Privacy Policy
Misellit UK ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our mobile application and services.
1. Information We Collect
Personal Information
- Name and email address (required for account creation)
- Profile photo (optional)
- Phone number (optional, for notifications)
- Delivery address (for purchases)
Transaction Data
- Purchase and sales history
- Payment transaction records
- Shipping and tracking information
- Dispute and resolution records
Communications
- Messages between buyers and sellers
- Customer support correspondence
- Offers and negotiations
Technical Data
- Device type and operating system
- IP address and approximate location
- App usage patterns and session data
- Push notification tokens
2. How We Use Your Information
We use your information for the following purposes:
- Account Management: Create, authenticate, and manage your account
- Transactions: Facilitate buying, selling, and payment processing
- Buyer & seller protection: Hold payments in escrow and process disputes
- Communication: Enable messaging between users and send notifications
- Security: Detect fraud, prevent abuse, and protect user accounts
- Support: Respond to enquiries and resolve issues
- Legal Compliance: Meet regulatory and legal obligations
- Improvements: Analyse usage to enhance app features and performance
3. Legal Basis for Processing
We process your data based on: (a) your consent when you create an account, (b) contractual necessity to provide our services, (c) legitimate business interests for security and improvement, and (d) legal obligations under UK and EU law.
4. Third-Party Services
We use trusted third-party services to operate our platform:
- Stripe: Payment processing and seller payouts
- Supabase: Database and authentication services
- Shipping partners: Tracking shipment delivery status
- Resend: Transactional email delivery
- Anthropic: AI writing and rule checks for Misellit Sites; shop descriptions and wording, listing titles and categories; processing in the USA. Listing photos are not sent to Anthropic, and Anthropic does not use this shop text to train its AI models.
- Cloudflare: Own-domain connection and HTTPS security; domain names and visitors’ IP addresses and browser details on seller domains; processing globally, including the USA.
- Google Fonts: Shop font styles; visitors’ IP addresses and browser details; processing in the USA.
- Stripe: Misellit Sites publish fees and own-domain subscriptions; name, email, payment details and subscription status; processing in the UK, EU and USA.
Each provider has their own privacy policy governing data they process on our behalf.
5. Data Sharing
We share limited data only when necessary:
- Between Users: Buyer name and delivery address shared with sellers for shipping
- Payment Providers: Transaction details for payment processing
- Service Providers: Stripe, shipping partners, Resend, Algolia, Supabase, Firebase, Google AdMob (non-personalised ads), Google sign-in, Anthropic and Cloudflare — see "Service Providers We Use" below
- Legal Authorities: When required by law or court order
We never sell your personal data to third parties.
6. Data Retention
We retain your data for as long as your account is active plus 6 years for financial records as required by UK law. You can request account deletion at any time, after which personal data will be removed within 30 days, except where legal retention is required.
For fraud prevention and account security we record the IP address used when you create your account and when you sign in. This is used to detect and investigate abuse, such as banned users attempting to re-register, brand impersonation, and suspicious account activity. These records are visible only to our internal security and moderation team, are never shown to other users, and are automatically deleted after 12 months. Because IP records are internal security data used to protect the community, they are not included in "Download my data" exports; you may contact us to enquire about this data.
Wholesale business verification
If you sell in Wholesalers as a business, we collect your business name, UK company number and, if you give it, your VAT number. We send the company number to Companies House, the UK government's company register, to check it matches an active company. We store the registered name and company status it returns, check again monthly, and use this only to decide and display your seller badge. Company and VAT numbers are not shown publicly. The legal basis is our legitimate interest in keeping the Wholesalers section trustworthy. We keep this information while you sell in Wholesalers and delete it with your account.
Misellit Sites (shop websites)
We use your shop description, wording and design, listing titles, categories and photos, your profile photo when selected as a logo, your own domain and connection status, and payment or subscription records to build, display and operate your shop, check content against our rules, take payment and send service emails.
We process this information to perform our contract with you and, for safety checks, for our legitimate interest in protecting users and enforcing marketplace rules. Once published, your shop is public and may be shown or stored by search engines and social media.
