Privacy policy
What we collect, why, who sees it and how long we keep it.
Not legal advice. These documents are drafted for this marketplace and are specific enough to review, but they have not been reviewed by a lawyer and they are not tailored to the countries you will actually operate in. Have counsel read them, and the review brief that ships with the repo, before you take a payment.
What we collect
Account data: email, handle, display name, country and time zone.
Identity data for sellers: legal name, date of birth, residential address, and tax form type. Full government ID and tax identification numbers are collected by our verification and tax providers. We store only a reference and the last four characters.
Transaction data: orders, prices, fees, payouts and withdrawal history.
Communications: order chat messages, dispute submissions and support tickets.
Technical data: IP address, device and browser information, and security event logs.
Why we collect it
To run the marketplace: matching orders, holding escrow, paying sellers, resolving disputes. This is performance of our contract with you.
To meet legal obligations: identity verification, sanctions screening, tax reporting and fraud prevention.
To keep accounts secure and to detect payment fraud and chargeback abuse. This is our legitimate interest, and yours.
Card details and stored codes
We never see or store full card numbers. Payment details are collected by our payment processor's embedded elements inside your browser and exchanged directly with them.
Gift-card and top-up codes are encrypted before they reach our database, with a key held only by the application. A database dump does not yield a redeemable code. Only the last four characters are ever displayed, and every access is logged.
Who sees what
Buyers and sellers see each other's handle, public profile, ratings and the order chat. They never see each other's legal name, address, payout details or email.
We share data with our payment processor, payout provider, identity verification provider and tax provider, and with authorities where legally required.
We do not sell personal data, and we do not run advertising on the marketplace.
International transfers
Our providers operate in several countries. Where data leaves the region it was collected in, it is transferred under the safeguards that region's law requires.
Retention
Transaction and identity records are kept for as long as required by financial and tax law, typically seven years. Order chats are kept for two years after an order completes so disputes and chargebacks can be answered. Security logs are kept for twelve months.
Your rights
You can export your data or request deletion from account settings. Deletion requests are honoured except where we are legally required to retain records, in that case the account is closed and the remaining data is locked to compliance access only.
You can object to processing based on legitimate interest, and you can complain to your local data protection authority.