Privacy policy
Our full privacy policy is being drafted with legal advice and will be published before retale opens to the public. What’s below describes what we actually do today.
retale is operated by Retale Marketplace Limited, a company registered in England and Wales, which is the data controller for the personal data described below.
What we collect
Your email address, username, and password (stored encrypted — we can never see it). Your postal address, if you choose to save one: it’s used to work out real delivery prices, to send books to you, and — if you sell with tracked delivery — as the collection address on the shipping label. The general area you choose to show publicly on pickup listings, which is separate from your full address and is the only part other users see before a sale. If you sell, the bank and identity details you give our payments provider, Stripe.
Who else sees your data
We use a small number of providers to run retale, and they only ever receive what they need to do their job: Stripe (payments and seller payouts), Sendcloud (buys shipping labels — receives the delivery name and address for tracked orders), Cloudflare (stores listing photos), Railway and Vercel (host the site and database). We don’t sell your data to anyone, ever.
Why we’re allowed to hold it
Most of what we hold is needed to provide the service you’ve asked for — we can’t deliver a book without an address, or pay a seller without payment details. Some of it we keep because the law requires it, particularly transaction records for tax purposes.
How long we keep it
Your account details stay until you delete your account. Delivery addresses are kept while your account is open and removed when you close it. Records of completed transactions are kept for six years in anonymised form, because UK tax law requires it — these no longer identify you personally.
What we don’t do
We don’t sell your data. Photos you upload have their location data stripped automatically before they’re stored, so a listing photo can never reveal where you live.
Your rights
You can download everything we hold about you, or delete your account, from your profile at any time. Deleting your account removes your personal details, including any saved address; we keep anonymised records of completed transactions where the law requires it. You can’t delete an account while an order is still in progress or money is still in your wallet — finish or cancel those first, so nobody is left stranded mid-sale.
You also have the right to ask us to correct anything that’s wrong, to object to how we use your data, and to complain to the Information Commissioner’s Office (ico.org.uk) if you think we’ve got it wrong. We’d rather you told us first so we can put it right.