v4.7 — September 30, 2026 (current)
v4.6 — September 30, 2026 (archived)
v4.5 — September 30, 2026 (archived)
v4.4 — September 30, 2026 (archived)
v4.3 — September 28, 2026 (archived)
v4.2 — September 25, 2026 (archived)
v4.1 — September 24, 2026 (archived)
v4.0 — September 23, 2026 (archived)
v3.0 — April 18, 2026 (archived)
v2.0 — April 13, 2026 (archived)
Prior versions are retained internally. Request a copy via our contact page.
🔒 Summary: We collect only the data needed to run the marketplace. We do not sell your personal data and we do not show ads on the Platform today. Google Analytics runs only after you consent in our cookie banner, including its Google signals feature, which gives us aggregated audience reports. We also count visits with Cloudflare Web Analytics, which uses no cookies and stores nothing on your device. Our database is hosted in Brazil. You can export or delete your account data at any time from Dashboard → Settings, and if you gave us only your email (newsletter or a service request), you can delete it with the link in our emails, without an account.
MyUsedRobot.com (the "Platform"; "we", "us", "our") is an online marketplace for humanoid robots. In this Privacy Policy, the terms "Platform", "Service", and "website" are used interchangeably and refer to the same thing: the MyUsedRobot.com website and its associated back-end services. For the purposes of data protection law, we act as the data controller for personal data collected through the Platform.
This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the Platform, in accordance with the Brazilian General Data Protection Law (LGPD — Lei nº 13.709/2018), the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and other applicable international privacy laws listed in Section 12.
| Data | When collected | Purpose |
|---|---|---|
| Name | Registration | Account identification, listing display |
| Email address | Registration, newsletter, service requests | Account authentication, notifications, newsletter (with consent), contact about requested services (with consent) |
| Password | Registration with email and password | Authentication. Stored only as a one-way hash; we never see or store it in readable form. Not collected if you sign in with Google, Microsoft, LinkedIn or GitHub. |
| Phone number | Completing a seller profile | Internal seller verification only. Never displayed publicly on listings or seller profiles; buyers contact sellers only through the in-site secure messaging system. |
| Date of birth, identity document type and number | Completing a seller profile (required to publish listings) | Fraud prevention, and identification of the seller in case of a dispute or a lawful request from an authority. These details are not checked against official records. Never displayed publicly. |
| Address (street, number, city, state, postal code, country) | Completing a seller profile | Seller verification and listing location. Only city and country are shown on listings. |
| Company name | Seller profile (optional) | Seller profile, company verification |
| Listing content | Listing creation | Publication and display of the listing |
| Photos | Listing creation | Stored on Cloudflare R2 and displayed in listings |
| Messages | Chat system | Communication between buyer and seller |
| Reviews | Review submission | Seller reputation display |
| Requests for financing and other services: email, services chosen, country, and the robot model or listing you were viewing | Form at Financing & Services | To contact you when the service is available in your country, and to measure demand. See §4.2. |
| Messages to us | Contact form or email | Answering your request |
| Data | Method | Purpose |
|---|---|---|
| IP address | Server and CDN logs | Security, fraud detection, rate limiting |
| Country (derived from IP address) | Cloudflare country header | Default country and currency for prices. No precise location is collected. |
| Browser type and version | HTTP headers | Compatibility and security |
| Bot-protection signals | Cloudflare Turnstile, on the registration and service request forms | Telling people and automated abuse apart |
| Pages visited and time on site | Google Analytics, only with your consent, with Google signals enabled: if you are signed in to a Google account and have allowed ad personalization there, Google can associate the visit with that account. We receive only aggregated reports, never data about identifiable people | Traffic analysis, UX improvement, aggregated audience reports (age range, interests, devices) |
| Visit statistics and page performance (page address, referring page, browser type, loading times) | Cloudflare Web Analytics, a script added by our CDN. It uses no cookies and stores nothing on your device; according to Cloudflare, your IP address is discarded at the nearest Cloudflare data centre and not stored | Counting visits and measuring page speed, in aggregate |
| Search queries on the Platform | URL parameters | Search functionality, aggregate analytics |
| Listing and article views, likes | Page requests; a random identifier stored in your browser (§6.1) | Popularity counters, seller dashboard |
| Session and authentication tokens | localStorage | Keeping you logged in |
| Language, country and currency preferences | localStorage | Localisation of the Platform |
If you choose to register or log in using Google, Microsoft, LinkedIn, or GitHub, we receive from those providers only your: name, email address, and profile photo (where available). We do not receive your password or any financial information from these providers.
