acting on a request, as described in Section 11.5.
13.4 Analytics without cookies. In the European Economic Area, the United Kingdom, and Switzerland we configure our analytics provider so that it stores no analytics cookies or similar identifiers on your device. That is why the Services do not present a cookie banner in these regions. We do not use analytics to build a profile of you across other websites or across your devices.
13.5 International transfers. Watch Safe operates from the United States, and personal information is transferred to and stored there by us and by the service providers described in Section 6. Where information is transferred out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, together with the United Kingdom International Data Transfer Addendum where it applies, and on the security measures described in Section 9.
13.6 Complaints. You have the right to lodge a complaint with the supervisory authority where you live or work. We would appreciate the chance to address your concern first, so please contact us at privacy@watchsafe.io before you do.
14Changes to This Privacy Policy
We may update this Privacy Policy from time to time. For material changes, we will post the updated policy with a new version number and effective date and, where appropriate, provide additional notice by email or through the Services. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.
15Contact
Watch Safe, Inc.
1000 Brickell Avenue, Suite 715, PMB 601
Miami, Florida 33131
privacy@watchsafe.io