Privacy Policy

1. What we collect

• Account: email, password (hashed), username, display name, date of birth (18+ check), optional phone and gender.
• Profile: photo, bio, town/city (never shown publicly), shipping address.
• Marketplace: listings and photos, bids, offers, sales, messages, reviews, disputes (dispute photos are private: only the buyer, the seller and our team can see them), support requests (photos you attach are private: only you and our team can see them).
• Payments: handled by Stripe. We keep card brand, last 4 digits and Stripe’s payment references, never the full card.
• Sellers: Stripe collects identity and bank details for payouts. Sellers close to the DAC7 thresholds (30 sales or about €2,000 in a year) give us their legal name, date of birth, home address and tax number (UTR or National Insurance number); if they pass the thresholds we report these, their sales and our fees to HMRC.
• Security: IP address and a security cookie (gb_did), stored only as salted hashes, to stop fraud and repeat bans.
• Usage: what you do on GameBid (for example listings, bids, sales), recorded on our own servers. Search terms are stored without your account and with emails, phone numbers and postcodes removed.

2. Beta waitlist

When you join we collect your name and email, and the invite code you used, if any. We use them to manage your place, to decide by hand who gets in (no automated decisions), to track invites, and to email you about your place and once when GameBid launches. Lawful basis: steps you asked us to take before using GameBid, and our legitimate interest in running a fair, abuse-free beta. If you share your invite link, people who open it see your first name. We keep waitlist entries until 6 months after GameBid opens to everyone, or delete them within 30 days if you ask. Supabase stores this data in London.

3. Why we use it (lawful basis)

• Contract

  Your account, listings, buying and selling, payments and payouts, postage labels, messages, order support and service emails.

• Legal obligation

  Tax and accounting records (HMRC), DAC7 seller reporting to HMRC, and lawful requests from courts, police or regulators.

• Legitimate interests

  Fraud prevention and security (security cookie, hashed IP and device signals, bans).

  Analytics: first-party usage counts to run and improve GameBid. No third-party trackers.

  You can object to these at any time (see section 8).

• Consent

  Marketing emails and push notifications. Turn them off any time in settings.

4. Who we share it with

We do not sell your data. These providers process it for us under contract:

• Stripe

  Payments, seller payouts and identity checks. UK/EU and USA.

• Vercel

  Website hosting and cookieless speed measurements. USA (servers worldwide).

  Vercel processes IP addresses in short-lived hosting logs to deliver and secure the site.

• Supabase

  Database, logins and photo storage. Data stored in London (UK); support access from the USA.

• Resend

  Sending emails (receipts, alerts, account emails). USA.

• Royal Mail Click & Drop

  Postage labels: buyer name and delivery address, seller return address. UK.

• Cloudflare R2

  Encrypted database backups.

• Push services (Google, Apple, Mozilla)

  Delivering push notifications, only if you switch them on. A device token, no message history.

Other users see what the marketplace needs (for example your username, listings and reviews; your buyer sees your return address on a label). We share data with HMRC (tax and DAC7) and with police or courts when the law requires it.

5. International transfers

Some providers are in the USA. Where data leaves the UK we use a UK safeguard: the UK–US data bridge (UK Extension to the EU–US Data Privacy Framework) for certified providers, otherwise the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. Ask us for a copy.

6. How long we keep it

• Account and profile

  While your account is open. Cleared when you delete it.

• Sales, payments, disputes

  6 years for tax. After deletion they show "Deleted user" with no name or contact details.

• DAC7 tax details

  While your account is open, in a locked record only admins and the tax export can read. If you were reportable: 6 years after the year reported, even after account deletion, as the law requires. Otherwise deleted with your account.

• Security data

  Security cookie, hashed IP and device signals, fraud logs: 12 months, then deleted automatically. Kept longer only for a banned account.

• Usage data and search terms

  13 months, then deleted. Totals with no personal details are kept.

• Messages

  While either person in the chat keeps their account.

• Backups

  Encrypted, kept up to 12 months and put “beyond use”: never used for anything except disaster recovery. If we ever restore one, we re-apply every account deletion straight away.

7. Cookies and your device

• Login cookie (Supabase): keeps you signed in. Essential.
• Security cookie gb_did: a random ID that only our server reads, used to spot fraud and banned accounts when you sign in, bid or sell. Lasts 12 months.
• Your browser also remembers a few settings on your device (local storage): cookie notice dismissed, grid size, install and notification prompts dismissed, hidden sell tips. No ids, nothing sent to us.
• No analytics or advertising cookies, no tracking ids on your device and no device fingerprinting. Usage is counted on our servers.

8. Your rights

• Access and portability: download your data any time (Profile → Security → Download my data).
• Erasure: delete your account (Profile → Security). We keep only what the law requires (sales, DAC7 details).
• Correct, restrict or object to processing, and withdraw consent.
• Email calum@gamebid.co.uk. We reply within one month.

You can object at any time to our use of your data based on legitimate interests, such as security and fraud checks and site analytics. Email calum@gamebid.co.uk and we'll stop unless we have compelling grounds to continue.

Complaints

If you're unhappy with how we use your data, email calum@gamebid.co.uk and we'll acknowledge your complaint within 30 days. You can also complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113, but please contact us first so we can try to help.

9. Children

GameBid is for over-18s only. We check date of birth at sign-up and delete accounts made by under-18s.

10. Security

Encryption in transit, hashed passwords, optional two-factor sign-in, card data kept by Stripe, encrypted backups.

11. Changes

We will email registered users and show a notice on the site before material changes.