Privacy Policy

Who We Are: Data Controller

BlueScroll, Inc. operating as Vessel, a Delaware corporation headquartered in Texas, USA, is the data controller responsible for personal data processed through the Vessel platform at vessel.delivery. We provide a private way to finish a sale between two people: we hold the buyer's payment, send an independent courier to collect the item from the seller and deliver it to the buyer, and give the buyer 3 hours to check the item and then keep it or send it back. Throughout this policy, "we," "us," and "our" refer to BlueScroll, Inc.

Information We Collect

We collect the following categories of information when you use the Vessel platform:

• Account information: name, email address, phone number, and profile details you provide during registration.
• Address and location data: the pickup and delivery addresses for a deal, and the location and time the courier records at each stop. A buyer and a seller are never shown each other's address.
• Payment information: payment method details processed securely through Stripe, and the name on the card used to pay for a deal. We do not store full card numbers on our servers.
• Notes for the driver: an access note saved with an address (a gate code, a buzzer, or a unit number, for example), and a note for the driver on one deal. A note may name another person, such as someone who will meet the driver. A deal can also carry a tip for the driver.
• Device information: device type, operating system, browser, IP address, and unique device identifiers.
• Usage and analytics data: pages visited, features used, interactions with the platform, and performance metrics collected through PostHog.
• Photos: the photos a seller adds to describe an item, the photo the courier takes at the door, and any photos a buyer adds when starting a return.
• Texts with Vessel's assistant: every text you send us and every text we send you, any photos you send, and where your first text came from. The SMS / Text Messaging section says more.
• Messages to a Vessel Facebook Page: the messages and photos you send one of Vessel's Facebook Pages, and the ID Meta gives you for that Page. The Messages to a Vessel Facebook Page section says more.

How We Use Your Information

• Provide, operate, and improve the Vessel platform.
• Process payments, holds, and refunds for your purchases and sales.
• Arrange courier pickup and delivery, and confirm that an item was delivered.
• Send transactional notifications (sign-in codes, and delivery and account updates about your orders).
• Answer your texts and Facebook Page messages to Vessel's assistant, and grade the assistant's replies so we can make them better.
• Enforce platform rules, prevent fraud, and resolve disputes.
• Analyze usage patterns to improve the product experience.
• Comply with legal obligations.

SMS / Text Messaging

When you provide your mobile number and opt in, we send SMS text messages for sign-in codes (one-time passcodes) and delivery and account updates about your orders (such as when your item is picked up, when it is delivered, and when your inspection window is closing). Message frequency varies based on your activity. Message and data rates may apply. Reply STOP at any time to opt out, or HELP for help.

If you text Vessel's phone number, we reply in that conversation, and a reply may come from our automated assistant. It is an AI: its first reply says so, and it never says it is a person. Texting us makes a Vessel account for your phone if it does not have one yet. It is the same account you get when you sign in with that number here or in our app, and a link we text you that opens your own page signs you in to it with one tap. That link works once, for a short time. In that conversation we may ask if we can show what you are buying or selling to people on Vessel within 100 miles, and text you when we find a match, about deals you started, and with offers. They see only the item, photos, price and distance. We do this only if you reply REMIND to that question, and we keep a record of the question we asked and when you agreed. They never see your name, number or address, and we stop showing it when you reply STOP, when the deal closes, or after 30 days, whichever comes first. If you asked us to find something, we text you about it up to once a day, for up to 60 days. Other texts, like offers and deal reminders, are up to 4 a month. You do not have to agree to use Vessel. Reply STOP to stop all texts from Vessel.

Recycled phone numbers. Phone companies give old numbers to new people. To keep your account away from whoever gets your old number, we ask Twilio whether a number has moved to someone new. We ask when you sign in with a phone number we have not confirmed in over 30 days, and when a number we have not heard from in 90 days texts us. Twilio looks the number up in the FCC's Reassigned Numbers Database. We send Twilio only the number and the date we last confirmed it. If the number has moved, a sign-in asks you to use your email instead, and a text from that number starts a new account. A text also starts a new account if the database has no record of the number. We keep only the answer and the date we asked.

What the assistant may text you. Details of your own account and deals, such as an address you saved or where your delivery is. For a card or a bank account, it sends only the last 4 digits. It never sends you the other person's phone number.

Who reads your texts. AI models read the texts and photos you send the assistant so it can answer you. They also read past conversations to grade the assistant's replies, so we can make them better. The companies that run these models are under "Texts you send the assistant" in Third-Party Services below, with what each one gets and keeps. TypeSafe reads your texts too, to tell what a text asks for and to check each reply before it goes out. A person at Vessel reads a conversation when the assistant passes it to a person, and to check the assistant's work.

