Privacy Policy

Introduction

This Privacy Policy explains how Resell Reserve handles your personal data when you use our Service — which covers the Resell Reserve app (our inventory and profit tracker), our Discord, our website, the Reframe photo app, and all related tools.

It tells you what we collect, why we collect it, who we share it with (if anyone), and what rights you have under UK data protection law — specifically the UK GDPR and the Data Protection Act 2018.

Using our Service means you've read and accepted this Policy. If you disagree with any part of it, don't use our Service.

Data Controller: Resell Reserve is an unregistered trading name based in the United Kingdom. For data protection purposes, we act as the data controller in respect of all personal data collected through the Service. Our contact details for data protection matters are set out in Section 11.

1. What we collect

1.1 Identity and Account Information

To manage your access to the Service, we collect:

• Your Discord user ID and display username — needed for authentication and access
• Your roles in our Discord server, read once when you sign in to the website so it knows which plan you are on. The website keeps the plan in your login cookie; the Discord access token is used for that one read and then discarded, never stored
• Email address — provided when you link your account, manage your subscription, or contact support
• Payment and billing metadata (transaction IDs, subscription status, payment history) — processed and stored by Stripe
• Your Reframe account, which is created from your Discord sign-in, together with your credit balance and credit history

1.2 Service Usage and Subscription Data

To run and improve the Service, we store:

• Your active subscription tier (Core or Ultimate), subscription status, activation dates, renewal dates, and billing cycle information
• If you use the Resell Reserve app: what you log there — items, sales, expenses, goals, lots, storage places, stock-takes, listing templates, receipts, photos and shipping labels — and what the marketplace connections you choose to make read from your own Vinted or eBay account. Section 1.4 sets out exactly what the app stores and Section 7 how long it is kept
• Interaction logs showing which Discord commands and features you use, to help us understand how the tools are being used
• What you put into the AI tools — the item details you type and any photo you attach for price estimation, listing text or seller research — and what the tool produced. Staff review the pricing tool's estimates and record corrections, and we keep that history to improve the tool
• Photos you upload to Reframe, the images it produces, and the layouts, backdrops and settings you chose. They stay in your Reframe library until you delete them
• If you cancel, the reason you choose and any comment you leave in the optional cancellation survey, so we can see why members leave
• Moderation records where they apply — warnings, cases, reports (with a link to any screenshot the reporter attached) and staff notes — kept to run the community fairly
• If you join the affiliate programme, the account name, sort code and account number you give us for payouts, stored encrypted and used for nothing else
• Wins you post in our success channel. A staff member may approve a post to appear on the public Success page of our website — the caption and screenshots you posted, never your name or avatar. Ask us at any time and we will take a post down

1.3 Technical and System Information

Our systems automatically capture:

• IP addresses in server logs (not stored as separate records — purged during log rotation)
• Browser type and basic device info, to check compatibility
• Crash logs and error reports to fix technical issues

Information We Do NOT Collect: We do not intentionally collect or store special category data (sensitive personal data such as health information, biometric data, political opinions, etc.), precise geolocation data, or personal information from advertising or cross-site tracking services. Our website analytics are cookieless and aggregate (see Section 8), and we do not maintain separate databases of IP addresses for tracking purposes.

1.4 The Resell Reserve app (inventory and profit)

The Resell Reserve app at app.resellreserve.co.uk is where members log what they buy and sell and see what they make. You sign in with Discord (or with Apple, which then hands you on to Discord). Everything in this section is held only for you: no other member can see it, and we do not use it for anything but running the app for you.

Your account in the app

• Your Discord user ID, username and avatar, and which paid tier you hold. Your session is a signed cookie; we do not keep your Discord password or access token
• If you use Sign in with Apple: the identifier Apple gives this app, the email address Apple shares with us (which may be a private relay address), and an Apple refresh token, stored encrypted, which we use only to tell Apple to forget the link when you delete your account
• Your settings, including the currency and language you keep your books in

What you log

• Items: titles, brands, categories, sizes, condition, costs, prices, fees, postage, dates, notes, storage places, where you bought them, and photos
• Sales, expenses (and any receipt image you attach), goals, lots, storage places and stock-takes (which items you ticked as present, and when), and listing templates
• Shipping labels you upload so you can print them. A label carries your buyer's name and address. We keep it only so you can print it; you can delete it, and it is deleted with your account. You decide what you upload, and we hold your buyers' details on your behalf
• A feed of what you did in the app (added, sold, repriced), shown only to you

