Privacy Policy

1. What we collect

We do not see or store your full payment card number. Stripe handles it.

• Account details: your email address and password (stored securely, never in plain text), and your username.
• Order and delivery details: your name, delivery address, what you bought or sold, prices, postage, tracking numbers, and messages in order problems.
• Seller details: shop name, whether you sell as an individual or a business, business details you provide, and the identity and bank information collected by Stripe, which Stripe holds under its own privacy policy.
• Listings and photos you upload, want lists, and reviews.
• Technical information: your IP address and device and browser details, used to keep the service secure and to prevent fraud.
• Records of when you accepted our terms.

2. Why we use it and on what basis

We do not sell your personal information and we do not currently send marketing emails.

• To provide CardSouk, including creating your account, processing orders, sharing delivery details with sellers and paying sellers. This is necessary to perform our contract with you.
• To send you emails about your orders, payments and problems. This is necessary to perform our contract with you.
• To prevent fraud and keep CardSouk safe, to resolve problems between buyers and sellers, and to improve the service. This is our legitimate interest.
• To meet legal obligations, such as accounting, tax and platform reporting to HMRC, and responding to lawful requests. This is a legal obligation.

3. Who we share it with

Some of these providers are based outside the UK, including in the United States. Where your information is transferred there, we rely on UK-approved safeguards such as the UK data bridge or standard contractual clauses.

• Sellers receive the delivery name and address and order details for orders you place with them, so they can post your order. Buyers see a seller's shop name, not their personal details.
• Stripe processes payments and seller payouts, and carries out identity checks on sellers.
• Supabase hosts our database and file storage, Vercel hosts our website, and Resend sends our emails. They act on our instructions.
• Authorities and advisers, where the law requires it or we need to protect our rights.

4. How long we keep it

• Order, payment and tax records: 6 years, as the law requires.
• Account details: while your account is open. If you close your account we delete or anonymise what we no longer need, except records we must keep.
• Problem conversations: for as long as needed to deal with the problem and any claim arising from it, and generally no longer than 6 years.

5. Cookies and similar technologies

CardSouk currently uses only essential browser storage: to keep you signed in and to remember an order that is in progress. We don't use advertising or analytics cookies. If that changes we will ask for your consent first and update this policy.

6. Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to some uses of it, and to receive it in a portable format. You can also object where we rely on legitimate interests. Contact info@cardsouk.uk and we will respond within one month. Some information we must keep by law, so we may not be able to delete everything.

If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first.

7. Security and changes

We use industry-standard protections including encryption in transit, access controls and row-level security on our database. No system is perfectly secure, and we will tell you and the ICO about a breach where the law requires it.

We may update this policy and will tell you about material changes. The date at the top shows when it was last changed.