Privacy & data processing policy

This policy is maintained by Not Another Marketplace to explain how we collect, use and protect personal data when you use the Not Another Marketplace marketplace. We act as a data controller for the personal information you provide when you register, list, buy, sell or otherwise use Not Another Marketplace, in line with the UK GDPR and the Data Protection Act 2018.

1. What we collect

• Account details: username, email, password hash, avatar and bio.
• Identity details: your legal full name and UK postal address (line 1, optional line 2, town/city, postcode and country), which you can view and edit at any time in Settings → Name & address.
• Listings and messages you post, including images.
• Transaction details: orders, payouts, refunds and dispute correspondence.
• Where applicable, tax reporting details you provide to help us meet HMRC platform-reporting obligations.
• Technical data: IP address, device, browser, and interactions with the site.

We use your name and address to confirm your identity, prevent duplicate accounts and fraud, generate returns labels, and meet our legal and tax reporting duties. It is stored securely, is never shown on your public profile, and is only shared with the processors and authorities listed below where the law or your order requires it. You have the right to correct, export or delete this information — see section 5 below.

2. Why we use it (lawful bases)

• Contract — to operate your account, process orders, payouts and support requests.
• Legal obligation — to comply with UK tax, anti-fraud, consumer-protection and platform-reporting law.
• Legitimate interests — to keep the marketplace safe, prevent fraud and improve the service.
• Consent — for optional cookies and marketing emails, which you can withdraw at any time.

3. Sharing and processors

We share data with processors who help us run Not Another Marketplace under written contracts. We may share your seller reporting details with HMRC where required by the Platform Operators (Reporting) Regulations 2023. We never sell your personal data.

• Stripe Payments UK / Stripe Inc. — payments, payouts, saved card references and seller verification.
• Supabase — database, authentication, file storage and hosting of your account data.
• Vercel — website hosting and content delivery.
• ShipEngine, ShipStation / carriers (Royal Mail, Evri, InPost, DPD, Parcelforce) — delivery prices at checkout, shipping labels, tracking and delivery addresses.
• XCover — shipment protection, bought through our shipping provider only when an item's value is more than the carrier's included compensation and cover is available. It receives the shipment details needed to issue cover and handle a claim.
• Sentry — error monitoring for the website and our servers. It receives technical error details and reference numbers (such as an order or shipment id); credentials and personal details such as names, email and postal addresses are removed before anything is sent, and session replays mask all text and media. Session replays are recorded only after you accept analytics cookies.
• Resend — transactional email such as order and delivery updates, and, where you have opted in, marketing email.
• Browser push services (Google Firebase Cloud Messaging, Apple Push Notification service, Mozilla Push Service, Microsoft Windows Push Notification Services) — deliver the alerts you choose to your phone or computer, only after you turn alerts on for that device. The service your browser uses receives your device's push address and each alert, encrypted end to end so it cannot read the alert. Message alerts never include what was written. Turn alerts off, or sign out, and your device's push address is deleted.
• Brevo — manages the marketing email subscriber list and audience segments for members who opt in to marketing email.
• QR Server — generates the QR code printed on a parcel label. It receives the parcel tracking number only.
• Ideal Postcodes and getAddress — optional UK postcode-to-address lookup. Switched off by default (you type your address yourself); when enabled, only the postcode you enter is sent.
• Cloudflare — Turnstile anti-bot checks at sign-up (processes your IP and device signals), and DNS lookups used to reject disposable email domains.
• Google Fonts — serves the website's typefaces. Your browser requests them from Google when a page loads, which shares your IP address and browser details with Google; no cookies are set.
• Google Analytics 4 & Google Tag Manager — analytics, only after you accept optional cookies.
• Meta (Facebook) Pixel — measures which adverts lead to sign-ups and purchases. It loads only if you accept marketing cookies, and never before. Decline them, or withdraw consent from the cookie settings, and it is not loaded at all.
• OpenAI — automated listing moderation (listing text and photos are checked before publication), Not Another Bot support replies and listing-detail suggestions.
• Firecrawl — reads your own shop pages on other marketplaces when you use the listing importer and expressly ask us to. See our importer policy.

4. Retention

We keep account data while your account is open and for up to 6 years after closure to comply with tax and consumer-law requirements. Marketing preferences are kept until you withdraw consent.

• Deleted on request — saved delivery address, saved card references, bio, avatar and marketing preferences.
• Deleted automatically — working copies of pages read by the listing importer are erased within 30 days, and sign-up attempt logs used for anti-abuse are erased on a rolling schedule.
• Retained by law, then reviewed — order, invoice, payout and tax records are kept for 6 years; fraud and moderation records are kept no longer than 2 years. These are maximum retention periods rather than automatic deletions: we review and remove records that are no longer needed.

5. Your rights

You can access, correct, delete or export your data, and object to or restrict processing. The quickest route is Dashboard → Profile settings → Privacy and your data, where you can download a copy of your data and delete saved addresses and card references yourself. You can also emailprivacy@mintedukmarketplace.com and we will respond within one month. You have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

6. How we protect your data

All traffic is served over HTTPS with strict transport security. Your data sits behind row-level database security so accounts can only reach their own records, and sensitive fields — legal name, postal address, tax reference, National Insurance number and payment identifiers — are additionally locked at column level so no other signed-in user can read them. Full card details never touch Not Another Marketplace: they are entered on Stripe's hosted checkout and only a token is stored. Access to production data is limited to administrators and logged.

7. Automated decisions

We use automated checks to screen listings and messages for prohibited or counterfeit items and to rank the discovery feed. These can hide a listing or flag an account for review. No decision with a legal effect is made without a human review, and you can appeal any moderation outcome from the listing itself or by contacting us.

8. Children

Not Another Marketplace is not for under-18s. We do not knowingly collect data from children; if we learn we have, we delete it.

9. International transfers

Some processors are outside the UK. Where that is the case we rely on adequacy regulations or the UK International Data Transfer Addendum to keep your data protected.

10. Changes to this policy

If we make material changes we will update the date above and, where the change affects how we use your data, tell you in the app or by email before it takes effect.

11. Contact

Questions? Email privacy@mintedukmarketplace.com or write to MintedUK LTD (Company No. 17339202), registered office: Suite A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom. We are registered with the UK Information Commissioner's Office as a data controller under registration number ZC227680.