Privacy Policy

• Identity and contact details of the controller (registered company, ICO registration number, DPO contact if applicable).
• What personal data we collect, grouped by source: account signup, listings, messages, payments, identity verification, support contact, automatic technical data.
• Purpose and lawful basis for each processing activity (contract, legitimate interest, legal obligation, consent), per UK GDPR Article 6.
• Special-category data (we do not intentionally collect any) and our position if it appears in user-uploaded content.
• Recipients and sub-processors: Supabase (hosting + database). Any future additions (email, payments, analytics) listed here before they go live.
• International transfers: Supabase region, SCCs / UK IDTA where relevant, and the safeguards in place.
• Retention periods per data class, cross-referenced to the operational retention schedule.
• Your UK GDPR rights (access, rectification, erasure, restriction, portability, objection, withdraw consent, complain to the ICO) and how to exercise them.
• How we handle data when you delete your account, including the 30-day grace window and the items held under legal-obligation carve-outs (Art. 17(3)).
• DAC7 / UK Platform Operator Reporting: when we report seller information to HMRC and what is reported.
• Cookies and similar technologies, with a link to the Cookie Policy.
• How we notify you of material changes and how to view previous versions.

Until the formal policy is finalised, the following plain-English explainers describe what we actually do today:

• Your data & rights, how to download or delete your data.
• Selling & taxes, what we collect for HMRC reporting and why.
• Cookie Policy, what we set in your browser.