We do not use your data for automated decision-making that produces significant legal effects, nor for profiling beyond the personalisation of listing results and language preferences.
News content and AI: the robotics news on the Platform is collected from public news feeds and may be summarised with the help of an AI service (Anthropic). Only the public text of news articles is sent to that service; no personal data of users is sent.
| Processing Activity | GDPR Basis | LGPD Basis |
|---|---|---|
| Account registration and management | Contract performance (Art. 6(1)(b)) | Contract performance (Art. 7, V) |
| Listing publication | Contract performance (Art. 6(1)(b)) | Contract performance (Art. 7, V) |
| Seller identification data | Legitimate interests (Art. 6(1)(f)) — fraud prevention | Legitimate interest (Art. 7, IX) |
| Transactional emails | Contract performance (Art. 6(1)(b)) | Contract performance (Art. 7, V) |
| Newsletter | Consent (Art. 6(1)(a)) | Consent (Art. 7, I) |
| Requests for financing and other services | Consent (Art. 6(1)(a)) | Consent (Art. 7, I) |
| Google Analytics | Consent (Art. 6(1)(a)) | Consent (Art. 7, I) |
| Cloudflare Web Analytics (aggregate visit statistics, no cookies) | Legitimate interests (Art. 6(1)(f)) — measuring use and speed of the Platform without identifying anyone | Legitimate interest (Art. 7, IX) |
| Fraud prevention and security | Legitimate interests (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX) |
| Keeping identification data after account deletion (§7) | Legitimate interests (Art. 6(1)(f)) — establishment, exercise or defence of legal claims | Regular exercise of rights in judicial, administrative or arbitral proceedings (Art. 7, VI) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) | Compliance (Art. 7, II) |
You subscribe to the newsletter by entering your email address; the subscription starts immediately. Every newsletter contains an unsubscribe link. You may withdraw your consent at any time by clicking that link; the withdrawal takes effect immediately and does not affect the lawfulness of any processing carried out before the withdrawal.
After you unsubscribe, we keep your address marked as unsubscribed so that we do not send you the newsletter again. If you want the address deleted completely, use the "Delete my data" link shown on the unsubscribe page.
Our Financing & Services page lets you ask to be told when financing, leasing, insurance, secure payment, inspection, shipping, maintenance or extended warranty becomes available in your country. These services are not available yet; we are selecting partners.
We do not sell your personal data. We share data only in the following limited circumstances:
| Provider | Service | Data shared | Location |
|---|---|---|---|
| Hostinger International | Website hosting, application server and database | All data stored by the Platform, server logs, IP addresses | Brazil (São Paulo) |
| Cloudflare, Inc. | CDN, DDoS protection, SSL, photo storage (R2), bot protection (Turnstile), visit statistics (Web Analytics) | IP addresses, HTTP headers, listing photos, bot-protection signals, page visit and performance data | USA and global network |
| Resend | Sending transactional emails and the newsletter | Email address, name, email content | USA |
| Zoho Corporation | Our email mailbox | Emails you send us | USA |
| Google LLC | Google Analytics (only with your consent); Sign in with Google (only if you choose it) | Usage events (Analytics); name, email and photo (sign-in) | USA |
| Microsoft, LinkedIn, GitHub | Sign-in, only if you choose it | Name, email and photo returned by the provider | USA |
When you publish a listing, the following data becomes publicly visible: brand, model, condition, year, price, location (city/country), description, photos, and your display name. This data may be indexed by search engines.
We may disclose your data if required to do so by law, court order, or at the request of competent public authorities, to the extent necessary to comply with such obligations.