We keep the shop and version history while the shop exists and delete them within 30 days after deletion. Payment records are kept for six years for tax and accounting. Transfers outside the UK use safeguards recognised by UK law, including the UK International Data Transfer Agreement or the UK–US Data Bridge where a provider is certified.
If you connect Misellit to Claude
If you choose to connect your account to Claude, we share the information Claude needs to build your site, at your request: your shop name, your active listings (titles, categories, prices, sizes, condition and photos) and your site design settings. We do not share buyer details, order information, payment details or your contact details.
Anthropic receives this information through your own Claude account and handles it under its own privacy policy. For information you share this way, Anthropic acts as a separate controller.
We keep a record of each connection and each action Claude takes on your account (which action, when, and whether it succeeded) to keep your account secure and prevent misuse. We keep these records for 12 months. Our legal basis is performing our contract with you, and our legitimate interest in security.
You can disconnect Claude at any time in Settings → Connected apps. Access stops immediately.
Sign in with Misellit and connected apps
Some third-party apps let you sign in with your Misellit account. We only share information with an app if you agree on the Misellit consent screen, and only the information shown there. This can include your Misellit account ID, name, username, profile picture, and your email address and whether it has been verified.
Each app is run by its own developer, who is an independent controller of the information under UK GDPR. The app uses your information under its own privacy policy, which is linked on the consent screen. Misellit does not sell your data to these apps.
You can disconnect an app at any time in Settings → Connected apps. When you do, we cancel the app's access and refresh tokens straight away, so it can no longer get information from Misellit. Information the app already received is handled under its own privacy policy, and the app must delete what it no longer needs.
7. Data Security
We implement robust security measures including:
- Encryption of data in transit (TLS/SSL) and at rest
- Row-level security policies on all database tables
- Secure authentication with password hashing
- Regular security audits and monitoring
- Escrow payment protection preventing unauthorised fund access
8. Your Rights
Under UK GDPR and the Data Protection Act 2018, you have the right to:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate or incomplete data
- Erasure: Request deletion of your data ("right to be forgotten")
- Portability: Receive your data in a machine-readable format
- Restriction: Limit how we process your data
- Objection: Object to processing based on legitimate interests
- Withdraw Consent: Revoke consent at any time
To exercise your rights, contact us via the Contact page or email below.
9. Children's Privacy
Our app is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with data, please contact us immediately and we will delete it.
10. International Data Transfers
Your data may be processed by service providers located outside the UK. Where transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses or adequacy decisions.
11. App Permissions
Our mobile app may request the following permissions:
- Camera: To photograph items for listings
- Photo Library: To upload existing images
- Notifications: To send order and message alerts
- Internet: Required for app functionality
All permissions are optional and can be managed in your device settings.
Advertising
We show banner ads through Google AdMob. Ads are non-personalised, meaning they aren't based on your activity in other apps or websites. Google may still collect device identifiers and usage data to serve ads, measure performance and prevent fraud. In the UK and EEA, Google's consent form is shown before ads appear, and you can reopen it any time from Settings → "Privacy & ad choices". See Google's privacy policy.
Service Providers We Use
We share personal data with these providers only as needed to run Misellit:
- Stripe — payments, payouts and fraud prevention
- Shipping partners — shipping labels and parcel tracking
- Resend — sending account and order emails
- Algolia — listing search
- Supabase — database, sign-in and file storage hosting
- Firebase (Google) — push notifications in the mobile app
- Google AdMob — non-personalised banner ads in the iOS/Android app
- Google — Google sign-in (OAuth)
- Anthropic (Claude) — automated compliance scanning of listings and dispute review support
- Cloudflare — content delivery, image hosting and security
Third-party apps you choose to connect using Sign in with Misellit are not Misellit service providers or sub-processors. They are independent controllers of the information you agree to share with them.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Significant changes will be notified via email or in-app notification. Continued use of the app after changes constitutes acceptance of the updated policy.
13. Contact Us
For privacy-related enquiries or to exercise your rights: