Privacy policy

1. Who is responsible

The data controller is Blackvalk Ltd, trading as roavmarket, at 850 Euclid Ave, Ste 819 #7287, Cleveland, OH 44114, United States. Privacy contact: contact@roavmarket.com.

2. What we collect

Account information: email address, display name, username, password hash, avatar and banner images, profile text and links, and any Discord or Roblox account you choose to link (their account identifiers, usernames, and avatars).

Activity: products you list, upload, buy, or save; orders, licences, and delivery records; messages with stores; reviews; reports you file and their attachments; commission briefs and proposals; advertisement content; and seller settings such as hub connections.

Technical and security information: IP address, browser and device details, sign-in times and sessions, and second-factor enrolment status. Platform staff may look up the approximate location of an IP address when reviewing suspected abuse; these lookups are not stored.

3. Payments

Card and bank details are entered directly with Stripe and never reach roavmarket. Stripe sends us transaction identifiers, amounts, payment status, and, for sellers, the status of their Stripe account. Identity documents sellers provide for verification go to Stripe, not to us. Stripe's privacy policy applies to that processing.

4. Why we use it

To run your account and keep it secure; to show products and process purchases; to deliver files and whitelist you on hubs; to run commissions, messaging, reviews, and reports; to pay sellers and keep financial records; to prevent fraud and abuse; to answer support requests; and to meet legal obligations. The lawful bases are performance of our contract with you, legal obligation for records we must keep, our legitimate interest in keeping the service safe, and consent where you opt in to analytics or marketing cookies.

We do not sell personal information, and we do not use it for advertising profiles.

5. Who receives it

Sellers receive the order details, your public profile, and the linked Roblox or Discord name needed to deliver and support a purchase. They do not receive your email, IP address, or device details. Buyers see the seller's public store and profile. Commission counterparties see the brief, proposals, messages, and files intentionally shared with them. Profiles, stores, listings, and reviews are public.

When you buy a hub-delivered product, or connect a hub as a seller, the product, purchase, and linked account identifiers needed for whitelisting are shared with that hub. Service providers that process data for us: Stripe (payments and payouts), Railway (hosting and database), Cloudflare (CDN, file storage, and edge security), ZeptoMail (transactional email), ipinfo (IP location for staff security review), and Discord (community notifications and linked roles). We disclose information to authorities only where the law requires it.

6. Cookies and similar technologies

We use cookies to run the site, keep you signed in, remember your preferences, and, only if you allow them, measure usage and personalize ads. Necessary cookies are always on. Analytics and marketing cookies load only after you accept them, and you can change your choice at any time with "Cookie settings" in the site footer.

Most browsers accept cookies by default, but you can set yours to block or delete them. Blocking necessary cookies will stop you from signing in. Your browser's help pages explain how to manage its settings.

7. International transfers, retention, and security

Our providers are based in the United States and may process data there and in other countries. Where required, transfers rely on the provider's standard contractual clauses or an equivalent safeguard.

We keep account data while your account is open and for up to 90 days after closure, except for order, licence, and payout records, which are kept for seven years to meet financial and tax requirements, and dispute or report records, which are kept while a matter is open and for two years after. Security logs are kept for 90 days. Uploaded product files are deleted when the product is deleted, subject to buyers' continuing access to products they have paid for.

Data is encrypted in transit, secrets and hub tokens are encrypted at rest, product files are stored privately and delivered through short-lived signed links, and staff accounts require a second factor. No online service can promise absolute security; we will notify affected users and authorities of a breach where the law requires it.

8. Your rights and young users

Depending on where you live you may have the right to access, correct, delete, or receive a copy of your data, to object to or restrict processing, to withdraw consent, and to complain to a data protection authority. You can edit your profile, unlink accounts, and manage cookies yourself; for anything else email contact@roavmarket.com. We answer within 30 days and may ask you to confirm your identity before acting.

roavmarket is not directed at children under 13, and we do not knowingly collect their data. Minors over that age use the service with a parent or guardian, who may exercise these rights on their behalf. We do not profile minors or show them personalized advertising.

9. Updates and contact

We update this policy when our practices change and show the new effective date at the top. Material changes are announced on the site, and we ask for consent again where the law requires it. Privacy requests and questions: contact@roavmarket.com, or by post to Blackvalk Ltd, 850 Euclid Ave, Ste 819 #7287, Cleveland, OH 44114, United States.