Olive Auction runs an olive oil marketplace across two sites and one Android app: oliveauction.com for the mills and estates that consign, olive.auction for the sale itself. One account system stands behind all three, so this page describes all three. It lists what the software actually stores.
An account holds your email address, your name, the mill or estate name, country, region, the delivery address you enter as a buyer, the site language you use, and the settlement rails you choose to publish to your winners — account name, IBAN, PayPal, Revolut or Wise, whichever you fill in. Your password is stored as a salted PBKDF2-HMAC-SHA256 hash at 150,000 iterations and never in readable form; a forgotten password is replaced through an emailed reset link. The IP address an account was opened from is kept on the account record and used to spot a mill bidding on its own lots.
Signing in sets one cookie, named oa_session: a random token, HttpOnly, Secure, SameSite=Lax, valid for 30 days and pushed back to a fresh 30 days while you keep using the account. The token means nothing on its own — the matching row on our server is what identifies you, and signing out or deleting the account deletes that row. There are no third-party cookies on either site. The browser also keeps a few small preferences locally: your light or dark choice, the account label shown in the header, whether you have already seen the sale-alert notice, and the analytics identifiers in §6. Clearing site data clears all of them.
A lot carries what you type into the listing form — title, cultivar, region, harvest, lab figures, tree reference, packaging, carriage rates — plus the photographs you attach. Laboratory documents you upload to your dossier shelf are not served publicly; they are reachable only through a signed-in request that checks the file is yours. Every bid is stored with its amount, the account behind it and the time it landed. Sold lots produce an order and a commission invoice, and to those are added the tracking number you log, any revised carriage figure, and any damage claim with the photographs attached to it. When a lot sells, the mill receives the winner's name and delivery address, and the buyer sees the settlement rails the mill publishes. That exchange happens for that settlement and nothing else — buyer details are never published, sold or passed on for marketing.
Card details are entered on Stripe's own hosted checkout page and never reach our servers; we neither see nor store a card number. What we keep is the identifier Stripe gives back for the checkout session and the payment, the amount, and whether it is held or settled. The producer commission is taken as a pre-authorisation — a hold placed on the card when a lot sells and captured when the shipment is logged — and a cancelled sale releases it. Where a mill settles by bank transfer or crypto instead, we store the reference or transaction id it declares so the payment can be matched. Buyers pay mills directly on the mill's own rails; that money never passes through Olive Auction, and we hold no payment credentials for it.
Transactional email — sale results, settlement steps, password resets, deletion confirmations — is sent from our own mail server. Sale alerts and any mailing go only to addresses that asked for them on the sign-up form, which stores the name, the address and the language. The Android app registers a Firebase Cloud Messaging token so a lot closing soon or an outbid can reach your phone; we store that token, the account it belongs to and when it was last seen, and Google's FCM service carries the message itself. Turning notifications off, signing out or uninstalling the app removes the token from our side.
There is no advertising network, no third-party analytics suite and no cross-site tracking anywhere on either site or in the app. Page views are counted by our own script on our own server. A view records the page path and title, the referring site's host, the browser language, the screen size, the device, browser and operating system read off the user-agent string, a two-letter country from the edge, a random visitor identifier held in the browser's own storage, a session identifier that lasts until the tab closes, and a salted one-way hash of the IP address. The IP address itself is not written to the analytics record. Clearing site data resets the identifiers, and nothing collected here is sold or shared.
A consignment enquiry or a support message is stored with the name, email and text you send, emailed to us so a person answers it, and copied into our own follow-up system on our own infrastructure so nothing is lost between replies. A problem report sent from the footer link carries your message, any screenshot you attach and the device context the browser reports, along with your email if you are signed in. Every form is rate-limited by IP address, which is held in memory for the length of that window and not stored.
You can close your account yourself from your account page. It takes two steps: the request, then a confirmation link emailed to you that works for one hour. Confirming deletes your sessions, any password-reset tokens, your watchlist and your sale-alert entry. An account with no trading behind it is removed outright. An account that has listed, bid, ordered or been invoiced is anonymised instead — name, mill and region cleared, the email replaced with an unusable placeholder, the password disabled — while the orders and invoices themselves remain as the records of completed sales. Deletion also suppresses the address in our follow-up system so no mailing can reach it again.
Accounts are kept until you delete them. Records of completed sales — orders, invoices, the trail behind a settlement — are kept as the books of the service after an account is anonymised. Listings, bids and watchlists live with the account. Enquiries and support messages are kept while the matter is open and for reference afterwards.
A copy of what we hold on you, a correction, or deletion where you cannot reach the button: ask through the support form and it is answered individually, within two working days. The producer terms sit alongside this page, and the buyer side has its own at olive.auction. Changes to this page are posted here.
