Privacy Policy

Second Stir, based in Ireland, is the data controller for the personal information described in this policy. We collect information in two ways.

Information you give us

• Your email address, when you request a valuation, sign up to be notified, or request a bulk quote.
• The machine model, condition, and included accessories you select on the valuation form.
• Your business name and desired quantity, if you submit a bulk quote request.

Information collected automatically

• Product analytics on how the site is used (e.g. which pages you visit and which buttons you click), via Statsig.
• Bot-detection signals collected by Vercel BotID (powered by Kasada) when you submit a form, used only to tell human traffic from automated abuse.
• Standard server logs (IP address, browser type, timestamps) generated by our hosting provider, Vercel.

We do not ask for or store payment card details, government ID, or a password — the site doesn't currently have user accounts.

• To respond to your valuation, notify-me, or bulk-quote request by email.
• To operate, secure, and improve the site, including understanding which pages and features are used.
• To detect and prevent spam, fraud, and automated abuse of our forms.
• To meet legal obligations, and to enforce our Terms of Service.

We don't sell your personal information, and we don't use it to serve you third-party ads.

We share data with the service providers who run Second Stir on our behalf, and nobody else:

• Supabase — stores form submissions in our database. Row-level security restricts the public site to inserting new submissions only; it cannot read, edit, or delete them.
• Vercel — hosts the site and runs BotID, our bot-detection layer.
• Statsig — provides product analytics and feature flagging.

Each provider only receives what it needs to do its job, and is bound by its own privacy and security commitments. If we ever need to disclose information to comply with the law, or to protect the rights, safety, or property of Second Stir or others, we will do so only to the extent required.

Statsig and BotID may use cookies or local browser storage to distinguish repeat visitors from new ones and to recognize legitimate traffic. We don't use these for cross-site advertising tracking. You can block cookies in your browser, though some parts of the site — like form submission — may not work correctly without them.

We keep form submissions for as long as reasonably needed to respond to your request and for our own records, and delete or anonymize them sooner on request (see below).

Under the GDPR, you have the right to access, correct, export (data portability), or erase the personal information we hold about you, and to object to or restrict certain processing. To exercise any of these, email hello@secondstir.com from the address you used to contact us, and we'll respond within a reasonable time.

You also have the right to lodge a complaint with Ireland's Data Protection Commission (DPC) — dataprotection.ie — or the supervisory authority in your own country, if you believe we haven't handled your information properly.

Second Stir is not directed at children, and we don't knowingly collect information from anyone under 16.

We're based in Ireland, inside the European Economic Area (EEA). Where a service provider processes data outside the EEA, we rely on the European Commission's Standard Contractual Clauses, an adequacy decision, or another lawful safeguard to cover that transfer.

We use reasonable technical and organizational measures to protect your information, including restricting database access to inserts only from the public site and keeping service credentials out of client-side code. No method of transmission or storage is perfectly secure, so we can't guarantee absolute security.

We may update this policy as the site changes; we'll update the “last updated” date above and, for material changes, make that clear on this page.

Questions about this policy or your data? Email hello@secondstir.com.