1. Who we are & scope
This Privacy Policy explains how Dial A Deal ("Dial A Deal", "we", "us"), operator of dialadeal.net, collects, uses, and protects personal information when you use our website and our web and telephone buying services (the "Service"). It applies to all users of the Service.
2. Information we collect
- Contact & identity data — such as your name, email address, phone number, and delivery address.
- Order requests — the items and preferences you ask us to buy, and your approvals.
- eBay account connection — a secure access token that links your own eBay account when you sign in with eBay. We never receive or store your eBay password.
- Payment data — a payment token and limited card metadata (brand, last four digits, expiry) from our processor. We do not receive or store your full card number (PAN) or security code (CVV). See Section 3.
- Order references — identifiers needed to purchase, track, and support your order.
- Voice data — if you use the phone channel, the call audio and/or transcript and your spoken approval (see Section 11). Card digits are masked and excluded.
- Technical data — limited device/log information (e.g. IP address, browser type, timestamps) used for security and reliability.
3. Payment information & PCI
Your purchase involves two charges. Your item is paid to eBay through eBay's own secure checkout on your connected account; Dial A Deal's separate service fee is collected and processed by a PCI DSS Level 1 certified payment processor. In both cases:
- On the web, card details are entered into encrypted fields (eBay's checkout for the item; our processor's hosted fields for the service fee) and exchanged for secure handling.
- On the phone, you enter your card using your keypad (DTMF); the tones are masked from our staff and call recordings.
- For the service fee we store only a token and limited metadata (brand, last four, expiry) to process the order, refunds, and support.
- We do not store your full card number (PAN) or security code (CVV).
We maintain PCI DSS compliance appropriate to our processing (including completing the applicable Self-Assessment Questionnaire and, where required, quarterly ASV scans). See our Security & PCI page.
4. eBay data & how we use the APIs
You connect your own eBay account by signing in with eBay (OAuth); we then integrate with eBay's official APIs (including Sign in with eBay, the Browse API, and the Order API for member checkout) under eBay's API License Agreement. We use them to:
- retrieve live listing data to answer your requests;
- place the orders you approve on your own connected eBay account (member checkout); and
- retrieve order and shipping status so we can keep you informed and provide after-purchase support.
We use eBay data only to provide the Service to you. We do not sell it or use it to build independent profiles, and we handle and retain it in accordance with eBay's developer and data-handling policies. Where eBay's policies require deletion of eBay-sourced data, we comply.
5. How we use information
- To provide and operate the Service (search, confirmation, payment, purchase, delivery, and after-sales support).
- To communicate with you about your requests and orders.
- To process refunds and handle returns, disputes, and escalations.
- To secure the Service, prevent fraud and abuse, and debug issues.
- To comply with legal, tax, and accounting obligations.
6. Legal bases (GDPR)
Where the EU/UK GDPR applies, we process personal data on these bases: performance of a contract (to deliver the Service you request), consent (e.g. call recording, certain communications), legitimate interests (security, fraud prevention, service improvement), and legal obligation.
7. How we share information
- eBay Inc. and sellers — to purchase and deliver your item and provide your shipping address to the seller.
- Payment processor — to take payment and issue refunds.
- Service providers — vetted vendors (e.g. hosting, telephony/voice and DTMF masking, email/SMS delivery) acting under contract and only on our instructions.
- Legal & safety — where required by law or to protect rights, safety, and security.
- Business transfers — in connection with a merger, acquisition, or asset sale, subject to this Policy.
We do not sell your personal information.
8. Data retention
We keep personal data only as long as necessary for the purposes above or as required by law (for example, transaction records kept for tax/accounting). Payment tokens are retained while needed to support your orders and refunds, then deleted. You may request deletion at any time (Section 10).
9. Security
We use technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), tokenization of card data, access controls, and least-privilege handling. No method of transmission or storage is 100% secure, but we work to protect your information and to respond promptly to any incident. Details are on our Security & PCI page.
10. Your rights (GDPR/CCPA)
Depending on where you live, you may have the right to access, correct, delete, or port your personal data; to object to or restrict certain processing; and to withdraw consent. California residents may request disclosure of categories of data collected/shared, deletion, and may opt out of "sale"/"sharing" (we do not sell your data). To exercise any right, contact us (Section 15).
11. Phone calls & recordings
If you use the phone channel, we may record the call and/or store a transcript to (a) capture your spoken approval of the purchase as proof of authorization, (b) provide support, and (c) maintain security. Card numbers entered on the keypad are masked and excluded from recordings. We will tell you when a call is recorded and obtain consent where required by law. You can ask about, access, or request deletion of these records, subject to legal retention requirements.
12. Cookies
Our website uses only cookies/local storage necessary for the site to function and to keep your session secure. If we add analytics or optional cookies in the future, we will update this Policy and request consent where required.
13. Children
The Service is not directed to children under 18 (or the age of majority where you live), and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.
14. Changes to this Policy
We may update this Policy from time to time. We will post the new version here with a revised "Last updated" date and, where appropriate, notify you.
15. Contact us
Privacy questions or requests: [email protected]
Postal address: Dial A Deal, 5 Kith Dr, Monsey, NY 10952, USA
If you are in the EU/UK and have unresolved concerns, you may contact your local data protection authority.
This template is provided to help you launch a compliant site and is not legal advice. Have it reviewed by a qualified attorney and tailor it to your jurisdiction, your payment processor, and your actual data practices before publishing.