We do not currently have partners for financing, insurance, inspection, shipping or the other services listed on the Financing & Services page, and we do not share your requests with anyone. Before any partner receives your data, we will ask for your separate, explicit consent.
| Cookie / Storage Key | Type | Purpose | Duration |
|---|---|---|---|
| mur_sid | Strictly necessary (cookie, set by api2.myusedrobot.com) | Keeps you signed in. It is HttpOnly: no script on the page can read it, which protects your session. Deleted when you sign out | 30 days, renewed while you use the Platform |
| mur-session | Functional (localStorage) | Tells the pages that you are signed in and when the session ends. It no longer holds the session itself | 30 days |
| mur-user | Functional (localStorage) | Cached user profile for faster load | 30 days |
| mur-consent | Functional (localStorage) | Records your cookie consent choices | 12 months |
| mur-theme, mur-lang, mur-country, mur_currency_pref | Preference (localStorage) | Light/dark mode, language, country and currency | Until cleared |
| mur-notif-prefs, pwa-install-dismissed, mur-av-* | Preference (localStorage) | Notification choices and prompts you have already dismissed | Until cleared |
| mur-cid | Functional (localStorage) | Random identifier used only to count an article view once per hour. Not linked to your identity or account. | Until cleared |
| _ga, _ga_* | Analytics (cookie) | Google Analytics — visitor identification and session tracking. With Google signals, Google may associate this data with your Google account if you are signed in and have allowed ad personalization (loaded only after your explicit consent via the cookie banner) | 13 months |
| Cloudflare security cookies (e.g. __cf_bm) | Strictly necessary (cookie) | May be set by Cloudflare to protect the Platform against bots and attacks | Up to 30 minutes |
Cloudflare Web Analytics is not in the table above because it does not use cookies or any storage on your device. It counts visits and measures page speed in aggregate, and it is not controlled by the cookie banner. You can block it with a content or tracker blocker in your browser without affecting the Platform.
Some news articles embed videos or posts from other websites. Videos from YouTube are embedded in YouTube's privacy-enhanced mode (youtube-nocookie.com), and Vimeo videos with tracking disabled; posts from X (Twitter) are loaded only when you click to view them. When embedded content loads, the provider receives your IP address and browser information under its own privacy policy.
You can change or withdraw your choices at any time through the "Privacy Settings" link at the bottom of every page, and clear localStorage data and cookies through your browser settings. Refusing analytics cookies does not affect core Platform functionality. You can also opt out of Google Analytics at tools.google.com/dlpage/gaoptout.
We do not show ads on the Platform today and we do not sell your data. The only feature related to advertising is Google signals in Google Analytics (above), which runs only with your consent. You can turn it off by refusing analytics cookies in the banner, or for all sites in your Google account's ad settings (myadcenter.google.com).
| Data Category | Retention Period |
|---|---|
| Account data (name, email, profile) | Until account deletion, plus up to 30 days |
| Identification data after account deletion (name, email, phone, company, identity document, date of birth, address) | 3 years from the deletion, kept in a restricted store and only for people who published listings or otherwise transacted on the Platform, so that we can answer legal claims (civil liability limitation period under Brazilian law). Deleted automatically at the end of the period. |
| Active listings | 30 days from publication or from the last renewal. We email the seller 3 days before the end; the seller can renew for another 30 days at any time from the Dashboard. |
| Expired and sold listings | Hidden from the marketplace. For 30 days an expired listing can still be renewed by the seller; after those 30 days, expired and sold listings are removed from the Platform. The photos of a removed listing are deleted 90 days after removal. Its text is kept, without being displayed, for 3 years for the establishment or defence of legal claims, and is then anonymized: only the make, model, year, country and price remain, for price statistics. |
| Messages | Conversations are deleted automatically 90 days after the last message. You can delete a conversation earlier from Dashboard → Messages. |
| Reviews | While displayed. Reviews exchanged in a confirmed deal also belong to the other party: if you delete your account, they remain without your name |
| Deal records (who indicated a sale to whom, and the answer) | Unanswered: 90 days. Declined: 12 months. Confirmed: while the related reviews exist |
| Newsletter subscription | Until you unsubscribe; the address then stays marked as unsubscribed for 12 months, as proof that your request was honoured, and is then deleted — or earlier if you delete it (§4.1) |
| Newsletter delivery records (which weekly issue was sent to which address) | 90 days |
| Copies of emails we send you (kept only to retry failed deliveries and investigate delivery problems) | 30 days after sending; 90 days at most |
| Requests for financing and other services | 24 months after your last request, then deleted automatically, or earlier with the link in the confirmation email |
| Audit log of privileged actions | 12 months |
| Sign-in records (IP address and browser of each session) | 6 months after the session was last used — the minimum required by Brazilian law (Marco Civil da Internet, art. 15) |
| Contact form messages | 12 months |
| Pre-launch waitlist | 24 months |
| Google Analytics data | 14 months |
| Server logs | Up to 90 days |
Upon account deletion, we will delete or anonymise your personal data within 30 days, except for the identification data described above and where retention is required by law.