What we keep, and for how long. We keep every text you send us and every text we send you, and the photos you send, so the assistant can follow the conversation and so we can sort out a problem with a deal. We keep the full texts and photos for 90 days. After that we keep only a summary, with the private details taken out: when each text was sent, what was said about a deal (such as a reported problem or a promise), and when you agreed to texts or replied STOP. We keep that summary as long as we keep the record of your consent to texts. Twilio, which carries our texts, keeps its own copy. We delete Twilio's copy of your texts and photos when we delete ours. Twilio says a deleted text can stay in its backups for up to 30 days after that.

Where your first text came from. When you first text us, we note which of our ads, posts, pages or cards led you to us. We tell this from the first words you send, or from a code in them. We also note which Vessel number you texted and when, whether your first texts had a link, a photo or a code, when your first photo came, and whether you came with a deal already going, an item ready to list, or just a question. We use these notes only to count which ads and posts bring people to Vessel, and how fast we help them. They never change a price, a promo, or whether we answer you. They hold no phone number, none of the words you sent, no code, no link and no city. We never send them to Meta or to any other ad company. They stay linked to your conversation with the assistant while we keep it. Once that conversation is deleted, they are only counts, linked to no one.

The other person in your deal. If you text us a deal's code, we link your phone to that deal. If you tell the assistant your first name, we tell the person who made the deal that first name. If both people in a deal text us, the assistant may pass short messages between you about that deal, and translates them when you write in different languages. It takes out phone numbers, email addresses, payment handles and outside links first. We never give either person the other's phone number.

We do not share your mobile information or SMS opt-in consent with any third parties or affiliates for their marketing or promotional purposes. Mobile numbers are used only to send the texts described above and to check whether a number has moved to someone new, and are shared solely with the messaging provider (Twilio) that transmits these texts and runs that check on our behalf. No mobile opt-in data is sold or shared for marketing.

Showing Your Listing

Your listing. When you list an item to sell, we may post it on Vessel's own Facebook Pages for nearby areas, without asking you first. A post may show the item's photos and video, its title, price and city, how delivery is paid, and a short line from what you wrote about it. A post never shows your name, phone number or street. We may mark a post sold, change it when you change your listing, or take it down. Meta, which runs Facebook, then has the post under its own terms.

Saying no. You can say no at any time. Ask us to stop showing it (Contact Us, below), or tap "Stop showing it" if your listing shows that button. We then take your posts down and stop posting your item.

Instagram, our shop and our ads. We show your item there only if the box for it is ticked when you publish. It starts ticked, and you can untick it. Third-Party Services says what Meta's product catalog then gets.

Wanted posts. If you are buying and say yes when Vessel's assistant asks, we may post a wanted post on Vessel's own Facebook Pages: the item, a price range and the city. A wanted post never shows your name, phone number or street.

Cookies and Tracking

We use the following cookies:

• Authentication cookies: session tokens issued by Auth0 to keep you signed in.
• Analytics cookies: PostHog cookies to understand how the platform is used. These can be opted out of.

We record how our pages are used, such as taps and scrolling, to find and fix problems. Everything you type, card details and photos are hidden in these recordings. We use Vercel Analytics and Sentry for this.

Third-Party Services

We share data with the following service providers who process it on our behalf:

• Stripe: payment processing, including payment holds, captures, and fee collection via Stripe Connect. When a seller sets up payouts, Stripe collects identity-verification (KYC) information, such as legal name, date of birth, government identifiers, and bank account details, directly from them and processes it under Stripe's own privacy policy to meet Stripe's legal obligations.
• Auth0: identity and authentication services, including secure sign-in and session management.
• Vercel: web hosting and content delivery for vessel.delivery, which processes request data such as IP addresses and server logs.
• Sentry: error monitoring, and the recordings of how our pages are used that we describe under Cookies and Tracking.
• PostHog: product analytics and feature flag evaluation.
• Meta: ad measurement from the pages named under Cookies and Tracking, and from our servers as it says there. Meta handles this under its own terms.
• Reddit: the same, for our ads on Reddit.
• Meta: carrying the messages and photos you send a Vessel Facebook Page, and our replies, under its own terms (see Messages to a Vessel Facebook Page).
• Meta (Facebook): the posts of your listing on Vessel's own Facebook Pages that Showing Your Listing describes.
• Meta: showing your item on Vessel's Facebook and Instagram pages, shop and ads, only if the box for it is ticked when you publish. If the box is ticked when you publish, we send Meta's product catalog your item's title, photos, price and area. We never send your name, your phone or your street. Meta may keep its own copy of a photo after we take the item down.
• Expo: push notification delivery to mobile devices.
• Twilio: delivery of SMS verification codes and dispatch/delivery text notifications to the mobile number you provide; your texts with Vessel's assistant, photos included; and checking whether a phone number has moved to someone new (see SMS / Text Messaging).
• Fly.io: running our servers and Vessel's assistant. It handles what our servers handle, which includes the texts, Facebook Page messages and photos you send the assistant, and its replies.
• xAI: estimating the package size of an item so a delivery can be quoted, from its title, the notes you add about it, the size you picked for it, and the listing photo when you attach one; and reading the number off a photo of the item's serial number label, or of a phone's IMEI screen, when you add one. When xAI's AI model answers your texts, it also gets what the companies under "Texts you send the assistant" below get.
• Vercel AI Gateway: identifying, valuing and searching the items in your Vessel contents, from a photo you add of an item, the text made from it, and the words you search with. This is a separate service from the Vercel hosting above. The gateway passes these to OpenAI or Microsoft Azure, which run the AI model.
• TypeSafe AI: checking whether a courier can carry an item, from its title. Before we send the title, we try to take out any phone number, email address or street address in it, but we do not catch them all. For example, a street address typed in all capital letters or all small letters, with no apartment number or ZIP code after it, can get through. It reads the title when an item is listed or offered on, or its title changes. It also reads the texts you send Vessel's assistant and the assistant's draft replies, to tell what a text asks for and to check each reply before it goes out. We try to take out any phone number, email address or street address in them first, the same way, and we do not catch them all there either. Its published terms say it will not train or fine tune models on what we send it.

From your listings and your Vessel contents, the AI providers above get only what you tell us about an item: its title, the notes you add about it, the size you picked for it, its photos (including a photo of a serial number label or a phone's IMEI screen when you add one), the text made from those photos, and the words you use to search your Vessel contents. We do not send them the name, contact details and addresses on your account, or the delivery and return photos. But if you write a name, a phone number, an email address or an address into a title or a note, or one shows in a photo, it is sent with the rest. We try to take those out only of the title we send TypeSafe.

xAI deletes what we send within 30 days, and its terms say it does not train AI models on it. Its terms let it keep some of it longer: when the law requires it; when it is needed for safety, security, compliance, moderation, stopping abuse, or looking into a suspected breach of its terms; or when a different period is set in our agreement with xAI, in its documentation, in a clear notice inside its service, or by a setting we choose. Vercel's AI Gateway keeps none of it once a request is done, and Vercel says the gateway does not use it for training. The gateway passes each request to OpenAI or Microsoft Azure. OpenAI's terms say it does not train its models on what is sent to its API, and keeps it up to 30 days to check for abuse, or longer when the law requires it or to protect its service or others from harm. Microsoft's terms say it does not use what is sent to train AI models without permission. We have not found a set period in Microsoft's terms for how long it keeps it.

Texts you send the assistant: these companies run the AI models that read and answer your texts with Vessel's assistant. Each one gets the texts and photos you send the assistant, the assistant's replies, and the details of your account and deals the assistant looks up to answer you. We do not send them the phone number you text from. We use one at a time for each kind of text, and another when the first is down or busy.

• Google: Google's AI API, on a paid plan.
• Anthropic: Anthropic's API.
• OpenAI: OpenAI's API.
• Meta: Meta's Model API, its standard service.
• xAI: xAI's API.

We do not take names, phone numbers or addresses out of what you write to the assistant first, so if you write one, they get it. We do hide a card number, a security code, a Social Security number or a bank account number: we hide it before we store the text or any of these companies reads it.

Google says that on its paid service, which is the one we use, it does not use what we send to improve its products. It keeps what we send for 55 days to catch misuse of its service, and for any disclosure the law requires. Anthropic says it does not train its models on what we send. It deletes what we send within 30 days, unless the law requires it to keep it longer or it needs it longer to enforce its usage policy. When its systems flag something as breaking that policy, it keeps it up to 2 years. Meta says it does not train its AI models on what we send to its standard service, which is the one we use. We have not found a set period in Meta's terms for how long it keeps it. OpenAI and xAI keep what we send as we say for them earlier in this section.

Couriers are not on this list. They are independent delivery companies rather than providers working on our behalf, so they have their own section below.

