v3.0 — April 18, 2026 (current)
v2.0 — April 13, 2026 (archived)
Prior versions are retained internally. Request a copy via our contact page.
🔒 Summary: We collect only the data necessary to operate the marketplace. We do not sell or share your personal data for advertising purposes. We use Google Analytics for traffic insights only after you consent via our cookie banner, and MailerLite only if you subscribe to our newsletter. You can download all your data or delete your account at any time from Dashboard → Settings.
MyUsedRobot.com (the "Platform"; "we", "us", "our") is an online marketplace for humanoid robots. In this Privacy Policy, the terms "Platform", "Service", and "website" are used interchangeably and refer to the same thing: the MyUsedRobot.com website and its associated back-end services. For the purposes of data protection law, we act as the data controller for personal data collected through the Platform.
This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the Platform, in accordance with the Brazilian General Data Protection Law (LGPD — Lei nº 13.709/2018), the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and other applicable international privacy laws listed in Section 12.
| Data | When collected | Purpose |
|---|---|---|
| Name | Registration | Account identification, listing display |
| Email address | Registration | Account authentication, notifications, newsletter (with consent) |
| Phone number | Registration (optional) | Internal seller verification only. Never displayed publicly on listings or seller profiles; buyers contact sellers only through the in-site secure messaging system. |
| Company name | Registration (optional) | Seller profile, company verification |
| Address (city, state, country) | Registration | Listing localisation, shipping context |
| Listing content | Listing creation | Publication and display of the listing |
| Photos | Listing creation | Stored on Google Drive, displayed in listings |
| Messages | Chat system | Communication between buyer and seller |
| Reviews | Review submission | Seller reputation display |
| Data | Method | Purpose |
|---|---|---|
| IP address | Server logs | Security, fraud detection, geographic inference |
| Browser type and version | HTTP headers | Compatibility and security |
| Pages visited and time on site | Google Analytics | Traffic analysis, UX improvement |
| Search queries on the Platform | URL parameters | Search functionality, aggregate analytics |
| Listing views and likes | JavaScript events | Popularity metrics, seller dashboard |
| Session and authentication tokens | localStorage | Keeping you logged in |
| Language and country preferences | localStorage | Localisation of the Platform |
If you choose to register or log in using Google, Microsoft, LinkedIn, or GitHub, we receive from those providers only your: name, email address, and profile photo (where available). We do not receive your password or any financial information from these providers.
We do not use your data for automated decision-making that produces significant legal effects, nor for profiling beyond the personalisation of listing results and language preferences.
| Processing Activity | GDPR Basis | LGPD Basis |
|---|---|---|
| Account registration and management | Contract performance (Art. 6(1)(b)) | Contract performance (Art. 7, VI) |
| Listing publication | Contract performance (Art. 6(1)(b)) | Contract performance (Art. 7, VI) |
| Transactional emails | Contract performance (Art. 6(1)(b)) | Contract performance (Art. 7, VI) |
| Newsletter | Consent (Art. 6(1)(a)) | Consent (Art. 7, I) |
| Google Analytics | Legitimate interests (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX) |
| Fraud prevention and security | Legitimate interests (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) | Compliance (Art. 7, II) |
Subscription to our newsletter uses a double opt-in process: after you submit your email address, we send you a confirmation email. Your subscription is only activated after you click the confirmation link. Until confirmed, we retain your email only for the purpose of sending the confirmation email, and will delete it if you do not confirm within 7 days.
Every newsletter contains an unsubscribe link. You may withdraw your consent at any time by clicking that link; the withdrawal takes effect immediately and does not affect the lawfulness of any processing carried out before the withdrawal.
We do not sell your personal data. We share data only in the following limited circumstances:
| Provider | Service | Data shared | Location |
|---|---|---|---|
| Google LLC | Google Sheets (database), Google Drive (photos), Google Apps Script (backend), Google Analytics (traffic), Google Identity (login) | Name, email, listing data, photos, usage events | USA (SCCs) |
| MailerLite UAB | Newsletter management | Name, email (newsletter subscribers only) | Lithuania / EU |
| Hostinger International | Web hosting | Server logs, IP addresses | Lithuania / EU |
| Cloudflare Inc. | CDN, DDoS protection, SSL | IP addresses, HTTP headers | USA (SCCs) |
When you publish a listing, the following data becomes publicly visible: brand, model, condition, year, price, location (city/country), description, photos, and your display name. This data may be indexed by search engines.