Marketplace connections you choose to make

• Vinted: the token you paste in, encrypted with a key that is not stored in the database; your Vinted account ID and username; and what the connection reads from your own account — your sold orders and their parcel status, your listings, the two figures in your Vinted balance and, for a buying account, what you bought. We do not read your messages and we do not keep a buyer's address
• eBay: a refresh token (limited by eBay's permissions to reading orders, finances, listings and purchases); your eBay user ID and username; your orders (including the buyer's eBay username), fees, payouts, balance, listings and purchases (including the seller's name)
• The app only changes something on a marketplace when you ask it to: a Vinted listing's price, from the Listings screen
• You can disconnect either at any time, and the token is deleted

Sharing you switch on

• If you share an item, a public page and a picture show that item's photo, title, brand, size, condition, what you paid, what you expect or got for it and the profit — to anyone holding the link, until you turn the link off. Nothing else about the item is on it
• If you share a week or a month, a public page and a picture show what sold, what it made, your best sale and the shape of the period. What you bought, your costs and your goals are never on it
• Links you post elsewhere (for example in Discord) may be cached or previewed by that service after you turn them off

Notifications

• If you turn notifications on: the push address your browser or phone gives us, or a device token from the App Store build. Notifications are delivered through Apple's, Google's or Mozilla's push services and the content is encrypted on the way
• If you ask for a private Discord channel: the channel and a webhook to post into it. Resell Reserve staff can see that channel so they can answer you in it. Removing it deletes the channel and its messages

Connectors and API keys

• Keys you create, and assistants you connect (for example a Claude or ChatGPT connector), are stored as one-way hashes with a name and when each was last used. A key can read and add to your records; it can never delete them or record a sale

Pooled sales (anonymised)

• When you record a sale, its brand, category, size, condition, price and date go into a pool that helps price guidance for every member. The pool holds no name, no Discord ID and no item title, and carries a keyed hash so a figure is never quoted from one seller's sales alone. Un-selling or deleting the item takes it back out, and so does deleting your account

Operational

• Server logs record counts and the kind of a failure, never your trading data. If a page fails in your browser, the app sends one line: the kind of error, the page's path (without its query string) and a short message
• Your IP address is used briefly in memory to limit the rate of requests. It is not stored in the database

Where it is processed

• The app and its database run on Railway (Netherlands); photos, receipts and labels are stored in that database. Discord provides sign-in, roles and the optional private channel. Apple provides Sign in with Apple and, in the App Store build, notifications. Vinted and eBay are read only when you connect them and only for your own account. When you ask the app to write a listing description, the item details you have entered (never photos) are sent to OpenAI to write it. Billing is through Stripe, via our subscriptions service, as described elsewhere in this Policy

2. How we use your data

We use your data for:

• Service provision: Authenticating you, managing your account, assigning Discord roles, and giving you access to what you've subscribed to
• Payments: Processing subscription charges, managing billing, and keeping financial records via Stripe
• Support: Responding to questions, fixing issues, and sending important service updates
• Service emails: Emailing you about your subscription — a failed payment, a scheduled cancellation, access ending, and after checkout a reminder to connect your Discord. We do not send marketing newsletters
• Security: Detecting and preventing fraud, unauthorized access, and abuse
• Legal compliance: Meeting tax, accounting, and other legal obligations, and responding to lawful requests from authorities
• Improvement: Analysing usage patterns and technical issues to make the Service better

We don't sell your data

We don't sell, rent, or share your data for anyone else's marketing. Your information is only used to run the Service and meet our legal obligations.

3. Lawful Basis for Processing Under UK GDPR

In accordance with UK GDPR Article 6, we process your personal data based on the following lawful grounds:

Performance of Contract (Article 6(1)(b))

We process your data to fulfill our contractual obligations to you, including: delivering the subscription services you have purchased, providing access to tools and features, managing your account, processing payments, and maintaining your subscription status.

Legitimate Interests (Article 6(1)(f))

We process data based on our legitimate business interests, which include: protecting the security and integrity of our Service, preventing fraud and abuse, improving our tools and features, providing customer support, and ensuring the proper functioning of our platform. We balance these interests against your privacy rights and only process data where necessary.

Legal Obligation (Article 6(1)(c))

We retain and process certain data to comply with legal obligations under UK law, including: maintaining financial and accounting records for tax purposes, responding to lawful requests from authorities, and fulfilling record-keeping requirements mandated by applicable regulations.

4. Storage and security

4.1 Data Storage and Hosting

Your account, subscription and community data are stored in databases hosted on Railway. Reframe's accounts, photos, results and credit records are stored on Supabase. Our website runs on Vercel. All data transfers between your device and our servers, and between our servers and their databases, are protected using industry-standard encryption (HTTPS/TLS), and each provider encrypts stored data at rest.

