Privacy Policy

• Account: name, email, phone, password hash, addresses.
• Orders: items, totals, VAT, shipping & billing addresses.
• Payments: tokenised card metadata only (last 4 digits, brand). Full card data is handled by Stripe and never reaches our servers.
• Technical: IP address, device, browser, pages viewed, cookie identifiers.
• Marketing consent: whether you opted in, when, and via which channel.

• Contract — to fulfil your orders and provide the marketplace.
• Legal obligation — to keep VAT records (HMRC), to respond to law enforcement, and to operate our anti-fraud checks.
• Legitimate interests — securing our service, preventing fraud, and improving the site, balanced against your rights.
• Consent — for marketing emails and non-essential cookies, where you have opted in.

• The seller of the product you purchased (so they can fulfil and ship your order).
• Stripe (payments) and our shipping carriers.
• Cloudinary (uploaded images), Brevo / SMTP (transactional and marketing email), our hosting and analytics providers.
• HMRC and other public bodies where the law requires it.

We do not sell your personal data.

• Account data: while your account is active, then up to 6 years for tax records.
• Order & VAT records: 6 years (HMRC requirement).
• Marketing logs: until you withdraw consent, plus a short audit window.
• Support tickets: 2 years.

You have the right to:

• Access the data we hold about you.
• Correct anything that is inaccurate.
• Erase your data, subject to our legal retention duties.
• Restrict or object to certain processing.
• Receive a portable copy of data you provided.
• Withdraw consent at any time.

To exercise any of these, email [email protected]. You can also complain to the UK Information Commissioner's Office at ico.org.uk.