We may disclose your data if required to do so by law, court order, or at the request of competent public authorities, to the extent necessary to comply with such obligations.
| Cookie / Storage Key | Type | Purpose | Duration |
|---|---|---|---|
| mur-session | Functional (localStorage) | Authentication session | 30 days |
| mur-user | Functional (localStorage) | Cached user profile for faster load | 30 days |
| mur-theme | Preference (localStorage) | Light/dark mode preference | Until cleared |
| mur-lang | Preference (localStorage) | Language preference | Until cleared |
| _ga, _gid, _ga_* | Analytics (cookie) | Google Analytics — visitor identification and session tracking (loaded only after your explicit consent via the cookie banner) | 13 months |
| mur-consent | Functional (localStorage) | Records your cookie consent choices | 12 months |
You can clear localStorage data and cookies through your browser settings at any time. Disabling analytical cookies will not affect core Platform functionality but will prevent us from counting your visit in our analytics. You can opt out of Google Analytics tracking at tools.google.com/dlpage/gaoptout.
We do not use advertising cookies or behavioural tracking cookies. We do not share data with advertising networks.
| Data Category | Retention Period |
|---|---|
| Account data (name, email, profile) | Until account deletion, plus 30 days |
| Active listings | 30 days from publication (renewable) |
| Expired listings | 30-day grace period, then permanently deleted |
| Messages | 12 months after the date of the last message exchanged in the conversation. Users can delete individual conversations from their Dashboard → Messages at any time, which triggers immediate anonymization of that conversation's contents on our servers. "Last activity" is defined as the timestamp of the most recent message sent or received in the conversation. |
| Reviews | Until account deletion |
| Google Analytics data | 14 months (anonymised after this period) |
| Server logs | 90 days |
| Newsletter subscription | Until unsubscribe request |
Upon account deletion, we will anonymise or delete your personal data within 30 days, except where retention is required by law or for legitimate fraud prevention purposes.
Our primary infrastructure is hosted in the EU (Hostinger, Lithuania). However, we use Google services (Sheets, Drive, Analytics, Identity), which process data in the United States. Google is certified under the EU-US Data Privacy Framework and uses Standard Contractual Clauses (SCCs) as a transfer mechanism. Cloudflare's CDN may route traffic through global data centres.
For users in the European Economic Area: these transfers are protected by appropriate safeguards as required by GDPR Chapter V. You may request further information about these safeguards via our contact page (subject: "Data transfer safeguards").
Depending on your location, you may have the following rights regarding your personal data:
| Right | Description | Available under |
|---|---|---|
| Access | Request a copy of the personal data we hold about you | GDPR, LGPD, CCPA |
| Rectification | Correct inaccurate or incomplete data | GDPR, LGPD |
| Erasure ("right to be forgotten") | Request deletion of your personal data | GDPR, LGPD |
| Restriction | Request we restrict processing of your data in certain circumstances | GDPR |
| Portability | Receive your data in a structured, machine-readable format | GDPR, LGPD |
| Object | Object to processing based on legitimate interests | GDPR, LGPD |
| Withdraw consent | Withdraw consent at any time (newsletter, etc.) without affecting prior processing | GDPR, LGPD |
| Non-discrimination | Not be discriminated against for exercising your rights | CCPA, LGPD |
To exercise any of these rights, please contact us at our contact page. We will respond within 15 business days (LGPD) or 30 days (GDPR). You also have the right to lodge a complaint with your national data protection authority (e.g., ANPD in Brazil, your EU supervisory authority).
Logged-in users can exercise these rights directly without contacting us:
For rights that cannot be self-served (restriction, objection, or complaints), please use our contact page or the email below. We may request identity verification to prevent unauthorized requests.
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional specific rights. This section applies in addition to Section 9 above.
In the 12 months preceding the Effective Date, we have collected the following categories of personal information (as defined by Cal. Civ. Code §1798.140):
We do not sell personal information in the traditional sense. However, under the broad CCPA/CPRA definitions of "sale" and "sharing," the following third-party analytics may constitute "sharing" for cross-context behavioural advertising purposes:
We do not use advertising cookies, do not engage in targeted advertising based on your activity across unaffiliated sites, and do not share your data with advertising networks.
No financial incentive: we do not offer financial incentives in exchange for personal information.
We will respond to verifiable California privacy rights requests within 45 days (extendable to 90 days for complex requests, with notice).
In addition to LGPD (Brazil) and GDPR (EU/EEA), users in the following jurisdictions are protected by their local data protection laws, which grant rights substantially similar to those described in Section 9:
Mainland China (People's Republic of China): The Platform is not specifically designed for the Chinese market and we do not currently hold an ICP licence. If you access the Platform from mainland China, you do so on your own initiative, and the primary processing of your data is governed by the laws of Brazil (data controller) and, where applicable, the EU/EEA. We do not currently comply with the Personal Information Protection Law (PIPL), Data Security Law (DSL), or Cybersecurity Law (CSL) requirements for domestic operators. We may restrict availability or remove Chinese-language content from the Platform at any time without notice.
