Privacy Policy

Squinted ("we", "us", or "our") is committed to protecting the privacy of our UK-based buyers and sellers. This policy sets out how we collect and manage your personal data in accordance with the UK GDPR.

1. The Controller

Squinted is the "data controller" for the personal information collected through our marketplace. This means we are responsible for deciding how we hold and use personal information about you.

Squinted Ltd, company number 16937508, registered office [REGISTERED OFFICE ADDRESS — TO BE CONFIRMED]. You can contact us at hello@squinted.co.uk for any data protection query.

2. Information We Collect

We collect and process personal data to facilitate the marketplace:

• Identity Data: Full name and username
• Contact Data: Email address, telephone number, and delivery/billing addresses.
• Financial Data: Bank account and payment card details (processed securely by Stripe — see Section 3 below).
• Transaction Data: Details about payments to and from you and products you have purchased or sold.
• Technical Data: IP address, login data, and browser type

3. Service Providers We Use

We use a small number of trusted third-party service providers to run Squinted. They process personal data on our behalf and under our instructions, and are contractually required to keep it secure and only use it for the purposes we specify:

• Stripe: Processes payments and payouts, and carries out fraud prevention checks. Stripe also acts as an independent controller in its own right for certain purposes, such as complying with its own anti-money laundering and financial regulatory obligations — see Stripe's own privacy policy for details.
• Sendcloud: Manages shipping labels, courier selection, and delivery tracking for orders.
• Ideal Postcode: Provides address lookup and validation at checkout and during seller onboarding.
• Resend: Sends transactional emails, such as order confirmations and account notifications.
• Supabase: Hosts our database and manages secure account authentication.
• Railway: Hosts our backend infrastructure.
• Formspree: Processes waitlist sign-ups submitted through our website ahead of the app launching.

We may add, change, or remove service providers as Squinted develops. Where this involves a material change to how your data is used, we'll update this policy accordingly.

4. Our Legal Basis for Processing

Under UK GDPR, we only use your data when the law allows us to. Most commonly:

• Performance of a Contract: To fulfill the buy/sell agreement between users.
• Legal Obligation: To comply with UK tax laws (HMRC), including our obligation as an online marketplace to report certain seller income to HMRC under the UK's digital platform reporting rules, and anti-money laundering regulations.
• Legitimate Interests: To prevent fraud and improve our marketplace security.
• Consent: Where you have opted-in to receive our marketing newsletters.

5. How Data is Shared Between Buyers & Sellers

To ensure orders are fulfilled, we facilitate the exchange of information:

• Seller to Buyer: Buyers will see the Seller's name.
• Buyer to Seller: Sellers are provided with the Buyer’s name and delivery address solely for the purpose of shipping the order.

Important: Under UK GDPR, Sellers are "independent controllers" of the Buyer data they receive and must not use it for marketing purposes without separate consent

6. Data Retentions

We retain your data for as long as necessary to provide our services and comply with legal obligations:

• Financial Records: We are required by UK law to keep transaction and tax data for 6 years plus the current tax year.
• Account Data: Kept as long as your account is active

7. Your Legal Rights

As a UK resident, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request that inaccurate personal data be corrected.
• Right to Erasure: Request that your personal data be deleted.
• Right to Restrict Processing: Request that we limit how we process your personal data.
• Right to Data Portability: Request a copy of your personal data in a structured, machine-readable format.
• Right to Complain: You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection (www.ico.org.uk).

8. International Transfers

Our database (Supabase) is hosted in the UK (London), and our backend infrastructure (Railway) is hosted in the EU (Amsterdam), so your data held with these providers stays within the UK/EEA.

Stripe, our payment provider, may process and store data outside the UK, including in the United States, as part of providing payment processing and fraud prevention services globally. Where this happens, Stripe ensures an equivalent level of protection through recognised safeguards, including the UK International Data Transfer Addendum and its participation in the UK Extension to the EU-U.S. Data Privacy Framework. You can read more in Stripe's own privacy policy.

If any other service provider we use changes where it stores or processes data, we will update this section accordingly.