Our database and application server are hosted by Hostinger in Brazil (São Paulo). Some of our service providers process data in the United States (Cloudflare, Resend, Zoho, Google and, if you use them, the sign-in providers), and Cloudflare's network may route traffic through data centres worldwide.
For users in the European Economic Area, the United Kingdom and Switzerland, these are transfers outside your region. Where required, they rely on appropriate safeguards under GDPR Chapter V, such as the providers' certification under the EU-US Data Privacy Framework and Standard Contractual Clauses. You may request further information about these safeguards via our contact page (subject: "Data transfer safeguards").
Depending on your location, you may have the following rights regarding your personal data:
| Right | Description | Available under |
|---|---|---|
| Access | Request a copy of the personal data we hold about you | GDPR, LGPD, CCPA |
| Rectification | Correct inaccurate or incomplete data | GDPR, LGPD |
| Erasure ("right to be forgotten") | Request deletion of your personal data | GDPR, LGPD |
| Restriction | Request we restrict processing of your data in certain circumstances | GDPR |
| Portability | Receive your data in a structured, machine-readable format | GDPR, LGPD |
| Object | Object to processing based on legitimate interests | GDPR, LGPD |
| Withdraw consent | Withdraw consent at any time (newsletter, etc.) without affecting prior processing | GDPR, LGPD |
| Non-discrimination | Not be discriminated against for exercising your rights | CCPA, LGPD |
To exercise any of these rights, please contact us at our contact page. We will respond within 15 business days (LGPD) or 30 days (GDPR). You also have the right to lodge a complaint with your national data protection authority (e.g., ANPD in Brazil, your EU supervisory authority).
Logged-in users can exercise these rights directly without contacting us:
Without an account: if you gave us only your email address (newsletter, a request for financing or other services, or the waiting list), use the "Delete my data" link in the confirmation email of your service request or on the newsletter unsubscribe page. It deletes that email address from all three, without login. If the address also belongs to an account, the account is not affected; delete it from the Dashboard.
For rights that cannot be self-served (restriction, objection, or complaints), please use our contact page or the email below. We may request identity verification to prevent unauthorized requests.
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional specific rights. This section applies in addition to Section 9 above.
In the 12 months preceding the Effective Date, we have collected the following categories of personal information (as defined by Cal. Civ. Code §1798.140):
We do not sell personal information in the traditional sense. However, under the broad CCPA/CPRA definitions of "sale" and "sharing," the following third-party analytics may constitute "sharing" for cross-context behavioural advertising purposes:
We do not show ads on the Platform and do not engage in targeted advertising based on your activity across unaffiliated sites. Google Analytics with Google signals, which runs only with your consent, may allow Google to use the data for its own advertising purposes; that is why it is listed above as possible "sharing", and you can opt out at any time through the cookie banner.
No financial incentive: we do not offer financial incentives in exchange for personal information.
We will respond to verifiable California privacy rights requests within 45 days (extendable to 90 days for complex requests, with notice).
In addition to LGPD (Brazil) and GDPR (EU/EEA), users in the following jurisdictions are protected by their local data protection laws, which grant rights substantially similar to those described in Section 9:
Mainland China (People's Republic of China): The Platform is not specifically designed for the Chinese market and we do not currently hold an ICP licence. If you access the Platform from mainland China, you do so on your own initiative, and the primary processing of your data is governed by the laws of Brazil (data controller) and, where applicable, the EU/EEA. We do not currently comply with the Personal Information Protection Law (PIPL), Data Security Law (DSL), or Cybersecurity Law (CSL) requirements for domestic operators. We may restrict availability or remove Chinese-language content from the Platform at any time without notice.
For rights under any of the above laws, please contact our DPO via our contact page. Where local law requires data to be processed by an in-country representative, we may not be able to offer full services without first establishing such representation.
The Platform is not directed at, or intended for use by, children under the age of 18. We do not knowingly collect personal data from minors. Humanoid robot marketplaces are inherently oriented toward commercial and industrial use cases and are not designed as a service for minors.