For rights under any of the above laws, please contact our DPO via our contact page. Where local law requires data to be processed by an in-country representative, we may not be able to offer full services without first establishing such representation.
The Platform is not directed at, or intended for use by, children under the age of 18. We do not knowingly collect personal data from minors. Humanoid robot marketplaces are inherently oriented toward commercial and industrial use cases and are not designed as a service for minors.
Specific jurisdictional considerations:
If we discover that we have collected personal data from a person under 18, we will delete such data within 7 days of becoming aware. If you are a parent or guardian who believes a minor has registered on the Platform, please contact us via our contact page and we will prioritize the request.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, and disclosure. These measures include:
However, no method of transmission over the internet or electronic storage is 100% secure.
In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authorities within the timeframes required by applicable law:
This section supplements the global rights described in Section 9 with specific notices for residents of certain jurisdictions. Where a specific law provides stronger protection, those rules prevail.
If you are a resident of California, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights regarding your personal information:
In the preceding 12 months, we have collected the following categories of personal information: identifiers (name, email, IP address), commercial information (listing history, messages), internet/network activity (page views, searches), and geolocation (country, inferred from IP). We have not sold personal information for monetary consideration. We may have "shared" information under CCPA's broad definition solely via analytics cookies; users can opt out as described above. We retain information as described in Section 7.
To submit a verifiable consumer request, use the "Export my data" or "Delete my account" buttons in your Dashboard, or contact us at our contact page. We will verify your identity before processing.
For users in the United Kingdom, references to "GDPR" in this policy should be understood as referring to the UK GDPR as incorporated into UK law by the Data Protection Act 2018. The supervisory authority is the Information Commissioner's Office (ICO) — ico.org.uk. UK residents have the same substantive rights listed in Section 9.
EU/EEA residents are protected by the General Data Protection Regulation (GDPR) and by the national data protection authority of their country. A complaint may be lodged with any supervisory authority; a list is maintained by the European Data Protection Board at edpb.europa.eu.
Brazilian users are protected by Lei nº 13.709/2018 (LGPD). The supervisory authority is the Autoridade Nacional de Proteção de Dados (ANPD) — www.gov.br/anpd. Brazilian users are also protected by Lei nº 8.078/1990 (Código de Defesa do Consumidor) and Lei nº 12.965/2014 (Marco Civil da Internet).
The following laws apply to users in the listed jurisdictions and confer rights analogous to those in Section 9. Contact the corresponding authority for complaints:
| Country | Law | Authority |
|---|---|---|
| Canada (federal) | PIPEDA | Office of the Privacy Commissioner — priv.gc.ca |
| Canada (Quebec) | Law 25 | Commission d'accès à l'information — cai.gouv.qc.ca |
| Australia | Privacy Act 1988 | Office of the Australian Information Commissioner — oaic.gov.au |
| Japan | APPI | Personal Information Protection Commission — ppc.go.jp |
| South Korea | PIPA | Personal Information Protection Commission — pipc.go.kr |
| India | DPDP Act 2023 | Data Protection Board of India (once established) |
| Mexico | LFPDPPP | INAI — inai.org.mx |
| Switzerland | revFADP | FDPIC — edoeb.admin.ch |
Although we accept users selecting "China" as their country, MyUsedRobot.com is not operated under Chinese law, does not hold an ICP license, and does not undergo Chinese cross-border data transfer security assessments. If you access this Platform from within mainland China, you do so at your own risk and are responsible for compliance with applicable local laws. Your personal data will be processed under the laws of Brazil, the European Union (for EU-based processors), and the United States (for US-based processors like Google), as described in Sections 5 and 8.
We may update this Privacy Policy from time to time. Material changes will be notified by email to registered users and by a prominent notice on the Platform at least 15 days before taking effect. The "Last updated" date at the top of this page will always reflect when the policy was last revised.
Each published version of this policy is assigned an internal version number, shown in the "Last updated" line. If a material change is made (for example: a new category of data processed, a new third-party processor, or a change in the legal basis for processing), we will (a) notify registered users by email at least 15 days in advance; (b) require explicit re-acceptance upon their next login after the effective date; and (c) retain a complete version history internally so you can request prior versions via our contact page.
Purely editorial changes (typo fixes, clarifications without substantive effect) do not require re-consent but are reflected in the "Last updated" date.
| Role | Contact |
|---|---|
| Data Protection Officer (DPO) | myusedrobot.com/contact.html (subject: "DPO") |
| Legal / General | myusedrobot.com/contact.html |
| Accessibility feedback | See Accessibility Statement |
| Response time | Within 5 business days (acknowledgement); 15 business days (full response) |
For LGPD-related requests, you may also contact Brazil's national data protection authority: ANPD — www.gov.br/anpd.