Privacy policy

About this policy

This Privacy policy explains how Food Trailers Marketplace ("we", "us", "our") collects, uses, and protects personal information when you use the US version of the platform, including when you register as a supplier, operator, event organizer or parking spot owner, browse listings, contact us, or pay for an optional feature.

It applies in conjunction with our Terms of use. By using the platform you agree to the practices described here.

Who we are

The platform is run by Food Trailers Marketplace, operated from Ireland. Because we are based in Ireland, we handle all personal data under the EU General Data Protection Regulation (GDPR), wherever you live. If you live in the United States, you also have the rights described in section 16. You can reach us about anything in this policy through the contact form or at info@foodtrailersmarketplace.com.

What data we collect

We only collect what we need to operate the platform. The categories below cover everything we routinely process.

Account data: business name (and DBA name, if you use one), account email address, hashed password, and any contact details (phone, WhatsApp, email) you choose to publish on your public profile or listings.

Listing content: titles, descriptions, prices, state, county and city, photos you upload, and category information you select.

Verification documents: for suppliers on the optional ✓ Verified tier, we collect one business registration document (a state registration, business license, DBA certificate or seller's permit), which is reviewed by our team, sent to our admin mailbox, and deleted from our server 7 days after it is sent for review. We never ask for an EIN or Social Security number, and we ask you to cover them on the document before you upload it.

Payment data: for paid features (Verified subscription, listing promotions), payments are processed by Stripe. We never see or store full card numbers; we only retain Stripe customer IDs, transaction IDs, and the last 4 digits + card brand to display in your dashboard.

Communications: messages you send via the contact form, replies to support emails, and any documents you attach.

Account activity: the date and time you last signed in, the IP address used for that sign-in, and the date and time your account was last used while signed in. We record the last-used timestamp at most once every five minutes, and we do not record which pages you visited while signed in.

Technical data: IP address (used for rate limiting and abuse prevention; hashed before being stored for analytics), browser type, device type, referring URL, pages viewed, and timestamps. Some of this is collected via cookies (see section 7).

How we use your data

We use personal information only for these purposes (the GDPR legal basis for each is in parentheses):

• Providing the service (performance of a contract): running your account, displaying your listings, processing your subscription or promotion payment, sending transactional emails (verification, password reset, payment confirmations).
• Keeping the platform safe and useful (legitimate interests): rate limiting, abuse detection, fraud prevention, aggregate analytics so we can improve the site, and showing you relevant features in your dashboard.
• Marketing emails (consent): only if you opt in. You can withdraw consent at any time from your dashboard preferences or with the unsubscribe link in any marketing email.
• Legal requirements (legal obligation): keeping payment and tax records for the period the law requires, and responding to lawful requests from authorities.

We do not sell or rent personal information to third parties, we do not share it for cross-context behavioral advertising, and we do not use your data for automated decision-making or profiling that produces legal effects.

Trailer Operators: public data on the Trailers Map

If you sign up as a Trailer Operator (separate from a supplier account), the following information about each food truck or trailer you add becomes publicly visible on our Trailers Map:

• Your business name
• Each truck or trailer's full address and exact pin location (latitude / longitude)
• Up to 10 photos per truck or trailer that you upload
• The short description (up to 280 characters) you write for each truck or trailer
• Your contact methods (any combination of phone, WhatsApp, email) so customers can reach you directly
• Your business type (Coffee, Food, or Coffee & Food), used by the map filter

Your consent: you agree to this public display by checking the public-display checkbox at registration (GDPR Article 6.1.a). The checkbox is mandatory because the entire purpose of the Trailer Operator account is to appear on the public map: without that consent there is no service to provide.

Embedded Google Maps: the public map is rendered using Google Maps Platform. When the page loads, your browser makes requests to maps.googleapis.com and maps.gstatic.com; Google may process your IP address as part of that load. See Google's Privacy Policy.

"Trailers near me" GPS feature: when you click this button on the map, your browser asks for permission to share your current location. We use it only to center the map on your view and immediately discard the coordinates: they are never sent to our server and never stored.

Right to remove: you can delete any truck or trailer (which removes its pin from the map immediately) at any time from your operator dashboard at /operator/trailers. You can also close your entire Trailer Operator account; doing so erases your operator profile, all trucks and trailers, and all uploaded photo files within 7 business days.

Events & Parking Spots: public listings and applications

We operate two further account types: Events Coordinator (posts events that need food trucks, coffee trailers or food trailers) and Parking Spots Operator (lists parking spots available to food trucks and trailers). Both are separate from supplier and Trailer Operator accounts.

If you post a listing, the following becomes publicly visible to anyone on /events-and-parking, with no login required:

• Events: the event name, theme, start date and duration, full location, the type of truck or trailer you need, your description, and any photos you upload
• Parking spots: the location, whether electricity and water are provided, your description of the truck or trailer you want, any photos you upload, and the contact details you enter (any combination of phone, WhatsApp and email)
• The display name on your account, shown alongside your listings

Your account email address is not published: it is used to send you applications. Note that a parking-spot listing publishes whatever contact details you choose to enter, so only enter details you are happy to make public.

If you apply to a listing (only Trailer Operators can), the business name, phone number, email address and any additional details you type into the application form are sent to the person who posted that listing, by email and in their dashboard. This is a disclosure to another user of the platform, not to the public: applications are never shown on any public page. We share only what you type into that form.

Legal basis: performance of a contract (GDPR Article 6.1.b). Publishing your listing and passing an application to the listing owner are the service you signed up for. Posting a listing and submitting an application are both voluntary acts you initiate.

Retention: events are hidden from the public page automatically once the event's end date has passed, but the record is kept until it is deleted, by you or by an administrator. Parking spots stay listed until you delete them. You can edit or delete any listing at any time from your dashboard; deleting a listing also permanently removes its photos and any applications it received. Closing your account erases your profile, every listing you posted, all uploaded photo files, and all applications you received, within 7 business days.

Jobs: job posts and applications

Job Posting Employer accounts post jobs on /jobs. A job post is publicly visible, with no login required: the job title, description, type, pay (if given), state and city, the date it was added, its closing date, any photos, and the company name and website. The employer's account email, the email where applications arrive and the phone number are not published.

If you apply for a job, your name and surname, phone number, email address and the resume file you attach are sent to the employer who posted that job, by email (with the resume attached) and in their dashboard, after you confirm that the job's location suits you. Applications are never shown on any public page. We also email you a copy of what you applied for.

Legal basis: taking steps at your request before entering a contract (GDPR Article 6.1.b): passing your application to the employer is the service you ask for when you press Send. Once the employer receives it, they are responsible for it as a separate data controller and may use it only to recruit for that job.

Retention: we keep applications and resume files privately on our server for 6 months, then delete them automatically (the file, your name, phone and email). To have yours deleted sooner, reply to the confirmation email or contact us. The copy the employer received by email is kept by them under their own policy. Jobs leave the site on their closing date (60 days at most); employers can put a job on hold, renew it or delete it, and deleting a job also deletes its photos and the applications it received.

Courses: buying a course

If you buy a course on /courses, you give us your name and email address. We send a link to that address to confirm it, and after payment we send the course PDF and a personal download link to it. Stripe handles the payment: we never see your card details. With your order we keep the course, the price, the date, the box you checked before paying, and when the course was sent and downloaded.

Legal basis: performance of a contract (GDPR Article 6.1.b): selling and delivering the course you ask for. Keeping the sales record afterwards is a legal obligation (Article 6.1.c, tax and accounting rules).

Retention: an order whose email is never confirmed is deleted automatically after 30 days. Paid orders are kept as accounting records for 6 years.

Cookies

We use a small set of strictly essential cookies to keep the platform working. We do not set any analytics, advertising or tracking cookies.

Visit statistics (Umami): to see which pages people use, we count visits with Umami (Umami Software, Inc., USA). It sets no cookies and stores nothing on your device. With each page view your browser sends Umami the page address, the address of the page you came from, the page title, your browser, device type, screen size and language, and, as with any connection, your IP address. Before anything is sent, private links (email confirmation, password reset, course download) are removed from the addresses, and so is everything after the "?" except campaign tags (utm_...). We only see totals, such as page views, visitors, referring sites, countries, browsers and devices: Umami does not give us your IP address or anything that identifies you.

Essential cookies (always set): a session cookie for keeping you logged in, a CSRF token for form security, a small cookie that records your cookie-banner choice so we don't ask again on every visit, and, only when you choose a country version (United States or Ireland) in the flag menu, a cookie that remembers that choice for a year. We look up the country of your IP address in an offline database, without storing it, to suggest the right country version.

If we ever add analytics or marketing cookies in the future, we will update this section, present a consent banner, and load nothing non-essential until you opt in.

Partner shops: the partner-shop Marketplace currently runs on the Irish version of the platform only. If we add partner shops for the United States, we will update this section before they go live.

Service providers

The following third parties process personal information on our behalf in order to deliver the service. Each is bound by a data processing agreement and processes only what's needed for its specific function. None of them may use your information for their own purposes.

• Hostinger (EU): web hosting, MySQL database hosting, transactional email delivery (SMTP).
• Stripe (Ireland / global): payment processing for Verified subscriptions and listing promotions. Stripe is a separate controller for the payment information you provide directly to its checkout.
• Umami (Umami Software, Inc., USA): visit statistics without cookies (see Cookies).

If we add a new service provider that materially changes how your data is handled, we will update this list and give reasonable notice in advance.

Where your data is stored

The platform is hosted in the European Union (Hostinger). When you use the US version from the United States, the information you give us is sent to and stored in the EU, where the GDPR protects it. There are two exceptions. Stripe may process payment data in the United States and other countries as part of its global processing infrastructure; if you avoid the paid features (Verified subscription, listing promotions), Stripe is never engaged on your behalf. Umami, our visit statistics service, is a US company whose providers are in the USA and the EU; it receives only the page-view details described under Cookies.

Data retention

We keep personal information only as long as we need it for the purpose collected, or as required by law.

