privacy policy

Kaparay is the data controller for personal data processed on kaparay.com. Contact: enquiries@kaparay.com. Full company and registration details will appear here before launch.

• Account: name, email address and password (stored hashed, never readable by us)
• Addresses: delivery and dispatch addresses for orders and labels
• Listings and content: the listings, photos, reviews and messages you create. Receipts uploaded for Verified Source checks are stored privately
• Orders: what you bought or sold, amounts, refunds and the delivery tracking trail. Card details go directly to Stripe; we never see them
• Seller identity: date of birth, identity verification through Stripe, bank account for payouts, and tax identifiers where the law requires them (section 5)
• Usage: device and usage data for security always; analytics only after you consent (section 9)

To run the marketplace (legal basis: contract): accounts, listings, orders, payments, delivery, messages, returns, disputes and reviews.

To meet legal obligations: financial record-keeping, tax and platform reporting to HMRC (section 5), fraud prevention and consumer protection law.

With your consent, separately and never pre-ticked: analytics cookies and marketing emails. Withdraw marketing consent at any time from any email footer. Analytics arrives at launch and will ask for your consent before it starts (section 9).

Legitimate interests, narrowly: keeping the platform secure, preventing abuse and improving the product with aggregate, de-identified data.

These providers run parts of the platform on our behalf, under data processing agreements, and may only use your data on our instructions:

• Supabase: Database, authentication and file storage (EU hosting)
• Stripe: Payments, payouts and seller identity verification
• Resend: Transactional email (order confirmations, shipping updates)
• Netlify: Website hosting and content delivery
• PostHog (EU): Product analytics, EU-hosted: arrives at launch and runs only with your consent
• Sentry: Error monitoring, so we find faults before you report them
• Cloudflare: Bot protection on sign-up and sign-in forms (Turnstile)

Beyond processors: delivery carriers receive the name and address needed to deliver a parcel. A seller sees the delivery name and address of their buyer, only for the order they are fulfilling, and may use it for nothing else. We do not sell personal data, and there is no advertising tracking on Kaparay.

Some providers (Stripe, Sentry, Cloudflare) process limited data outside the UK and EU; where they do, transfers are protected by UK-approved safeguards such as the International Data Transfer Agreement or addendum to the EU standard contractual clauses.

UK digital platform reporting rules require marketplaces like Kaparay to report seller information to HMRC each year. If you sell above the reporting thresholds, we are legally required to report your name, address, date of birth, tax identifier (such as your National Insurance number, which we will ask you for when the rules require it), and the amounts you earned through Kaparay. You receive a copy of what we report about you. This is a legal obligation; it is not optional for us, and selling on any UK marketplace involves the same reporting.

Transaction, payout and tax records are kept for 6 years after the tax year they relate to, because financial record-keeping law requires it. Messages are kept while the account exists; they are also the evidence record if an order is disputed. Analytics data is kept in identifiable form no longer than needed and is aggregated or deleted thereafter.

When you delete your account (you can, from account settings, without emailing anyone): your profile is anonymised, your messages are detached from your name, unsold listings are removed, and everything not subject to a legal retention duty is erased. The 6-year financial records survive deletion because the law says they must; they are no longer linked to a living profile.

• Access and export: a machine-readable bundle of your profile, listings, orders and messages, free, within one month
• Correction: fix anything inaccurate, mostly self-serve in account settings
• Deletion: anonymise and retain as described in section 6
• Objection and restriction: object to processing based on legitimate interests, and withdraw any consent at any time
• Complaint:to us first if you will let us put it right, and to the Information Commissioner's Office (ico.org.uk) at any time

Data is encrypted in transit and at rest. Access to personal data inside Kaparay is role-gated and logged. Passwords are hashed, payment details never touch our servers, and receipts uploaded for verification are stored in a private bucket readable only by the seller who uploaded them and our moderation team.

A few essential cookies keep Kaparay working: signing you in and keeping your bag. They are always on because the site does not work without them. There are no analytics cookies on Kaparay today. Analytics arrives at launch, and when it does it will be consent-first: nothing loads until you agree, and declining keeps the site working exactly as it does now. There are no advertising trackers, and there never have been.

Material changes to this policy are notified by email before they take effect, with the new effective date stated.