Legal

Privacy Policy

Last updated: 4 July 2026

This policy explains what personal data Sellganise collects, why we collect it, how we use and protect it, and what your rights are under UK data protection law. We are committed to handling your data responsibly.

1. Who we are

Sellganise ("we", "us", "our") is operated by Sellganise, a company registered in England and Wales. We are the data controller for personal data collected through sellganise.com and our associated services.

We are registered with the Information Commissioner's Office (ICO). Our registration reference and registered office details are available on request.

For all data protection queries, contact us at: privacy@sellganise.com

2. Data we collect

We collect the following categories of personal data:

Account dataYour name and email address, collected when you register or sign in.

Inventory & sale dataItem names, prices, conditions, storage locations, notes, and sale records you create. This data belongs to you.

Billing dataSubscription status and a Stripe Customer ID. We never store your card number or CVV — payments are handled entirely by Stripe.

Technical dataIP address, browser type, device type, pages visited, referrer URL, and access timestamps.

Support communicationsRecords of any emails or messages you send us.

We do not collect any special-category personal data (health, ethnicity, biometrics, etc.).

3. How we use your data

We use your data only for the following purposes:

✓Provide, maintain, and improve the Sellganise service
✓Process subscription payments and send billing confirmations
✓Send essential service notifications (security alerts, planned maintenance)
✓Respond to support requests and enquiries
✓Detect and prevent fraud, abuse, or Terms of Service violations
✓Generate anonymised, aggregated analytics to improve the product
✓Comply with our legal and regulatory obligations

What we never do

We do not sell your personal data to third parties. We do not use your inventory or sale data for advertising. We do not share your data with data brokers.

4. Legal basis for processing (UK GDPR)

We rely on the following legal grounds under UK GDPR Article 6:

Contract (Art. 6(1)(b))

Processing necessary to provide the service — account management, storing your inventory, processing subscriptions.

Legitimate interests (Art. 6(1)(f))

Operating and securing the platform, sending product update announcements, preventing fraud. We have carried out a balancing test and these interests do not override your rights.

Legal obligation (Art. 6(1)(c))

Retaining billing records for HMRC tax purposes (6 years).

Consent (Art. 6(1)(a))

Optional marketing communications. You can withdraw consent at any time by clicking 'unsubscribe' or emailing us.

5. Data retention

Account & inventory dataRetained while your account is active; deleted within 30 days of account closure on request.

Billing records6 years from the end of the relevant tax year, as required by HMRC.

Support communications2 years from last contact.

Technical server logs90 days, then automatically purged.

You may request deletion of your account at any time via your account settings or by emailing privacy@sellganise.com. Billing records are retained for legal compliance and cannot be deleted early.

6. Third-party processors

We share data with the following processors, each bound by data processing agreements:

Stripe, Inc.Payment processing

Processes subscription payments. Stripe is PCI-DSS Level 1 certified. Data may be transferred to the United States under Standard Contractual Clauses. Stripe's privacy policy: stripe.com/gb/privacy

Vercel, Inc.Website hosting

Hosts the Sellganise web application. Vercel is GDPR-compliant and processes data within the EU/UK where possible.

Supabase, Inc.Database hosting

Stores your account, inventory, and sale data. Supabase is SOC 2 Type II certified.

We do not share your personal data with any other third parties. We will disclose data to law enforcement or regulatory bodies only when legally required to do so.

7. Your rights under UK GDPR

You have the following rights, which you can exercise free of charge. We will respond within one calendar month.

Right of accessRequest a copy of all personal data we hold about you.

Right to rectificationAsk us to correct inaccurate or incomplete personal data.

Right to erasureRequest deletion of your personal data, subject to legal obligations (e.g. billing records).

Right to restrictionAsk us to restrict processing of your data in certain circumstances.

Right to data portabilityReceive your data in a structured, machine-readable format (JSON or CSV).

Right to objectObject to processing based on legitimate interests, or to direct marketing at any time.

Right to withdraw consentWhere processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any right, email privacy@sellganise.com with "Data Rights Request" in the subject line. We may ask you to verify your identity before proceeding.

8. Cookies

We use only essential cookies required to operate the service. We do not use advertising or tracking cookies, and we do not share cookie data with third parties for marketing.

session / auth-tokenAuthentication — keeps you signed in. Duration: session.

sb-* (Supabase)Authentication state. Duration: up to 1 year.

stripe-midStripe fraud prevention. Duration: 1 year.

9. Security

We implement appropriate technical and organisational measures including:

HTTPS/TLS encryption for all data in transit
Encrypted database storage at rest
Role-based access controls — only essential personnel can access production data
Regular security dependency updates and vulnerability reviews

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO within 72 hours as required by UK GDPR Article 33.

10. Children's privacy

Sellganise is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 13. If you believe we have inadvertently collected data from a child, contact us at privacy@sellganise.com and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users of any material changes by email at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the most recent revision. Minor changes (e.g. clarifications) may be made without notice.

12. How to complain

If you are unhappy with how we handle your personal data, please contact us first at privacy@sellganise.com and we will do our best to resolve the issue.

You also have the right to lodge a complaint with the UK's data protection supervisory authority:

Information Commissioner's Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Telephone: 0303 123 1113

ico.org.uk