Privacy policy

Who looks after your information

Bagged is run by Carl Joseph Lee, a sole trader based in the UK, who is responsible for your information under UK data protection law. You can contact us about anything in this policy at rethrift@yahoo.com.

What we keep and why

• The waitlist: if you join the waitlist before launch, we keep your first name, email, your answers to the form and where you came from (e.g. TikTok). We only use them to tell you when Bagged opens and to plan what to build. We delete them when we launch, or sooner if you ask.
• Your account: your email address, the name you show to other members, your password (stored scrambled, so we never see it) and when you confirmed you’re 18 or over. We need these to run your account.
• Your shopping choices: the departments, sizes and filters you choose, the items you add to your Rail and the items you hide. We use these to show you a feed that suits you, and we only show you items in the sizes you pick.
• Notifications: when you add an item to your Rail, we tell the seller how many people have it on their Rail. We never tell them who. If the seller then sends a discount to everyone who saved it, you get a notification. Notifications are deleted after 90 days.
• Phone notifications and emails: if you switch notifications on, we keep a code for that phone or browser so we can send them (it isn't your phone number). We email you about your messages, offers and orders unless you turn that off in Profile → Notifications. We only email about saves and discounts if you turn that on. What we send is kept for up to 14 days, then deleted.
• Your shop page: each seller has a public shop page that anyone with the link can see, even without an account. It shows your first name, shop bio, when you joined, how many items you've sold and your items for sale. Nothing else.
• Quick listing: if you tap “Fill in the details from my photos”, up to 4 of your listing photos are sent to Anthropic, the company that makes the Claude AI, to suggest the details. Under its business terms, Anthropic doesn't use them to train its AI. Nothing is listed until you check and save it.
• Your listings: photos, descriptions, prices and sizes. Other members can see these. When you upload a photo we save a fresh copy, which removes hidden details such as where it was taken.
• Chats and offers: the messages and offers you send. Only you and the other person can see a chat, unless it’s reported to us (see below).
• Addresses for posting: when you buy, the seller sees the delivery address you give (it’s on the label). Your phone number, if you add it, goes to the courier for delivery texts and may appear on the label. A seller’s return address and phone number are kept private but are printed on the label. We send both addresses, and phone numbers where the courier needs them, to our postage partners to make the label.
• Orders and payments: what was bought, the amounts, dates, payment and payout references, tracking, and any problem reported and how it was resolved. Card details are handled by Stripe and never reach us.
• Sellers’ payout details: to pay sellers, Stripe collects your name, date of birth, address, bank details and sometimes photo ID, and checks them as the law requires. We only keep your Stripe account reference and whether payouts are switched on.
• Tax reporting: the law requires us to report sellers to HM Revenue & Customs once they make 30 or more sales, or are paid more than €2,000 (about £1,700), in a calendar year. We count each seller’s finished sales and what they were paid, each quarter. When a seller gets close to the limits we ask for their legal name, home address, date of birth and National Insurance number (or tax reference), and remind them every couple of weeks until they add them. Only Bagged’s owner can see these details, and sellers can see their own (but not their full number) in Profile → Seller tax details, along with a copy of what we report.
• Safety records: reports you make or that are made about you, people you block, and any decisions and appeals. We keep these to keep Bagged safe and fair, and because the law expects us to deal with illegal content.
• Technical information: our hosting providers keep short-term logs, including your IP address, to keep Bagged secure and working.

The law calls these reasons our “lawful bases”. Most of what we keep is needed to provide the service you signed up for (a contract). Safety records and technical logs are kept because we have a genuine need to keep Bagged safe (legitimate interests) and to meet our legal duties. Order and payment records, and tax reporting, are kept because the law requires it.

When someone reports something

If a listing, person or chat is reported, the person reviewing it can see the listing, the reported person’s account details and, for a chat, the messages in that chat. We don’t tell the reported person who reported them.

Who we share it with

We only share information with the companies that help us run Bagged, and only what they need:

• Supabase stores our database, photos and log-ins, on servers in London.
• Vercel hosts the Bagged website and app.
• Stripe takes card payments, holds buyers’ payments until orders are complete, checks sellers’ identity and pays sellers. Stripe is responsible for the information it collects to do this; see its privacy policy at stripe.com/gb/privacy.
• HM Revenue & Customs receives, once a year, the tax details and sales figures of sellers who pass the reporting limits above.
• Anthropic reads listing photos when a seller uses quick listing.
• Resend sends our emails.
• Phone notifications are delivered by the company that makes your phone or browser (such as Apple, Google or Mozilla). They only see the notification text.
• ShipStation and the courier the buyer chooses (such as Evri or Royal Mail) receive the addresses and parcel details needed to make and deliver the label.

Some of these companies are based in, or use servers in, the United States. When information leaves the UK, it’s protected by the UK’s rules on international transfers, such as the UK–US data bridge or approved contract terms.

We’ll also share information if the law requires it, for example with the police. We never sell your information.

Cookies

We only use the cookies needed to keep you logged in. We don’t use advertising or tracking cookies, so we don’t need to ask for your consent.

How long we keep it

We keep your information while your account is open. If you close your account, we delete it and the information linked to it, including your listings, photos, chats and addresses, within 30 days. The exception is order and payment records, which we must keep for 6 years for tax and accounting; we keep only what’s needed (the item, amounts, dates and delivery details) and nothing else. Sellers’ tax details are kept for 5 years after the end of the year they were reported for, as the law requires, even if the account is closed. Stripe keeps its own records of payments and payouts for as long as the law requires.

Your rights

You have the right to:

• get a copy of the information we hold about you
• have it corrected if it’s wrong
• have it deleted
• ask us to limit how we use it, or object to how we use it
• get the information you gave us in a format you can take elsewhere

To use any of these rights, contact us at rethrift@yahoo.com. We’ll reply within one month. If you’re unhappy with how we’ve handled your information, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Age

Bagged is only for people aged 18 or over. We don’t knowingly keep information about children.

Changes to this policy

If we make an important change to this policy, we’ll tell you before it takes effect. The date at the top shows when it was last updated.