Privacy Policy

The distinction that matters

Your data as our customer — your name, email, phone number, billing details, and how you use the product. For this we are the data controller: we decide what to collect and why, and this policy is our explanation to you.

Your customers’ data, which you put into the system — the people whose phones you repair, buy and sell to. For this you are the controller and we are your processor. We hold and process it on your instructions, to run the service for you. We do not decide what you collect, we do not use it for our own purposes, and we do not contact your customers except where you ask the product to (for example, a repair-ready SMS you trigger).

That second part carries an obligation you should be clear about: your shop’s own privacy notice, and the lawful basis for holding your customers’ data, are yours to get right. This is particularly true for trade-in identity records — a photographed driving licence is sensitive, you are collecting it, and you need to be able to say why and for how long you keep it.

What we collect about you

• Account details — name, email address, and the mobile number you optionally give at signup. Used to create your account, confirm your email, and contact you about the service.
• Shop details — business name, address and contact details you enter during setup, which appear on your receipts and invoices.
• Billing details — handled by our payment processor. We see the subscription status and the last four digits; we never see or store your full card number.
• Technical data — IP address, browser type, and timestamps, kept in server logs. We also record signup attempts (email, IP, outcome) to prevent abuse of the free trial.
• Support correspondence — what you send us when you ask for help.

Why we are allowed to hold it

• To perform our contract with you — running your account, taking payment, providing support.
• Our legitimate interests — keeping the service secure, preventing fraud and trial abuse, and improving the product. We have considered your rights alongside ours; the data used for this is limited to what is needed.
• Legal obligation — keeping records we are required to keep, such as for tax.

We do not send marketing email to your customers, and we will not sell your details to anyone.

Who else sees the data

We use a small number of sub-processors to run the service. Each is bound by contract to protect the data and to use it only for the purpose below.

Your business data is stored in the European Union. Where a provider processes data outside the UK or EU, that transfer is covered by the UK International Data Transfer Agreement or equivalent safeguards.

We will also disclose data where the law requires it. If we receive such a request covering your data, we will tell you unless we are legally prevented from doing so.

How long we keep it

• While your account is active — for as long as you keep using the service.
• After you stop — your data is kept for 3 months so you can return or export it, then permanently deleted.
• Billing records — kept for six years, as UK tax law requires.
• Server and signup-attempt logs — kept for a short period for security and abuse prevention, then discarded.

Some records inside the product are deliberately append-only — the money ledger, completed sales and the audit log. A correction is recorded as a further entry rather than by editing history, because a financial record that can be quietly rewritten is not a financial record. This affects how deletion works: where we must keep a transaction for accounting purposes, we remove or anonymise the personal details attached to it rather than destroying the entry.

Your rights

Under UK data protection law you can ask us for a copy of your personal data, ask us to correct it, ask us to delete it, object to processing based on legitimate interests, or ask for it in a portable format. Email [email protected] and we will respond within one month.

If one of your customers asks you to delete their data, that request is yours to action — you can do it in the product. Ask us if you need help.

We are established in the United Kingdom and process personal data here, so we are registered with the Information Commissioner’s Office and pay the data protection fee.

You can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you came to us first, but it is your right either way.

Security

Access is over HTTPS, passwords are hashed, and every business’s data is isolated at the database level rather than by application code alone. Staff access inside your shop is limited by the role permissions you set. We keep audit logs of access to sensitive records.

No system is perfectly secure. If a breach affects your data, we will tell you without undue delay and report it to the ICO where required.

Contact

Red Crystal. Data protection enquiries: [email protected].