4.2 Security Measures and Protections

Our security includes:

• Encryption: All sensitive data is encrypted both in transit (using TLS/SSL) and at rest (using database-level encryption) to protect against interception and unauthorized access
• Access controls: Member data is reached only through the providers' own authenticated dashboards and our staff tools, by the people who run the Service
• Payment security: All card data goes through Stripe (PCI DSS Level 1). We never see your full card numbers or CVV
• Discord sign-in: The website asks Discord for the minimum — who you are and your roles in our server — uses the access token once and discards it. Reframe's sign-in is handled by Supabase, which holds that session
• Access restrictions: Only people who need your data to do their job can access it, and they're bound by confidentiality
• Monitoring: Errors and unusual activity are logged to a private staff channel and reviewed
• Updates: We keep our systems patched and up to date

5. Third-party services and data sharing

We use a handful of third-party services to run the platform. We share data with them only as needed:

Stripe (Payment Processing)

Stripe handles all payment processing and is an independent data controller under their own privacy policy. We share your email and subscription info with them. Stripe deals with card data directly — we never see your full card numbers.

Discord (Authentication and Community Platform)

Discord handles authentication and hosts our community. They're an independent data controller. We receive your Discord user ID, username and server roles via OAuth to manage your account. Screenshots attached to Discord posts are hosted on Discord's own servers. What Discord does with your data is covered by their privacy policy.

Railway (Infrastructure and Hosting)

Railway provides cloud hosting and database infrastructure services for our web application and backend. Your data is stored on Railway's servers, but Railway does not have access to the contents of encrypted databases. Railway acts as a data processor under our instructions and is bound by appropriate data processing agreements and security standards.

Vercel (Website Hosting)

Our marketing website is hosted on Vercel, which also provides our cookieless website analytics (see Section 8). Vercel may process transient request data (e.g. IP addresses in server logs, and aggregate page-view counts) in the course of delivering our website. Vercel acts as a data processor and is bound by appropriate data processing agreements.

Supabase (Reframe: sign-in, database and file storage)

Reframe's accounts, photo uploads, results and credit records are stored on Supabase, which also handles Reframe's Discord sign-in. Supabase acts as a data processor under our instructions and is bound by appropriate data processing agreements.

AI model providers (Reframe and the AI tools)

To produce a result, the photo you upload to Reframe, and the item details and any photo you give the AI tools in Discord, are sent to third-party AI model providers. They are sent for that purpose only, under the provider's API terms, and we do not build profiles from them. We name the category rather than a vendor because the provider behind a given tool can change.

Resend (Service emails)

The subscription emails described in Section 2 are sent through Resend, which processes your email address and the message content to deliver them, as a data processor.

Vinted and eBay (Marketplace Connections)

If you connect your Vinted or eBay account to the Resell Reserve app, the app reads your own account there (orders, listings, balance, purchases) with the credential you provide, and changes a listing only when you ask it to. Each platform is an independent data controller under its own privacy policy.

Apple (Sign in with Apple, App Store Notifications)

If you use Sign in with Apple, Apple provides the identifier and email address described in Section 1.4. In the App Store build of the app, Apple's push service delivers notifications you have turned on. Apple is an independent data controller under its own privacy policy.

OpenAI (Listing Descriptions)

When you ask the Resell Reserve app to write a listing description, the item details you have entered (never photos) are sent to OpenAI to write it, under OpenAI's API terms.

Push Services (Apple, Google, Mozilla)

If you turn notifications on in the app, they are delivered through the push service your browser or phone uses, with the content encrypted on the way.

Each third-party service provider maintains its own privacy policy and security standards. When data is transferred outside the UK or European Economic Area, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, to protect your data in accordance with UK GDPR requirements.

No Sale or Unauthorized Sharing

We do not sell, rent, or share your personal information with third parties for their marketing or advertising purposes. We only share data with the service providers listed above to the extent necessary to deliver our Service to you.

6. Your rights

Under UK GDPR, you have the following rights over your personal data:

Right of Access (Article 15)

You can request a copy of all personal data we hold about you, including information about how it is processed

Right to Rectification (Article 16)

You can request correction of any inaccurate or incomplete personal data we hold about you

Right to Erasure (Article 17)

You can request deletion of your personal data in certain circumstances, subject to legal retention requirements

Right to Restrict Processing (Article 18)

You can request that we limit how we process your data in specific situations

Right to Data Portability (Article 20)

You can request that we provide your data in a structured, commonly used, machine-readable format that you can transfer to another service

Right to Object (Article 21)

You can object to certain types of processing, particularly processing based on legitimate interests or for direct marketing purposes

Rights Related to Automated Decision-Making (Article 22)

We operate automated tools (AutoBuy and AutoCop) that execute purchasing actions on your behalf based on your configured preferences. These tools act on instructions you define and do not make decisions that produce legal or similarly significant effects about you as an individual. However, you have the right to request human review of any automated action taken through our Service. To do so, contact us at support@resellreserve.co.uk.

Right to Lodge a Complaint (Article 77)

You have the right to lodge a complaint with the UK supervisory authority for data protection if you believe we have violated your data protection rights

To use any of these rights, email us at support@resellreserve.co.uk or open a ticket in our Discord server. We'll respond within 30 days as required by UK GDPR. For complex requests we may take up to 3 months — we'll let you know if that's the case. We don't charge a fee unless a request is clearly excessive or unfounded.

7. How long we keep your data

Financial and Billing Records

We keep account, subscription, and billing records for up to 6 years from your last transaction. This is required by UK tax law. We may hold records longer if there are ongoing legal proceedings.

Data in the Resell Reserve app

Everything you log in the app, and everything its connections read, is kept for as long as your account is open. If your plan ends, your records are kept so you can come back, and from the screen you see instead of the app you can still download them or delete them. Settings › Data › Export everything downloads a zip of spreadsheets at any time, and Settings › Data › Delete everything deletes your account and everything above at once — there is no grace period, and your pooled sale entries, your private Discord channel and your Apple link go with it. Deleting your account in the app does not cancel your subscription; that is done on the Billing page. The app's database is backed up on a schedule (a daily backup kept for six days and a weekly backup kept for one month), so data you delete leaves our backups within one month.

Account Deletion Requests

When you request complete account deletion, we will delete or anonymize your personal data within 30 days of receiving your request, except where we are legally required to retain certain information (such as financial records for tax and accounting purposes, or data subject to legal holds). Deleted data cannot be recovered, so please ensure you have exported any information you wish to keep before requesting deletion.

Reframe Photos and Results

Photos you upload to Reframe and the results it produces stay in your library until you delete them or close your account. Uploads that never became a finished render are swept automatically.

AI Tool History and Survey Answers

What you give the AI tools, the pricing tool's history and staff corrections, and any cancellation survey answer are kept while they are useful for running and improving the Service. You can ask for yours to be deleted at any time, subject to the legal retention above.

Moderation and Affiliate Records

Moderation records are kept while you are a member and for a reasonable period afterwards, so repeat conduct can be recognised. Affiliate payout details are kept while you are an active affiliate and deleted on request once any outstanding payout is settled.

Discord and Sign-in Data

Discord user identifiers are retained while your account is active and for a reasonable period after account closure to prevent fraud and abuse, and longer if required for legal or security purposes. We do not store Discord access tokens.

8. Cookies, storage and analytics

We keep this deliberately light. We do not use advertising networks, we do not build advertising profiles, and we do not share your data with third parties for advertising or marketing. We set no non-essential cookies, so there is no cookie consent banner.

Analytics: we use Vercel Web Analytics to count page views and visits, so we can see which pages are used and how the site performs. It is privacy-first and cookieless — it sets no cookie, stores nothing on your device, and does not track you across other websites. We only ever see aggregate figures, not individual people.

What the website stores on your device:

• A strictly necessary cookie that keeps you signed in after you log in with Discord. It exists only to maintain your session, and it is exempt from consent because the logged-in area cannot work without it
• Small interface flags in your browser's session or local storage — for example, remembering that you have dismissed a banner or a prompt so it is not shown to you again. These stay on your device and are never transmitted to us

Reframe stores only the sign-in session Supabase keeps in your browser, which is strictly necessary for the app to work, plus small interface flags. It runs no analytics.

Our hosting and analytics provider processes transient technical data (such as IP addresses in server logs, and aggregate page-view counts) in the course of delivering the site, as described in Section 5.

9. Children's privacy

Our Service is for users aged 13 and over, in line with Discord's minimum age. We don't knowingly collect data from under-13s. If you're 13–17, make sure you have parental permission.

If you're a parent or guardian and think we've collected data from a child under 13, contact us at support@resellreserve.co.uk or via our Discord server and we'll investigate and delete it promptly.

10. Updates to this policy

We may update this Policy from time to time. If we make material changes, we'll let you know — via Discord, email, or a notice on the site. The date at the top shows when the current version took effect. Continuing to use the Service after changes means you accept the updated Policy. If you disagree, you can cancel your subscription and stop using the Service.

11. Contact us

Questions about this Policy or how we handle your data? Get in touch:

Email: support@resellreserve.co.uk

Discord: Open a support ticket in our Discord server.

Supervisory Authority: If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the UK supervisory authority for data protection. We would appreciate the opportunity to address your concerns first, so please contact us at support@resellreserve.co.uk before taking that step.

We aim to respond to all data protection inquiries within 30 days as required by UK GDPR, though we may contact you sooner if we need additional information to process your request.