Specific jurisdictional considerations:
If we discover that we have collected personal data from a person under 18, we will delete such data within 7 days of becoming aware. If you are a parent or guardian who believes a minor has registered on the Platform, please contact us via our contact page and we will prioritize the request.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, and disclosure. These measures include:
However, no method of transmission over the internet or electronic storage is 100% secure.
In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authorities within the timeframes required by applicable law:
This section supplements the global rights described in Section 9 with specific notices for residents of certain jurisdictions. Where a specific law provides stronger protection, those rules prevail.
If you are a resident of California, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights regarding your personal information:
In the preceding 12 months, we have collected the following categories of personal information: identifiers (name, email, IP address), commercial information (listing history, messages), internet/network activity (page views, searches), and geolocation (country, inferred from IP). We have not sold personal information for monetary consideration. We may have "shared" information under CCPA's broad definition solely via analytics cookies; users can opt out as described above. We retain information as described in Section 7.
To submit a verifiable consumer request, use the "Export my data" or "Delete my account" buttons in your Dashboard, or contact us at our contact page. We will verify your identity before processing.
For users in the United Kingdom, references to "GDPR" in this policy should be understood as referring to the UK GDPR as incorporated into UK law by the Data Protection Act 2018. The supervisory authority is the Information Commissioner's Office (ICO) — ico.org.uk. UK residents have the same substantive rights listed in Section 9.
EU/EEA residents are protected by the General Data Protection Regulation (GDPR) and by the national data protection authority of their country. A complaint may be lodged with any supervisory authority; a list is maintained by the European Data Protection Board at edpb.europa.eu.
Brazilian users are protected by Lei nº 13.709/2018 (LGPD). The supervisory authority is the Autoridade Nacional de Proteção de Dados (ANPD) — www.gov.br/anpd. Brazilian users are also protected by Lei nº 8.078/1990 (Código de Defesa do Consumidor) and Lei nº 12.965/2014 (Marco Civil da Internet).
The following laws apply to users in the listed jurisdictions and confer rights analogous to those in Section 9. Contact the corresponding authority for complaints:
| Country | Law | Authority |
|---|---|---|
| Canada (federal) | PIPEDA | Office of the Privacy Commissioner — priv.gc.ca |
| Canada (Quebec) | Law 25 | Commission d'accès à l'information — cai.gouv.qc.ca |
| Australia | Privacy Act 1988 | Office of the Australian Information Commissioner — oaic.gov.au |
| Japan | APPI | Personal Information Protection Commission — ppc.go.jp |
| South Korea | PIPA | Personal Information Protection Commission — pipc.go.kr |
| India | DPDP Act 2023 | Data Protection Board of India (once established) |
| Mexico | LFPDPPP | INAI — inai.org.mx |
| Switzerland | revFADP | FDPIC — edoeb.admin.ch |
Although we accept users selecting "China" as their country, MyUsedRobot.com is not operated under Chinese law, does not hold an ICP license, and does not undergo Chinese cross-border data transfer security assessments. If you access this Platform from within mainland China, you do so at your own risk and are responsible for compliance with applicable local laws. Your personal data will be processed under the laws of Brazil, the European Union (for EU-based processors), and the United States (for US-based processors like Google), as described in Sections 5 and 8.
We may update this Privacy Policy from time to time. Material changes will be notified by email to registered users and by a prominent notice on the Platform at least 15 days before taking effect. The "Last updated" date at the top of this page will always reflect when the policy was last revised.
Each published version of this policy has a version number, shown at the top of this page, and a summary of changes in the version history. We keep a complete history of previous versions; you can request a copy via our contact page.
If a change expands how we use your data (for example, a new purpose, a new category of data, or sharing with a new type of recipient), we will notify registered users by email and show a notice on the Platform at least 15 days before it takes effect, and we will ask for your consent where the law requires it. Corrections that only describe more accurately how the Platform already works, and editorial changes, take effect when published.
| Role | Contact |
|---|---|
| Data Protection Officer (DPO) | myusedrobot.com/contact.html (subject: "DPO") |
| Legal / General | myusedrobot.com/contact.html |
| Accessibility feedback | See Accessibility Statement |
| Deleting data without an account | "Delete my data" link in our emails (see §9) |
| Response time | Within 5 business days (acknowledgement); 15 business days (full response) |
For LGPD-related requests, you may also contact Brazil's national data protection authority: ANPD — www.gov.br/anpd.