Privacy & data processing policy

This policy is maintained by MintedUK to explain how we collect, use and protect personal data when you use the MintedUK marketplace. We act as a data controller for the personal information you provide when you register, list, buy, sell or otherwise use MintedUK, in line with the UK GDPR and the Data Protection Act 2018.

1. What we collect

• Account details: username, email, password hash, avatar and bio.
• Identity details: your legal full name and UK postal address (line 1, optional line 2, town/city, postcode and country), which you can view and edit at any time in Settings → Name & address.
• Listings and messages you post, including images.
• Transaction details: orders, payouts, refunds and dispute correspondence.
• Where applicable, tax reporting details you provide to help us meet HMRC platform-reporting obligations.
• Technical data: IP address, device, browser, and interactions with the site.

We use your name and address to confirm your identity, prevent duplicate accounts and fraud, generate returns labels, and meet our legal and tax reporting duties. It is stored securely, is never shown on your public profile, and is only shared with the processors and authorities listed below where the law or your order requires it. You have the right to correct, export or delete this information — see section 5 below.

2. Why we use it (lawful bases)

• Contract — to operate your account, process orders, payouts and support requests.
• Legal obligation — to comply with UK tax, anti-fraud, consumer-protection and platform-reporting law.
• Legitimate interests — to keep the marketplace safe, prevent fraud and improve the service.
• Consent — for optional cookies and marketing emails, which you can withdraw at any time.

3. Sharing and processors

We share data with processors who help us run MintedUK under written contracts. We may share your seller reporting details with HMRC where required by the Platform Operators (Reporting) Regulations 2023. We never sell your personal data.

• Stripe Payments UK / Stripe Inc. — payments, payouts, saved card references and seller verification.
• Supabase (Lovable Cloud) — database, authentication, file storage and hosting of your account data.
• Vercel — website hosting and content delivery.
• ShipEngine, ShipStation / carriers (Royal Mail, Evri, InPost) — shipping labels, tracking and delivery addresses.
• XCover — optional shipping insurance where supported.
• Resend — transactional email such as order and delivery updates, and, where you have opted in, marketing email.
• Brevo — manages the marketing email subscriber list and audience segments for members who opt in to marketing email.
• QR Server — generates the QR code printed on a parcel label. It receives the parcel tracking number only.
• Ideal Postcodes and getAddress — UK postcode and address lookup when you enter an address.
• Cloudflare — Turnstile anti-bot checks at sign-up (processes your IP and device signals), and DNS lookups used to reject disposable email domains.
• Google Analytics 4 & Google Tag Manager — analytics, only after you accept optional cookies.
• Meta (Facebook) Pixel — measures which adverts lead to sign-ups and purchases. It loads only if you accept marketing cookies, and never before. Decline them, or withdraw consent from the cookie settings, and it is not loaded at all.
• Lovable AI Gateway (Google Gemini models) — powers MintedBot support replies and listing-detail suggestions.
• OpenAI — automated listing moderation: listing text is checked against OpenAI's moderation endpoint before publication.
• Firecrawl — reads your own shop pages on other marketplaces when you use the listing importer and expressly ask us to. See our importer policy.

4. Retention

We keep account data while your account is open and for up to 6 years after closure to comply with tax and consumer-law requirements. Marketing preferences are kept until you withdraw consent.

• Deleted on request — saved delivery address, saved card references, bio, avatar and marketing preferences.
• Deleted automatically — working copies of pages read by the listing importer are erased within 30 days, and sign-up attempt logs used for anti-abuse are erased on a rolling schedule.
• Retained by law, then reviewed — order, invoice, payout and tax records are kept for 6 years; fraud and moderation records are kept no longer than 2 years. These are maximum retention periods rather than automatic deletions: we review and remove records that are no longer needed.

5. Your rights

You can access, correct, delete or export your data, and object to or restrict processing. The quickest route is Dashboard → Profile settings → Privacy and your data, where you can download a copy of your data and delete saved addresses and card references yourself. You can also emailprivacy@minteduk.com and we will respond within one month. You have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

6. How we protect your data

All traffic is served over HTTPS with strict transport security. Your data sits behind row-level database security so accounts can only reach their own records, and sensitive fields — legal name, postal address, tax reference, National Insurance number and payment identifiers — are additionally locked at column level so no other signed-in user can read them. Full card details never touch MintedUK: they are entered on Stripe's hosted checkout and only a token is stored. Access to production data is limited to administrators and logged.

7. Automated decisions

We use automated checks to screen listings and messages for prohibited or counterfeit items and to rank the discovery feed. These can hide a listing or flag an account for review. No decision with a legal effect is made without a human review, and you can appeal any moderation outcome from the listing itself or by contacting us.

8. Children

MintedUK is not for under-18s. We do not knowingly collect data from children; if we learn we have, we delete it.

9. International transfers

Some processors are outside the UK. Where that is the case we rely on adequacy regulations or the UK International Data Transfer Addendum to keep your data protected.

10. Changes to this policy

If we make material changes we will update the date above and, where the change affects how we use your data, tell you in the app or by email before it takes effect.

11. Contact

Questions? Email privacy@minteduk.com or write to MintedUK LTD (Company No. 17339202), registered office: Suite A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom. We are registered with the UK Information Commissioner's Office as a data controller under registration number ZC227680.