Privacy Notice
1. Who we are
Wivvr provides this marketplace platform.
2. How to contact us
Contact: support@wivvr.co.uk.
3. How and why we process personal data
We process personal data for the purposes below and use a lawful basis that matches each purpose.
| Purpose | Personal data categories | Source | Recipient/system | Lawful basis | Retention period or criteria |
|---|---|---|---|---|---|
| Account creation and authentication | Email, account identifiers, login/session data | User input and authentication events | Supabase authentication and database services | Contract | While account remains active and as needed for security and legal recordkeeping |
| Profile management and saved delivery addresses | Profile name, delivery recipient details, address lines, postcode, country | User account/profile updates | Supabase database services | Contract | Until changed/deleted by user, or while required for order, dispute, fraud, or legal reasons |
| Basket, checkout, order creation and fulfilment workflows | Order items, delivery address snapshot, order identifiers, payment status references | User checkout actions and store/order events | Supabase order systems and Stripe payment services | Contract | For service operation, dispute handling, accounting, and legal claims/obligations |
| Seller onboarding and store management | Store details, business contact details, store assets, seller reporting profile fields | Seller submissions and merchant actions | Supabase database/storage services | Contract | While seller account/services are active and for legal/compliance obligations |
| Seller subscription and billing administration | Plan selection, subscription state, Stripe customer/subscription identifiers | Seller billing actions and Stripe events | Stripe billing services and Supabase records | Contract | For subscription lifecycle, reconciliation, accounting, and audit needs |
| Payout and financial administration | Order financial snapshots, payout events, adjustment records | Order and payout processing events | Supabase financial records; Stripe payout/account events | Legal obligation and Contract | As required for accounting, tax, anti-fraud, and legal compliance periods |
| Messaging, reviews, returns, issue handling, and support | Message content, review text/ratings, return/issue details, support correspondence | User submissions and order-support workflows | Supabase data systems; Postmark for operational email delivery | Contract and Legitimate interests | While needed to provide support/services and for dispute, safety, and legal claim handling |
| Fraud prevention, abuse detection, platform security, and service integrity | Technical logs, event diagnostics, account/session and transaction context | System-generated logs and platform activity | Supabase systems and internal operational tooling | Legitimate interests | As long as reasonably necessary for security monitoring, investigations, and claim defense |
| Site analytics where enabled | Usage/interaction analytics and browser identifiers | Browser events where analytics is enabled | Google Analytics services | Consent | Until analytics preference is changed/withdrawn and per analytics configuration |
| AI-assisted storefront generation features | Seller-provided style selections and optional store-name text in prompts | Seller storefront generation requests | OpenAI image generation services; Supabase storage for outputs | Contract and Legitimate interests | Generation requests and outputs retained while needed for storefront tooling and operations |
| Storefront and catalog search | Search query text and product/store listing content | User search input and published listing content | Supabase search function and database indexing | Contract and Legitimate interests | Search logs and diagnostics kept only as needed for service quality and abuse prevention |
4. Legitimate interests used
Where we rely on legitimate interests, those interests include running, securing, and improving marketplace operations; preventing fraud and abuse; handling support and disputes; and maintaining service reliability proportionately.
5. Right to object
If we process your data based on legitimate interests, you have the right to object to that processing in circumstances provided by law. Contact support@wivvr.co.uk to raise an objection.
6. Who we share data with
We share data with service providers that support marketplace operations, including data hosting, payments, email delivery, analytics, and AI-enabled tooling used by sellers.
7. Service providers currently integrated
- Supabase: platform database, auth, storage, and server-side functions.
- Stripe: buyer payments and seller billing/payout account workflows.
- Postmark: transactional email delivery for platform notifications.
- Google Analytics: site analytics when enabled and not opted out.
- OpenAI: AI image generation for storefront shell/variant tools.
8. International transfers
Some service providers may process personal data outside the UK. Where this happens, Wivvr uses legally permitted safeguards where applicable. Detailed transfer-mechanism mapping remains under legal review.
9. How long we keep information
Wivvr does not currently operate a single fixed retention timetable for every category. We retain data according to service necessity and legal criteria, including account lifecycle, order/dispute timelines, accounting and regulatory obligations, fraud/security investigation needs, and legal-claims defense requirements.
10. Security
We use technical and organizational measures intended to protect personal data in our systems and service-provider environments.
11. Your rights
Depending on applicable law and circumstances, rights may include access, correction, erasure, restriction, objection, and data portability.
12. Consent withdrawal
Where processing relies on consent, you can withdraw consent. For browser analytics settings, use Data and cookies.
13. Account/profile correction
Users can update account profile details and saved addresses through account features.
14. Deletion and erasure requests
Requests are considered case-by-case and may be limited where retention is required for legal, fraud, accounting, or dispute reasons.
15. Complaints to the ICO
If you have a data-protection concern, please contact support@wivvr.co.uk first so we can investigate and respond.
If you remain dissatisfied, you can complain to the Information Commissioner's Office (ICO). You can also contact the ICO directly at any time.
Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline: 0303 123 1113
ICO complaints and contact guidance: https://ico.org.uk/make-a-complaint/
16. Cookies and browser storage
See Data and cookies for current browser-storage and analytics controls.
17. Policy versioning
Current policy versions: Terms 2026-09-04; Privacy Notice 2026-09-04.
18. Changes to this Notice
Updates are published on this page with a revised last-updated date.