Privacy Policy
Last updated: 4 October 2026 (draft)
This policy explains what personal data RigYard collects, why, how long we keep it, who we share it with, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
The data controller is [COMPANY NAME] (company number [COMPANY NUMBER]), [REGISTERED ADDRESS]. We're registered with the Information Commissioner's Office (ICO), registration number [ICO REGISTRATION NUMBER]. For anything about your data, email privacy@rigyard.example.
2. What we collect
- Account details: your name, email address, password (stored only as a secure hash), username, and whether you sell as a private individual or a business (plus trading name, address and company/VAT numbers for businesses).
- Contact and verification: your phone number if you choose to verify it, and verification codes.
- Location: the postcode you give us. We show only your town or area publicly, and an approximate map area that is deliberately offset from your postcode.
- Listings: descriptions, specifications, prices, photos and an optional private serial number. We remove location data (EXIF/GPS) from every photo before storing it.
- Messages and offers you send other members, including photos.
- Reviews you write and receive, and reports you make or that are made about you.
- Payments: what you paid for, when, and receipts. Card details are handled entirely by Stripe; we never see or store them.
- Technical data: IP address, browser type, and security logs (for example sign-in attempts), plus a record of which listings you've saved and your saved searches.
- Analytics, only if you agree to analytics cookies (see our Cookie Policy).
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Running your account, publishing listings, messaging, reviews, taking listing fees | Contract |
| Keeping the site safe: spam and fraud prevention, rate limits, scam-phrase warnings in chat, automatic checks on listings (for example duplicate photos), moderating reports | Legitimate interests (protecting members and the marketplace) |
| Service emails (verification, receipts, messages, alerts you've asked for) | Contract; you can turn off non-essential emails at any time |
| Keeping payment and tax records; responding to lawful requests from authorities; meeting our duties under the Online Safety Act 2023 | Legal obligation |
| Analytics cookies | Consent (you can withdraw it at any time) |
Automated checks: we use automated tools to flag listings and messages that may be scams. These don't make final decisions about you on their own. A flagged listing may be held until a person reviews it, and you can always appeal a decision.
4. Who we share it with
We don't sell your data. We share it only with:
- Other members, as needed to use the marketplace: your public profile (name, town, badges, reviews), your listings, and messages you send them. Your phone number is shown only if you choose to show it, and only to signed-in, verified members.
- Service providers who process data for us under contract: hosting [HOSTING PROVIDER, e.g. Vercel]; database [DATABASE PROVIDER]; file storage (Cloudflare R2); email (Resend); payments (Stripe); bot protection (Cloudflare Turnstile); postcode lookup (postcodes.io, which receives only the postcode); error monitoring (Sentry, if enabled); real-time messaging signals (Pusher, if enabled, which never receives message content); and analytics (if you consent).
- Map tiles: if you choose "Show approximate area" on a listing, your browser loads map images from OpenStreetMap, which will see your IP address.
- Authorities, such as the police or HMRC, where the law requires it or to prevent fraud or harm.
- A buyer of our business, if RigYard is ever sold, under the same protections.
Some providers process data outside the UK (for example in the EU or US). Where they do, we rely on UK adequacy regulations or the ICO's International Data Transfer Agreement / Addendum to protect it.
5. How long we keep it
| Data | Kept for |
|---|---|
| Account and listings | While your account is open. When you delete it, we remove or anonymise your personal details within 30 days. |
| Messages | Kept so the other member still has the conversation. When you delete your account, your name and profile are removed from your messages. Reported conversations are kept while we investigate. |
| Payment records and receipts | 6 years after the end of the financial year (HMRC requirement) |
| Reports, moderation decisions and audit logs | [2 YEARS] after the decision, or longer if needed for a legal claim |
| Security logs and email delivery logs | Up to 30 days |
| Photos you delete | Removed from storage straight away; backups expire within [30 DAYS] |
6. Your rights
You have the right to:
- access your data. You can download most of it yourself from Settings → Your data;
- correct inaccurate data (most of it you can edit yourself);
- erase your data. Delete your account from Settings → Account;
- restrict or object to processing based on legitimate interests;
- data portability (your download is machine-readable JSON);
- withdraw consent at any time, for example from Cookie preferences in the site footer.
Email privacy@rigyard.example to use any of these rights. We'll reply within one month. If you're not happy with how we handle your data, you can complain to the ICO at ico.org.uk or on 0303 123 1113.
7. Security
We protect your data with encryption in transit, hashed passwords, optional two-factor authentication, access controls for staff, and logging of staff actions. No system is perfectly secure; tell us at safety@rigyard.example if you spot a problem.
8. Children
RigYard is for adults (18+). We don't knowingly collect data from children.
9. Changes
We'll post any changes here and tell you about significant ones by email.