• Account data: kept while your account is active. After you close it, we delete profile, listings, images, and contact details within 7 business days; we may keep a minimal record (email + hashed password) for up to 24 months for fraud prevention.
• Payment & tax records: retained for at least 7 years to meet our tax law obligations.
• Verification documents: deleted from our server 7 days after they are sent for review; the copy emailed to our admin team stays in our admin mailbox.
• Support & contact-form messages: retained for up to 3 years so we can refer back to past correspondence.
• Job applications and resumes: deleted from our server automatically 6 months after the application was sent (Jobs).
• Course orders: unconfirmed orders deleted automatically after 30 days; paid orders kept as accounting records for 6 years (Courses).
• Sign-in IP address: the IP recorded at your last sign-in is erased automatically once 180 days have passed since that sign-in. The sign-in and last-used timestamps themselves are kept for the life of the account.
• Server logs: request logs (with sensitive query-string parameters redacted) are kept for up to 30 days for security and abuse-detection purposes, then rotated.

Your rights

Wherever you live, you have the following rights over your personal information. We respond to every request within one month; exercising any of them is free, and we won't treat you differently for using them.

• Access (right to know): get a copy of the personal information we hold about you. Logged-in suppliers can self-serve at /dashboard/account → "Download my data". Anyone else can request a copy via the contact form.
• Correction: ask us to correct inaccurate or incomplete information. Suppliers can edit their profile + listings directly from the dashboard.
• Deletion: ask us to delete your information. Logged-in suppliers can submit a deletion request at /dashboard/account → "Delete my account" (email confirmation + 7-business-day admin-action window). Subject to the retention obligations in section 10.
• Restriction: ask us to pause processing while we resolve a query about your data. Email us via the contact form.
• Portability: get your data in a structured, machine-readable format you can transfer to another service. The "Download my data" button on your account page returns a JSON export.
• Objection: object to processing based on our legitimate interests, including direct marketing. Email us via the contact form.
• Withdraw consent: where processing is based on consent (e.g. marketing emails), you can withdraw it at any time.

Every request is logged in our internal audit trail (date, type, status) so we can show that we answered on time. You'll see your own request history on your account page.

Security

We use reasonable technical and organizational measures to protect your data:

• HTTPS/TLS for all traffic to and from the platform
• Passwords stored only as bcrypt hashes, never in plain text
• Rate limiting and CSRF protection on authentication and form endpoints
• Regular software updates and dependency patching
• Server location in the EU (Hostinger), with backups that don't include card data
• Access controls limiting who on our team can see account-level data

No system is perfectly secure. If we discover a breach that is likely to put your information at risk, we will notify affected users without undue delay and notify the authorities the law requires us to tell, including the Irish Data Protection Commission within 72 hours and any US state authority under the breach-notification law of the state where you live.

Children

The platform is not directed at children. You must be 18 or older to create an account, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has registered an account, please contact us and we'll delete the account and any associated data promptly.

Changes to this policy

We may update this policy from time to time as the platform evolves or the law changes. The "last updated" date at the top of this page reflects the most recent revision. For material changes, for example adding a new service provider or expanding the categories of data we collect, we will give reasonable notice by email or in-account notification before they take effect.

Contact & complaints

To reach us about anything in this policy, to exercise a right, ask a question, or raise a concern, use the contact form or email info@foodtrailersmarketplace.com. We aim to respond within 5 business days and at the latest within 1 month.

If you are not satisfied with our response, you can lodge a complaint with the Irish Data Protection Commission (dataprotection.ie). If you live in California, you can also contact the California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General; residents of other states can contact their state attorney general.

Users in the United States

California residents (CCPA / CPRA). If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to:

• Know what personal information we collect, use and disclose about you, and get a copy of it
• Delete personal information we collected from you, subject to legal exceptions
• Correct inaccurate personal information
• Opt out of the sale or sharing of your personal information. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of; this has been true for the past 12 months
• Not be discriminated against for using any of these rights

In the past 12 months we collected the categories listed in section 3: identifiers (name, business name, email, IP address), commercial information (Verified and promotion payments), internet activity (pages viewed on our site), approximate location (state, county and city you enter, and the address of any truck or trailer you pin on the map), and professional information (your business registration document). We collect them from you and from your use of the site, for the purposes in section 4, and disclose them only to the service providers in section 8 and, where you choose, to other users (sections 5 and 6). We use your password only to sign you in.

How to make a request. Email info@foodtrailersmarketplace.com or use the contact form, from the email address on your account if you have one. We confirm your identity by matching that email address, and we may ask for one more detail if we cannot. You can use an authorized agent; we will ask the agent for your signed permission. We answer within 45 days at the latest.

Other states. If you live in another state with a consumer privacy law, you can make the same requests in the same way. If we decline a request, you can appeal by replying to our answer.

Marketing emails (CAN-SPAM). We send marketing emails only if you opt in. Every marketing email carries an unsubscribe link and our postal address, and we honor unsubscribe requests promptly. Account emails (confirmation, password reset, payment receipts, applications) are part of the service and are not marketing.

Age. The platform is for users who are 18 or older.