This policy explains what personal data Biddurs collects, why, who we share it with, how long we keep it and your rights under the UK GDPR and the Data Protection Act 2018. It covers the Biddurs app, biddurs.com and the Biddurs waitlist.
The data controller is Robert Scotts Commerce LTD, a company registered in England and Wales (company number 14252682), Unit 2 Forty Acres, Coombe Road, Petersfield, GU32 1PP. ICO registration number: [Scott to add]. For anything about your data, email privacy@biddurs.com or write to us at that address.
Account data: email address, username, a record that you confirmed you are 18 or over (we check your date of birth but do not keep it), profile picture, password (stored only as a one way hash), and phone number if you add one. If you sign in with Apple or Google, we receive your name and email address from them. Marketplace activity: bids, wins, purchases, sales, follows, reviews, show reminders, rewards activity (points, spins, containers, credit) and referrals. Messages and chat: chat messages in shows and in community chat, private messages and the photos you send in them, and conversations with our help assistant and support team. Orders and delivery: delivery name, address and phone number, tracking details, returns and disputes. Payment data: handled by Stripe. We never see or store your full card number; we keep only Stripe's references, the card brand, the last four digits and the expiry. Sellers: business details, UTR or company number, payout details held by Stripe, and identity checks carried out by Stripe. Streams: live video and audio broadcast publicly in a show, recordings for replays and sale clips, and automatic transcripts of stream audio. Device and usage data: app version, device type, push notification tokens, crash reports and diagnostics, and your IP address in sign in security logs. Analytics are explained in section 9. Fraud prevention data: a random install id kept in the app or your browser, the fingerprint Stripe gives your card (a code that recognises the same card number without revealing it), and scrambled (hashed) copies of your email address, phone number, delivery address and push notification tokens. We use these only to stop one person running several accounts for rewards, giveaways or referrals, to stop buying from your own shop with credit, and to keep banned accounts out. The install id is stored on your device because it is strictly necessary for security, so it does not need cookie consent. Waitlist: if you join the Biddurs waitlist before we open, we keep your email address, your first name (if you give it), whether you want to sell, the source of the signup, the exact wording you agreed to and when you agreed. To stop abuse of the form we also keep a one way, keyed hash of your IP address (never the address itself). We use this only to email you when Biddurs opens and when your account is ready, and to set up that account. The waitlist is stored with our database provider, Supabase.
To create and run your account, run auctions, take payments, arrange delivery and handle returns and disputes (contract). To check you are 18 or over (contract, legal obligation). To prevent fraud, payment abuse, auction manipulation and spam, and to secure accounts (legitimate interests). To keep Biddurs safe: moderating chat, reviewing reports and acting on illegal content (legitimate interests, legal obligation). To run the rewards programme, referrals and giveaways (contract). To send service messages such as order updates, outbid alerts and show reminders you asked for (contract). To send marketing emails and push notifications (consent, which you can withdraw at any time). To understand how Biddurs is used and improve it (consent for anything stored on your device, legitimate interests for anonymous totals; see section 9). To keep tax and accounting records and report seller earnings to HMRC (legal obligation). To contact you about the waitlist and set up your account (consent).
Private messages between members, including photos sent in them, are not end to end encrypted: authorised Biddurs staff may review a conversation and its attachments when needed to investigate a report, a dispute, suspected fraud or a safety concern, and every such review is recorded (legitimate interests, legal obligation).
Other users see your username, profile picture, reviews and what you post in public chat and shows. Sellers see the name, delivery address and phone number needed to send your order. Buyers see a seller's trader details. Service providers acting for us: Supabase (database, authentication and file storage), Stripe (payments, seller payouts and identity checks), LiveKit (live video), Resend (email), Expo, Apple and Google (push notifications), Vercel (website hosting), Railway (database for older biddurs.com website accounts), OpenAI (help assistant and stream transcripts), Apple and Google (sign in, if you use it), and the carriers that deliver your orders (such as Royal Mail, Yodel, DPD and InPost). Authorities: HMRC, the police, regulators or courts where the law requires, and others where needed to protect users from fraud or harm. We do not sell your personal data.
Our database is hosted in the UK (London region). Some providers, including Stripe, LiveKit, Resend, Vercel, Expo, Railway and OpenAI, may process data in the United States or elsewhere outside the UK. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU US Data Privacy Framework where the provider is certified) or the International Data Transfer Addendum to the standard contractual clauses. [Solicitor to confirm the safeguard for each provider]
Account data: while your account is open. When you delete your account, your profile, addresses, devices, follows, notifications, messages and rewards progress are removed and your analytics records are unlinked from you. Orders, payments, refunds, invoices and seller tax records: 6 years. Disputes and returns: 6 years after they close. Show chat: 180 days; messages hidden by moderation: 12 months. Community chat: 7 days; hidden messages: 90 days. Private messages: 2 years after the last message, or 6 years if they relate to an order. Replays: up to 14 days. Sale clips: 180 days. Transcripts: up to 30 days. Stories: removed 7 days after they stop showing. Notifications: 60 days once read, 180 days if unread. Help assistant conversations: 6 months. Support requests: 2 years. Problem reports: 12 months after they close. Safety records (reports, bans, moderation actions): as long as needed to keep users safe, reviewed every 2 years. Analytics: 13 months, then only anonymous totals. Fraud prevention data: 12 months after we last see it, including after you delete your account, so a closed or banned account cannot simply sign up again (legitimate interests). Technical logs: 1 to 30 days. Error and crash reports: up to 90 days. Waitlist entries: until your account is set up or you ask us to remove you, and in any case no longer than 12 months after Biddurs opens. Email sales@robertscotts.com to be removed at any time. Anything under an open report, dispute or legal claim is kept until it is resolved.
You can ask for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent you can withdraw it at any time. Use the app's account tools (Account, then Data and privacy, or Delete account) or email privacy@biddurs.com. We reply within one month. You can delete your account at any time in the app or by following the steps on our account deletion page at biddurs.com/account-deletion.
If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
We use automatic checks to filter banned words in chat, to spot unusual payment or bidding patterns and to cancel an order when a payment fails. These checks can hold a message or restrict an account until a person reviews it. No decision with a legal or similarly significant effect on you is made without a person being able to review it; ask us and we will.
We measure how Biddurs is used with our own first party analytics; nothing is sent to a third party analytics company. If you choose "Essential only" (or make no choice) we record only anonymous page and screen counts with no identifier at all. If you accept analytics, we store a random identifier on your device (a 12 month cookie on the website, a stored id in the app) so we can count visitors and sessions and see which pages, shows and features are used, and we link this activity to your account while you are signed in. We record the page or screen, the show being watched and for how long, bids, wins, orders, follows, searches and shares, your device type and app version, the site that referred you and any campaign tags in the link, and your country. Analytics never records your email address, phone number, postal address or IP address. Raw analytics events are kept for 13 months and then reduced to daily totals that identify no one. Lawful basis: your consent for anything stored on or read from your device (PECR), and our legitimate interest in understanding aggregated use of the service. If you switch on "Marketing" we may also use these records to measure the performance of our own advertising; we do not use them for advertising otherwise. You can change your choice at any time from "Cookie settings" in the website footer or the app's data and privacy settings; withdrawing consent deletes the identifier. The Cookie Policy lists every cookie we use.
Biddurs is strictly 18+. You must be 18 or over to register, bid, buy or sell. We check you are 18 or over and keep only a record that you confirmed it, we close accounts that belong to anyone under 18, and we do not knowingly collect data from anyone under 18.
We will tell you about important changes to this policy by email or in the app before they take effect.
Contact: privacy@biddurs.com