1. Introduction

Thrifter Club Ltd ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and mobile application (collectively, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

2. Information We Collect

2.1 Information You Provide to Us

When you create an account or use certain features of our Service, we may collect:

Account Information: Email address and name (if you choose to provide it)
Payment Information: If you subscribe to paid features, payment details are processed by our payment processor. We do not store your full payment card details
Communications: If you contact us, we may keep a record of that correspondence

2.2 Information Collected Automatically

When you use our Service, we automatically collect certain information, including:

Usage Data: Information about how you use our Service, including search queries, pages viewed, and features used
Device Information: Device type, operating system, browser type, and unique device identifiers
Location Information: Approximate geographic location derived from your IP address (we do not collect precise location)
Cookies and Similar Technologies: We use cookies and similar tracking technologies to track activity on our Service. See Section 7 for more details

2.3 Information from Third-Party Sources

We may receive information from third-party analytics services (Google Analytics and Hotjar) as described in Section 5.

3. How We Use Your Information

We use the information we collect for the following purposes:

To provide and maintain our Service: Including account management and access to features
To process transactions: For paid features and subscriptions
To improve our Service: Analysing usage patterns to enhance functionality and user experience
To communicate with you: Sending service-related announcements, updates, and marketing communications (if you have opted in)
To provide customer support: Responding to your inquiries and requests
To detect and prevent fraud: Protecting the security and integrity of our Service
To comply with legal obligations: As required by applicable laws and regulations

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, our legal basis for collecting and using your personal information depends on the data concerned and the context in which we collect it:

Contract: Processing is necessary to perform our contract with you (e.g., providing the Service)
Consent: You have given us explicit consent to process your information (e.g., for marketing communications or cookies)
Legitimate Interests: Processing is necessary for our legitimate interests (e.g., improving our Service, fraud prevention) and does not override your rights
Legal Obligation: Processing is necessary to comply with legal obligations

5. Third-Party Services

We use the following third-party services that may collect information about you:

5.1 Google Analytics

We use Google Analytics to analyse how users interact with our Service. Google Analytics collects information such as how often users visit our Service, what pages they visit, and what other sites they used prior to coming to our Service. Google Analytics uses cookies to collect this information.

For more information on Google Analytics' privacy practices, visit: https://policies.google.com/privacy

You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout

5.2 Hotjar

We use Hotjar to better understand our users' needs and optimise the Service. Hotjar collects information about your device, browser, and how you interact with our Service through cookies and similar technologies.

For more information on Hotjar's privacy practices, visit: https://www.hotjar.com/legal/policies/privacy/

You can opt out of Hotjar tracking by visiting: https://www.hotjar.com/policies/do-not-track/

5.3 Firebase and Google Cloud Platform

We use Firebase for hosting and Firestore for database storage, both provided by Google. Your account information and usage data may be stored on Google's servers. Google's data processing practices are governed by their privacy policy.

5.4 Silktide Cookie Consent

We use Silktide to manage cookie consent preferences. Silktide may collect information about your consent choices.

6. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

Service Providers: With third-party vendors who perform services on our behalf (e.g., hosting, analytics, payment processing). These providers are contractually obligated to protect your information
Legal Requirements: If required by law or in response to valid legal processes (e.g., court orders, subpoenas)
Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity
Protection of Rights: To protect our rights, property, or safety, or that of our users or others
With Your Consent: We may share your information with third parties when you have given us explicit consent to do so

Important: We do not share your personal information with the third-party marketplaces (eBay, Vinted, etc.) featured in our search results. When you click through to these marketplaces, you will be subject to their own privacy policies.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our Service and store certain information. Cookies are files with a small amount of data that are sent to your browser from a website and stored on your device.

7.1 Types of Cookies We Use

Essential Cookies: Necessary for the Service to function properly
Analytics Cookies: Help us understand how visitors interact with our Service (Google Analytics, Hotjar)
Preference Cookies: Remember your settings and preferences

7.2 Managing Cookies

You can manage your cookie preferences through our cookie consent banner provided by Silktide. You can also set your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some features of our Service.

8. Data Security

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit and at rest
Regular security assessments and updates
Access controls and authentication procedures
Secure hosting infrastructure (Google Cloud Platform and Firebase)

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

9. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Account Information: Retained until you request deletion or your account is inactive for an extended period
Usage Data: Typically retained for up to 26 months in analytics systems
Transaction Records: Retained as required by law for tax and accounting purposes

When we no longer need your information, we will securely delete or anonymise it.

10. Your Data Protection Rights

Depending on your location, you may have the following rights regarding your personal information:

10.1 Rights Under GDPR (EEA and UK)

Right to Access: Request a copy of the personal information we hold about you
Right to Rectification: Request correction of inaccurate or incomplete information
Right to Erasure: Request deletion of your personal information ("right to be forgotten")
Right to Restrict Processing: Request that we limit how we use your information
Right to Data Portability: Request a copy of your information in a structured, machine-readable format
Right to Object: Object to processing based on legitimate interests or for direct marketing
Right to Withdraw Consent: Withdraw your consent at any time where we rely on consent
Right to Lodge a Complaint: File a complaint with your local data protection authority

10.2 How to Exercise Your Rights

To exercise any of these rights, please contact us at hello@thrifter.club. We will respond to your request within one month, as required by law.

11. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside, including the United States where our cloud service providers (Google Cloud Platform, Firebase) maintain servers.

When we transfer personal data from the EEA or UK to other countries, we ensure appropriate safeguards are in place, such as:

Standard Contractual Clauses approved by the European Commission
Adequacy decisions by the European Commission or UK authorities
Certification schemes such as the EU-U.S. Data Privacy Framework (if applicable)

12. Children's Privacy

Our Service does not have an age restriction, and we do not knowingly collect personal information from children under 13 without parental consent. If you are under 18, you should have your parent or guardian's permission before providing any personal information to us.

If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information.

Parents or guardians who believe we may have collected information from their child should contact us immediately at hello@thrifter.club.

13. Third-Party Links

Our Service contains links to third-party websites and marketplaces (such as eBay, Vinted, Thrift+, and Oxfam). We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party sites you visit.

This Privacy Policy applies only to information collected by our Service.

14. Marketing Communications

If you have opted in to receive marketing communications from us, we may send you emails about our Service, special offers, or other information we think may interest you.

You can opt out of marketing communications at any time by:

Clicking the "unsubscribe" link in any marketing email
Updating your communication preferences in your account settings
Contacting us at hello@thrifter.club

Please note that even if you opt out of marketing communications, we may still send you service-related messages (such as account notifications or updates to our Terms or Privacy Policy).

15. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page and notify you of material changes by:

Posting a prominent notice on our Service
Sending you an email (if you have provided one)

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of the updated Privacy Policy.

16. Data Controller and Contact Information

For the purposes of GDPR and UK data protection law, the data controller is:

Thrifter Club Ltd
124 City Road
London, UK
EC1V 2NX
Company Number: 16811436
Email: hello@thrifter.club

If you have any questions about this Privacy Policy or our data practices, or if you wish to exercise your data protection rights, please contact us using the information above.

17. Supervisory Authority

If you are located in the EEA or UK and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority:

UK: Information Commissioner's Office (ICO) - https://ico.org.uk
EEA: Your local Data Protection Authority - Find your DPA