Privacy Policy

We collect only what is needed to run the marketplace, keep it safe, and meet our legal obligations.

• Account and authentication: email, username, and password (stored only as an argon2id hash, never in plain text), plus login history, active sessions, and two-factor settings.
• Profile: avatar, bio, country, language, currency, and interface preferences.
• Verification (KYC): identity documents and personal details required to sell or withdraw funds, stored encrypted and accessed only when strictly necessary.
• Financial: orders, wallet balance, payouts, and transaction history. Card and payment details are handled by our payment partners, not stored on our servers.
• Communications: buyer–seller chat messages, support tickets, and disputes.
• Technical and usage: IP address, browser and device data, device identifiers used to prevent fraud and ban evasion, and presence (your last-seen time).
• Behavioural signals: which listings and pages you view, how long you stay on them, and which search results you click — detailed under “Usage data and recommendations”.

Your data powers the service and protects everyone on the platform.

• Operate the marketplace: process orders, payments, payouts, and deliveries.
• Authenticate you and keep your account secure.
• Prevent fraud, abuse, money laundering, and multiple-account or ban-evasion attempts.
• Mediate disputes and provide customer support.
• Comply with legal obligations such as identity verification (KYC/AML) and tax rules.
• Improve and personalize the platform — your language, currency, and preferences.
• Send transactional messages and notifications; marketing only with your consent.

We process personal data under recognized legal bases (LGPD / GDPR).

• Performance of a contract: to deliver the marketplace services you request.
• Legal obligation: to meet KYC/AML, tax, and accounting requirements.
• Legitimate interest: to keep the platform safe and prevent fraud and abuse.
• Consent: for optional features such as marketing communications, which you can withdraw at any time.

We never sell your personal data. We share it only with trusted parties needed to operate the service or when required by law.

• Payment processors and gateways to charge buyers and pay out sellers.
• Identity-verification and anti-fraud providers used during KYC and risk checks.
• Infrastructure providers (hosting, email, storage) bound by data-protection terms.
• Authorities and courts when legally required, or to protect the rights and safety of users and the platform.

We use cookies and similar storage to keep you signed in, remember your choices, protect your account, and measure how the marketplace is used.

• Essential: session and refresh tokens (m9_rt, httpOnly), CSRF protection, and security cookies — required for the site to work and to keep you signed in.
• Preferences: language (m9_locale) and currency (m9_currency) cookies, plus browser local storage for your theme (m9_theme), reduced-performance mode (m9_perf), and recent searches (m9_recent_searches).
• Usage measurement: an anonymous visitor identifier (m9_anon_id) — a random value created on your first visit, kept for one year, and used only so that the same visit is not counted twice. It carries no name, email, or device data, and it never authorizes anything.
• We do not use third-party advertising or cross-site tracking cookies.
• Preference cookies and local storage are never used to authorize sensitive actions — that is always verified by our backend.
• You can clear or block this storage in your browser at any time. Clearing the visitor identifier simply creates a new anonymous one; clearing essential cookies signs you out.

We record how the marketplace is used so we can rank listings, improve search, and understand overall traffic.

• What we record: the pages you open, the listings you view and how long you stay on them, and which search result you click — including the search term and the position of the result.
• Each event is linked to your account when you are signed in, or to the anonymous visitor identifier described in the cookies section when you are not.
• Why: to order the catalog (trending and relevance sorting), improve search results, and produce aggregated traffic reports for our team.
• Raw usage events are deleted after 30 days by an automated daily cleanup. Only the aggregated rankings derived from them are kept longer, and those contain no personal data.
• Your IP address is not stored with these events, and they are not used to build advertising profiles or shared with third parties for advertising.
• Deleting your account also deletes the usage events linked to it.

We apply strong technical and organizational measures to protect your data.

• Passwords are hashed with argon2id and never stored or logged in plain text.
• Sensitive data such as KYC documents and credentials is encrypted at rest.
• Logs are scrubbed of personal data (CPF, address, phone, tokens) before being stored.
• Data is transmitted over TLS, and access is restricted by role and ownership checks.
• No system is perfectly secure, but we continuously review and improve our safeguards.

We keep your data only for as long as it is needed.

• While your account is active, we retain the data required to provide the service.
• After account deletion, we remove or anonymize your data, except where retention is required by law (financial, tax, and anti-fraud records).
• Backups are kept for a limited period and then permanently deleted.
• Usage events are deleted after 30 days; the aggregated rankings derived from them contain no personal data.

You are in control of your personal data and can exercise your rights at any time.

• Access, correct, or update your personal data.
• Request deletion of your data, subject to legal retention requirements.
• Request a portable copy of the data you provided.
• Object to or restrict certain processing, and withdraw consent where it applies.
• To exercise any of these rights, contact us through a support ticket.

M9 is a global, multi-currency marketplace, so your data may be processed in other countries.

• Data may be processed by providers located outside your country of residence.
• Whenever we transfer data internationally, we apply appropriate safeguards and contractual protections.
• We require the same level of protection from our partners regardless of where they operate.

M9 is not intended for people under the age of 18.

• We do not knowingly collect personal data from anyone under 18.
• If we learn that a minor has created an account, we will remove it and delete the associated data.
• If you believe a minor is using the platform, please report it to our support team.

This policy may evolve as the platform grows and new features ship — and you will always be told when it does.

• We may update this Privacy Policy to reflect new features, legal requirements, or improvements.
• When we make material changes, we notify you in advance — by email and/or an in-app notice — before they take effect.
• The "Last updated" date at the top of this page always reflects the current version.
• Continuing to use M9 after a change takes effect means you accept the updated policy; if you disagree, you may stop using the service and request account deletion.