Privacy policy

The Gemstone Market is a private trade desk where jewelers and their clients ask for stones and dealers and cutters answer; our team approves each business before it can buy or sell. It is run by Bee Creek Holdings, LLC, Austin, Texas (“we”, “us”, “our team”).

This policy says what we collect, why, who sees it, and the choices you have. It covers gemstone.market and our phone app.

• Account details: your name and the name you prefer, email, phone, time zone, the business you work for (its legal and trade names), your role, your business’s phone, website and social profiles, and a referral code if you use one.
• Checks on your business, when we approve an account: tax and trade identifiers (such as an EIN, a JBT number, a resale or VAT number), business licenses and resale certificates, the documents you upload to prove them, and the names, emails and phones of trade references you give us.
• Where you are and where stones ship: your office address, a separate ship-to address and the name on the package if you give them, and a place you choose so clients can find a jeweler near them — stored with its address, its map reference and its precise map coordinates. A client looking for a jeweler gives an approximate location, kept rounded.
• What you ask for and offer: open calls (the stone, its size, color, clarity, budget, need-by date and what it is for, and anything you write in your own words), offers (price, terms, the stone’s record, treatment and lab details), counters, and the messages you send on the desk.
• Photos, videos and documents you upload, such as stone photos with their lighting, and lab reports.
• Deals and money records: accepted offers, closes, memos, shipments and tracking numbers, the platform fee, and payment records. We record amounts and status; we do not collect card or bank account numbers.
• What our team adds to an account’s file: other people at your business we deal with (their names, roles, emails and phones), and other addresses, with their map coordinates, and our notes.
• How you use the desk: when you sign in and the internet address (IP address) a sign-in request comes from, what you do on the desk (for example, sending an offer or approving an account), and the phone you register for notifications.
• When your mail app shows one of our emails, it may load our typefaces from gemstone.market. Our host sees that request the way it sees any page visit. We don’t use it to track whether you opened an email.

• To run the desk: to approve accounts, send open calls to the dealers who fit them, show offers, close deals, and keep the record both sides rely on.
• To tell you what happened: emails and phone notifications about your calls, offers, counters, closes and memos.
• To keep the desk safe and fair: to check who people are, to stop contact details being passed in messages to take a deal off the desk, to review messages our systems flag, and to investigate disputes and misuse.
• To run our business: to see each account’s activity and deals (how many calls, offers and stones, deal values and fees), to set fees and referral rates, to plan, and to keep accounts.
• To market to you: to email you about the desk, new features and events that may interest your business. We do not send marketing email today. Before we do, every one will carry an unsubscribe link, and you can also ask us at privacy@gemstone.market. Unsubscribing does not stop the emails about your own calls, offers and deals.
• To meet the law: tax, record keeping, and requests from authorities we are required to answer.

We do not sell your personal information, and we do not share it for other companies’ advertising.

• The other side of a deal sees only what the deal needs. A dealer never sees a jeweler’s budget. A dealer quoting on an open call sees the country the stone ships to, and the street address only once their offer is accepted and the close needs it. A dealer who does not win is told the jeweler chose another stone, and nothing about the winning offer.
• A client works through the jeweler they choose, and never sees a dealer’s price or which dealer offered the stone.
• Our team sees what it needs to run the desk, approve accounts, resolve problems and run the business, including account details and each account’s activity. Every export of account or deal records by our team is recorded: who made it, when, which view, and how many rows it held.
• Service providers who handle data on our behalf, only to provide their service (listed below).
• Advisers and authorities: our lawyers and accountants, and anyone the law requires us to tell, or where needed to protect people, property or the desk.
• A buyer of our business, if it is sold, under this policy.

These services receive data to do their job for us:

