docs/DATA-SOURCES.md, the retention job, the runbooks). It is not legal advice; have it checked, fill the placeholders (including the ICO registration number once registered), remove this notice and the noindex tag, and set the effective date.What we store about you, and why
Effective REPLACE_WITH_DATE. The short version: your account email, the ledger and watchlists you type in, billing through Stripe, and a short-lived cache of eBay listings. No advertising, no tracking cookies, nothing sold.
1. Who is responsible
The data controller is REPLACE_WITH_OWNER_NAME, trading as GrailDesk, of REPLACE_WITH_TRADING_ADDRESS, United Kingdom, registered with the Information Commissioner's Office under number REPLACE_WITH_ICO_NUMBER. Contact: REPLACE_WITH_OWNER_EMAIL.
2. What we collect and why
| Data | Why (lawful basis) | Kept |
|---|---|---|
| Waitlist: email, the role and card types you tick, founding interest, the page you signed up from, date and time | To tell you when GrailDesk opens and, if you asked, to offer the founding price (consent) | Until you ask to be removed, or 12 months after public launch |
| Account: email address, sign-in method (magic link or Google), the times you signed in | To run your account (contract) | While the account exists |
| Your workspace: ledger entries (cards, costs, sales, notes), watchlist searches, bankroll rules, settings, the name you give the desk | To provide the service (contract) | While the account exists; then deleted on request, except what section 6 says about tax records |
| Billing: your Stripe customer id and subscription state (plan, status, period dates). Stripe holds your card, billing address and invoices | To charge you and to apply your plan (contract; legal obligation for tax records) | Subscription state while the account exists; invoices 6 years (HMRC) |
| eBay listing data the watchlist scanner saw for you: titles, prices, seller names, item links, images' links | To show you alerts (legitimate interest in providing what you asked for), under eBay's API licence | 10 days from when a listing was last seen; an alert nobody acted on 180 days at most; your own purchase keeps its figures |
| Push subscriptions: a browser push endpoint for each phone you turn pushes on | To send alerts you asked for (consent) | Until you turn pushes off, or the browser revokes it |
| Emails we send you: alert digests, receipts, sign-in links | To provide the service (contract); product news only with consent | Delivery logs at the email provider for 30 days |
| Error reports: a stack trace and the page you were on when something broke (no form contents) | To fix faults (legitimate interest) | 90 days |
| Usage statistics: page views counted without cookies or any identifier that follows you | To see what is used (legitimate interest) | Aggregated; no personal data retained |
We do not collect special-category data, we do not profile you for advertising, and we never send eBay data or your ledger to an artificial-intelligence service.
3. Cookies and local storage
No advertising or analytics cookies. The sign-in session is kept in your browser's storage so you stay signed in; a few preferences (theme, which sidebar you chose, a draft you have not sent) are kept on your device only and never leave it. The landing page sets nothing at all.
4. Who processes data for us
| Processor | What | Where |
|---|---|---|
| Supabase | The database, sign-in, the server functions, file storage | London (EU-West-2), with encrypted backups |
| Vercel | Serves the application and this site | Global edge network; no personal data is stored there |
| Stripe | Payments, cards, invoices, subscription emails | EU and US, under Stripe's own data agreements |
| Resend | Sends our emails (sign-in links, alert digests, receipts) | EU/US; delivery logs 30 days |
| eBay | We request listing data from eBay's API; eBay sees the searches we make, not who you are | eBay's own terms |
| Sentry | Error reports | EU region |
| Cloudflare R2 | Encrypted nightly database backups | EU |
Each processes data only on our instructions under a written agreement. Transfers outside the UK rely on the UK's adequacy regulations or the International Data Transfer Addendum.
5. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to our processing, and to move it elsewhere. Most of this you can do yourself: every table in GrailDesk exports to CSV, and Settings shows what we hold. For anything else, email REPLACE_WITH_OWNER_EMAIL; we answer within one month. You may complain to the Information Commissioner's Office (ico.org.uk) at any time.
6. Deleting your account
Ask by email from your account address and we delete your account and workspace: ledger, watchlists, rules, settings, push subscriptions and cached listings go with it, and your billing is cancelled. What we must keep: invoices and the subscription record Stripe holds, for 6 years, because HMRC requires it. Deletion is confirmed by reply.
7. eBay sellers
If you are an eBay seller whose listings appeared in a user's watchlist, we held your public eBay username and the listing for at most 10 days. When eBay tells us a seller has closed their account, we remove the username from anything still held, as eBay requires.
8. Security
Every row in the database is scoped to its owner and enforced by the database itself, not only by the application. Secrets live in a vault, never in the code. Backups are encrypted. Sign-in is by emailed link or Google; we never see a password.
9. Changes
The current version is always at this address with its effective date. We email you about a material change before it applies.