Couriers

Couriers are independent delivery companies that move the item between the two people in a deal. They are not part of BlueScroll, Inc. For each delivery we give the courier only what its driver needs to find each stop, reach the person there, and know what they are carrying:

• Names: the name of the person at the pickup and the person at the drop-off. We use the name on your account. If your account has no name, we use the name on the card you paid with. If we have neither, the driver sees "Vessel customer."
• Phone numbers: a phone number for the person at each end, so the driver can call or text them about the delivery.
• Both addresses: the pickup address and the drop-off address.
• The item's title: the title of the item, as the seller or the buyer typed it, so the driver knows what they are picking up. We give it only to a courier we book. A courier we only ask for a price does not get it. If the title names someone, such as "Mom's dresser," the courier gets that too.
• Both kinds of note for the driver: the access note saved with each address, and each party's note for that deal. On a return trip, the courier gets the access notes only, never the deal notes.
• The tip: the amount of the tip for the driver.

We never give a courier your email address.

These details are disclosed only to the couriers we ask to carry that delivery, and only for it. When we ask more than one courier at once, each gets the same details. We cancel the others right away, and each keeps what it got only as its own terms allow.

Someone named in a note. If you name another person in a note, such as "Ask for Sam at the front desk," the courier and its driver get that name too. Name someone only if they expect the driver, and write only what the driver needs.

Who can read a note. The courier, its driver, and our support team. The other person in the deal never sees your notes.

We give a courier these details so it can carry out the delivery. What the courier then does with them is governed by its own terms. The courier and its driver may call or text you about the delivery, and a text from the courier, such as a tracking link, comes under the courier's own name.

The courier sends back proof of the trip: the time of pickup and of handoff, the location recorded at each step, and the photo the driver takes at the door. We keep that proof so we can settle returns and card disputes.

Our delivery partners today are Uber Direct and Frayt. Each one is an independent company that handles what we give it under its own privacy policy. We will update this list before we add another.

Data Retention

We retain your account data for as long as your account is active. Deal and transaction records are retained for a minimum of seven years to comply with financial reporting requirements. You may request deletion of your account and personal data at any time, subject to legal retention obligations.

When you delete your account, we delete your home address and every address you gave for a deal. On each deal you paid for, we also delete the name on the card you paid with and the phone number and email address recorded for that deal. A deal that is still under way keeps these until it ends, because the courier and the payment still need them, and we delete them after it ends. A courier's own copy of a delivery address is kept with that delivery record.

A note for the driver on one deal, and an access note saved with an address used only for that deal, are deleted 30 days after the deal ends. An access note saved with your home address stays until you change or clear it, or delete your account.

Delivery photos, handoff photos, and the courier location and time records for a trip are kept for 180 days after the transaction closes, or until any open dispute, claim, or card chargeback about that transaction is resolved, whichever is later. Then we delete them.

Your texts with Vessel's assistant, and the photos you send it, are kept in full for 90 days. Then we keep only a summary with the private details taken out, as long as we keep the record of your consent to texts.

The notes on where your first text came from stay linked to your conversation with the assistant while we keep it. After that, we keep them only as counts, linked to no one.

Your messages to a Vessel Facebook Page, and the photos you send, are kept in full for 90 days. Then we keep only a summary with the private details taken out, for 2 years after your last message.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to access: request a copy of the personal data we hold about you.
• Right to correction: request that we correct inaccurate or incomplete data.
• Right to deletion: request that we delete your personal data.
• Right to opt out: opt out of analytics tracking, non-essential cookies, and ad measurement.
• Right to data portability: receive your data in a structured, machine-readable format.

These rights apply under the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR) where applicable.

To exercise any of these rights, email privacy@bluescroll.com, the shared privacy contact for all BlueScroll, Inc. brands. We will verify your request and respond within the timeframe required by applicable law.

To delete messages you sent a Vessel Facebook Page, follow the steps under Messages to a Vessel Facebook Page above.

We do not sell your personal information. When the Meta and Reddit pixels run, or our servers send ad measurement to Meta and Reddit, the CCPA may count that as sharing for cross-context behavioral advertising. You can opt out with the "Do not sell or share my info" link at the bottom of every page that uses the pixels, or by turning on Global Privacy Control in your browser, which we follow automatically.

Security

We implement industry-standard security measures including encrypted data transmission (TLS), secure authentication protocols, and access controls to protect your personal data. No method of transmission over the internet is 100% secure, but we take reasonable steps to safeguard your information.

Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will notify you through the platform or via email. Your continued use of the platform after changes take effect constitutes acceptance of the updated policy.

Contact Us

If you have questions about this privacy policy, contact us at privacy@vessel.delivery. To exercise your data rights across any BlueScroll, Inc. brand, use the shared privacy contact at privacy@bluescroll.com. You can also write to us by mail at Vessel, 605 W 9th Street Unit #4132, Austin, TX 78701.