• Supabase: our database, sign-in and file storage, and, once we switch file backups on, a second copy of the files uploaded to the desk.
• Cloudflare (R2): a backup copy of every file uploaded to the desk (stone photos, lab reports, business documents and verification papers), kept so they can be restored if lost, once we switch file backups on.
• Vercel: hosting the website and its servers.
• Resend: sending our emails.
• Calendly: booking a product tour. The tour page on gemstone.market shows Calendly’s own booking form inside a frame, so Calendly receives your browser’s request, including the network address of your connection, and whatever you type into its form, such as your name, email and the time you pick, and it sets its own cookies. Our servers send Calendly nothing. Calendly’s own privacy policy covers what it does with that information, if you open the product tour page.
• Expo: delivering notifications to our phone app. When you allow notifications, the app registers your phone with Expo, which receives an identifier for the app’s installation on your phone, the phone’s notification address from Apple or Google, the app’s identifiers, and the app’s development push-service setting. To send a notification, our servers give Expo the phone’s notification address, a title, an opening line and an internal reference to the item it is about, and Expo passes these to Apple (Apple Push Notification service) on an iPhone or Google (Firebase Cloud Messaging) on Android, which deliver them to your phone. The title and opening line are taken from the subject and first line of the email we send about the same event (shortened if long), so they can include whatever those say: for example a stone, a price, a carrier and tracking number, a city, an account’s status, a business’s or a person’s name or email address, and, when a business declines to add you, the message that business wrote, if you use the app and allow notifications.
• Google (Places): finding an address or place you type. When a business sets up its account, what it types into the address search is sent from our servers to Google as it is typed, with a random reference that ties that search to the address picked, so Google can suggest full addresses; the one picked is looked up again to fill in its street, city, region, postcode and country, and we store that address, its map coordinates and Google’s reference for the place with the business. An address typed in by hand, and a suite or unit number, are not sent to Google. When our team reviews an account, we also send Google the saved place to check the business’s Google listing, when you look up your location, when a business enters its address while setting up, and when our team reviews an account.
• Sentry (Functional Software, Inc.): error reports from the website and the phone app so we can fix what breaks: errors only, with no session recording, screenshots or performance tracing; cookies, headers, request bodies, web-address queries and email addresses are removed before a report is sent, and so is a value a database error puts in parentheses after an equals sign (such as key=(value)); other words inside an error message can still appear in a report. When the app crashes or freezes below its own code (a native crash, or Android reporting the app not responding), the report is sent by the phone’s Sentry library without passing through those removals: it carries where it crashed, the phone’s model, system version and settings such as language and memory, the app’s version, and the app’s recent screens and actions, which were cleaned the same way when they were recorded, once we switch error reporting on.
• PostHog: understanding how the website is used, if and when we switch analytics on.

We keep account, deal, money and message records while your account is open and for at least one year after it closes, and longer when the law or a fair record of a deal requires it. Details our team keeps on a business’s file, such as other contacts, addresses and references, are deleted when they are wrong or no longer needed, which can be sooner. Sign-in link requests and some routine activity records are deleted a year after they are made, or sooner. A request held before you confirm your email is deleted after 24 hours unless you confirm it; once you do, it is kept with your account records. Counts that limit sign-in abuse, such as codes tried for an address, are kept in an unreadable form for up to 31 days. When we no longer need something, we delete it or keep it only in a form that no longer identifies you.

Data travels encrypted, only our team can see every account, and every export of account or deal records is recorded. No system is perfectly secure; if something goes wrong that affects you, we will tell you as the law requires.

• See, correct or delete: you can ask for a copy of your personal information, ask us to correct it, or ask us to delete it. Some records must stay because the law or a deal requires them; we will say which.
• Marketing: we do not send marketing email today; if we do, you can stop it with the unsubscribe link in the email or by asking us at privacy@gemstone.market.
• Notifications: turn phone notifications off in your phone’s settings, and sign a phone out from your account page.
• Depending on where you live (for example Texas, California or the European Union), you may have further rights, such as appealing a decision about your request or complaining to a regulator. We will not treat you differently for using them.
• To use any of these, write to privacy@gemstone.market. We may need to confirm it is you first.

We use the cookies that keep you signed in and the desk working. The product tour page also loads Calendly’s booking form, which sets its own cookies. If we switch analytics on, PostHog will also keep an identifier in a cookie and in your browser’s storage (if your browser does not allow that, it keeps nothing) so it can count the pages you visit and the things you click. It is not told who you are. A click is recorded only as a click on a page, with nothing about what was clicked: the words on the page, the page’s title, any text on or around what you click, and where a link goes are not sent. The address of a page, including any ids in its path, is sent without anything after a “?” or “#”. It does not record your screen. Your browser sends these events to PostHog directly, so PostHog receives the network address of your connection: we keep it out of the events and ask PostHog not to work out where you are, and PostHog itself discards the address once its “Discard client IP data” setting is on. Our servers also tell PostHog when a step of a deal happens, such as an offer sent or a deal closed, under an internal account number, with ids and a few labels and counts such as the currency code; the code that sends them passes no name, email address, price or message.

The desk is for adults in the trade and their clients. It is not for anyone under 18, and we do not knowingly collect their information.

Our database, sign-in and file storage are in the United States, and so are the main servers that run the desk. On the way there, your requests pass through our hosting provider’s servers around the world, and some of our other service providers (listed above) run on networks around the world. If you use the desk from outside the United States, your information is transferred to the United States, and may be handled in other countries where those providers operate.

If we change this policy, we will post the new version here with its date. If the change is material, we will tell members by email before it takes effect.

Bee Creek Holdings, LLC, Austin, Texas. Email: privacy@gemstone.market.