Privacy Policy

Account and profile data

• Email address and password (your password is stored in hashed form by our authentication provider and is never visible to us).
• Username ("handle"), full name, phone number, and profile photo.
• Business details you choose to provide: company name, trade type, VAT-registration status.
• Postcode and default search radius, used to show you nearby listings.

Listing and transaction data

• Listings you create: title, description, category, condition, price, quantity, photographs, and an approximate collection location derived from your postcode (we deliberately show only an approximate, rounded location publicly, not your exact address).
• Orders, offers, and their status, prices, and platform fees.
• Messages you send to other users through the Platform.
• Reviews and ratings you leave or receive.
• Listings you favourite or have recently viewed.

Payment data

We never see or store your card details. Payments are collected and processed by Stripe, our payment processor. We store only payment metadata needed to run the marketplace: order amounts, our platform fee, the status of a payment, and Stripe's own reference identifiers (such as a payment or transfer ID). If you sell on the Platform, Stripe separately collects the information it needs to verify your identity and pay you (such as bank account details) as part of its own onboarding process — Skipless does not receive or store your bank account number.

Technical and usage data

• Login session information, so you can stay signed in.
• Basic usage information such as which listings you view (used to power "recently viewed" and view counts).
• Information described in our Cookies section below.

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

• Performance of a contract — to create and manage your account, operate listings, process orders and payments, hold funds pending collection, enable messaging between Buyers and Sellers, and provide customer support.
• Legitimate interests — to keep the Platform secure, prevent fraud, understand and improve how the Platform is used, show you relevant nearby listings, and enforce our Terms and Conditions. We consider our interests here to be balanced fairly against your rights.
• Legal obligation — to keep records required by tax, accounting, and anti-money-laundering law, and to respond to lawful requests from authorities.
• Consent — for optional cookies and any marketing communications, which you can withdraw at any time (see Sections 9 and 10).

We share personal data only where necessary to operate the Platform, and always under contracts that require these providers to protect your data. Our key processors are:

• Supabase — our database, authentication, and file storage provider, which stores your account, listing, and message data, and hosts uploaded photos.
• Stripe — our payment processor, which handles card payments, seller identity verification, and payouts.
• Mapbox — used to convert postcodes into an approximate location for search and display, and to power address autocomplete.
• Microsoft Azure — hosts our backend application (in the UK South region).
• Vercel — hosts our frontend website.

We also disclose limited profile information (your handle, company name, rating, and listing details) publicly on the Platform as part of its normal operation — for example, other users can see your handle and listings, but never your full name or exact address unless and until an order between you is paid for. We do not sell your personal data to third parties, and we do not use it for third-party advertising.

We may also disclose data where required by law, to enforce our Terms, to protect the rights, property, or safety of Skipless or our users, or in connection with a merger, acquisition, or sale of business assets.

Some of our service providers may process data outside the UK (for example, in the EU or the US). Where this happens, we rely on appropriate safeguards recognised under UK data protection law, such as the UK's International Data Transfer Agreement or Addendum, the EU-US Data Privacy Framework (UK extension), or Standard Contractual Clauses, to ensure your data continues to receive an equivalent level of protection.

We keep your account and transaction data for as long as your account is active, and for a reasonable period afterwards to meet our legal, accounting, and dispute-resolution obligations (generally up to 6 years after a transaction, in line with standard UK limitation periods for contract claims). If you delete your account, we will delete or anonymise personal data that we no longer need to keep for these purposes.

Under UK GDPR, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data in certain circumstances ("the right to be forgotten");
• restrict or object to our processing of your data in certain circumstances;
• data portability — receive your data in a structured, machine-readable format;
• withdraw consent at any time, where we rely on consent (this won't affect processing already carried out); and
• complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk, if you believe we have not handled your data properly.

Many of these settings — your profile details, handle, and account — can be updated directly from your account settings. For anything else, contact us at [privacy@skipless.co.uk] and we will respond within one month, as required by law.

The Platform is not intended for, and we do not knowingly collect data from, anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

We use industry-standard technical and organisational measures to protect your data, including encryption in transit, access controls, and reputable third-party infrastructure providers. Passwords are stored in hashed form and are never visible to Skipless staff. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We use a small number of browser storage items (technically similar to cookies, and covered by the same UK rules on cookies and similar technologies) to run the Platform. You can manage your preferences for the non-essential ones at any time using the cookie banner or the "Cookie preferences" link in the site footer.

Strictly necessary (cannot be switched off)

These are essential for the Platform to function and do not require consent:

Functional (optional — you can opt out)

These make your experience more convenient but the Platform works without them:

Analytics and marketing (optional)

We do not currently use any analytics or advertising cookies. If we introduce them in future (for example, to understand how the Platform is used so we can improve it), we will update this table, list them here individually, and ask for your consent again via the cookie banner before they are set.

Third-party cookies

When you pay for an order, you are briefly directed to a secure Stripe-hosted checkout page. Stripe may set its own cookies on that page, governed by Stripe's own privacy policy — Skipless does not control these.

We may update this Privacy Policy from time to time. Where changes are material, we will notify you (such as an in-app notice or an email) before they take effect.

If you have any questions about this policy or how we handle your data, contact us at [privacy@skipless.co.uk], or write to Skipless [Ltd], [registered office address]. You also have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk.