This policy explains how Simpson's Ventures Ltd, trading as Rare Kind (we), collects and uses personal data when you use Rare Kind (the Service). We are a company registered in England and Wales (company number 17169404, registered office: 61 Bridge Street, Kington, HR5 3DJ, United Kingdom) and we are the data controller for the information described below. We are registered with the UK Information Commissioner's Office (ICO) as a data controller, registration number ZC133494.

1. Data we collect

• Account data — email address, username, and optionally a display name, provided at signup.
• Profile data — your avatar (optional), your default address (optional, used to pre-fill checkout), and the sizes you save to filter the shop.
• Two-factor authentication — if you enrol TOTP, the metadata for the factor (label, enrolment date) is stored by our authentication provider. The shared secret is held by Supabase, not by us directly.
• Business-seller details — if you sell as a sole trader or limited company, we collect your trading name, your Companies House registration number (limited companies only), your VAT number and UTR (where applicable), and the trading address you display to buyers under the Companies Act 2006 disclosure requirements. We cross-check the company number against the public Companies House register.
• Tax identifier (individual sellers)— optional at signup, but we ask for your UK National Insurance number or Self Assessment UTR. Required by HMRC once you cross 30 sales or £1,700 in a calendar year — see the “UK Digital Platform Reporting” section below for what we report and when.
• Identity verification (KYC) — to receive payouts you complete identity checks via our payments partner. The documents (ID, selfie, bank account verification) are submitted directly to Stripe and held by Stripe; we receive only the verification status and the high-level fields needed to operate the account (e.g. account type, charges-enabled flag).
• Listing data — photos, titles, descriptions, prices, weights, and postage options you provide when listing.
• Transaction data — the fact that you bought or sold an item, the price, your shipping address (collected by Stripe at checkout), the carrier you picked at checkout, tracking number, and the status history of the order. Shipping addresses are shown to the seller of that order only.
• Shipping data — for sellers: the ship-from address you save on your shipping-preferences page and your preferred-carrier list. For buyers: the ship-to address you enter at Stripe Checkout. We pass the sender address, recipient address, parcel size, and chosen carrier to our shipping partner Sendcloud (see Section 3) to generate the label. The tracking number and carrier are retained with the order record.
• Seller promotion records — if you purchase the Front Row promotion, we retain the fact of the purchase, the amount, the Stripe session reference, and the expiry date, as part of our accounting records.
• Payment metadata— we do not see your card details. Stripe provides us with a payment intent ID and, after the charge clears, the Stripe fee charged to us. Sellers' banking details are held by Stripe, never by us.
• Support and dispute correspondence — any messages you send to us or to other users via dispute forms, plus messages exchanged with counterparties on the platform.
• Reviews and reputation — reviews you leave and reviews counterparties leave on you. Aggregate ratings, cancellation counters, and follower / following counts displayed on your public profile.
• Technical data — IP address, browser info, timestamps of auth attempts (used for rate limiting), and error events captured by our monitoring provider when something breaks.
• Activity signals— a per-listing view counter (seller-facing analytics), the most-recent time you used the app (so we can show "Last active 3d ago" on your public profile when relevant), and aggregated counts of saves, sales, and reply times. None of this exposes who specifically viewed what — only counts.

2. Why we use it and our legal basis

• To provide the Service (account creation, listings, purchases, payouts) — performance of a contract (UK GDPR Article 6(1)(b)).
• To prevent fraud and abuse (rate limiting, account moderation, suspensions) — our legitimate interests(Article 6(1)(f)). We have documented a legitimate-interests balancing assessment weighing these interests against users' rights; a summary is available on request to hello@joinrarekind.co.uk.
• To send transactional email (order confirmations, dispatch notices, dispute updates) — performance of a contract.
• To send optional platform notifications you have not opted out of — including price drops on items you have favourited, and improvements to bundle discounts from sellers you follow — our legitimate interests in keeping you up to date on activity relevant to the items and sellers you've chosen. You can turn these off at any time on your notification preferences page.
• To generate shipping labels once a buyer has paid — performance of a contract. We pass the addresses, parcel size, and chosen carrier to Sendcloud; see Section 3.
• To meet our tax and accounting obligations (retaining transaction records) — legal obligation (Article 6(1)(c)).
• To resolve disputes and defend legal claims — legitimate interests.

3. Who we share it with

• Stripe Payments UK Limited— processes card payments and handles seller onboarding (KYC, bank account verification, payouts). Stripe is an independent controller for payment-related data. See Stripe's privacy policy.
• Supabase (Supabase, Inc.) — our database and authentication provider. Acts as our processor.
• Resend (Resend, Inc.) — delivers transactional emails on our behalf. Acts as our processor.
• Vercel Inc. — hosts the Service and runs the application code. Acts as our processor.
• Functional Software, Inc. (Sentry) — captures error events from the Service so we can fix bugs. Events may include the URL you were on, browser and OS info, and an internal user identifier; we do not send full request bodies. Acts as our processor.
• Sendcloud Global B.V.— generates shipping labels and passes parcel data to the chosen carrier. We share the sender address, recipient address, parcel size, and the carrier the buyer picked at checkout. Sendcloud is an independent controller for shipment-related data. See Sendcloud's privacy policy.
• Anthropic (via the Vercel AI Gateway)— when you create a listing, we send the photos you upload to Anthropic's vision model to generate suggested title, brand, size, condition, and price. The model receives only the photos, not your account details. The Vercel AI Gateway routes the call and may use Anthropic or another vision provider with equivalent terms. Suggestions are best-effort starting points — you edit anything before publishing. See Anthropic's privacy policy.
• Other users— buyers and sellers see each other's username and the other party's shipping address on paid orders. Sellers see the buyer's ship-to address only.
• HM Revenue & Customs (HMRC) — under the UK Digital Platform Reporting Rules. See section 4 below for what we report, when, and how to get a copy.
• Law enforcement and regulators — where required by law or court order.

4. UK Digital Platform Reporting (HMRC)

Simpson's Ventures Ltd is a Reporting Platform Operator under the UK Digital Platform Reporting Rules (the UK's implementation of the OECD Model Rules, in force since 1 January 2024). If you sell on Rare Kind we may have to report your activity to HMRC each year.

Who is reportable. Sellers who, in a calendar year, complete 30 or more sales OR earn £1,700 (€2,000) or morein consideration. Sellers under both thresholds aren't reported.

What we report. For each reportable seller: legal name, address, country of residence, date of birth (individuals only), tax identifier (NI or UTR for individuals; Companies House number and VAT for companies), financial account identifier (the bank account where Stripe pays you out), and four quarterly figures — your gross sales, the number of sales, and the platform fees deducted.

When. Reports are filed annually by 31 January for the prior calendar year. The first report covering 2026 is due 31 January 2027.

Your copy. You can request a copy of what we reported about you (or are about to report) at privacy@joinrarekind.co.uk.

5. International transfers

Stripe, Supabase, Resend, and Vercel process some data in the United States. Sendcloud is in the Netherlands and Sentry is in Germany (Frankfurt) — both EEA countries covered by adequacy decisions, so no additional transfer mechanism is required. Where we transfer personal data outside the UK to a country without an adequacy decision we rely on the UK International Data Transfer Agreement ("UK IDTA") or the UK Addendum to the EU Standard Contractual Clauses, as applicable, together with a transfer risk assessment conducted in line with post-Schrems II guidance from the Information Commissioner's Office. Copies of our transfer mechanisms and risk assessments are available on request.

6. How long we keep it

• Account data — for as long as your account is open, plus 30 days after closure unless legal or fraud reasons require longer.
• Transaction, contractual and financial records — 6 years from the end of the relevant tax year, to meet HMRC requirements and the limitation period under the Limitation Act 1980.
• Rate-limit logs — 24 hours.
• Stripe webhook events — 6 years, aligned with the transaction retention above.
• Audit log (admin actions on disputes, refunds, account moderation) — 6 years, as tamper-evident evidence for any subsequent claim.
• Reviews you leave or receive— kept for the lifetime of the account they relate to. Reviews about a counterparty stay on the counterparty's record so their reputation history isn't silently changed if you delete your account.
• Messages— retained for the lifetime of either participating account. Sender / recipient is shown as “[deleted user]” on the receiving side after a deletion.
• Digital Platform Reporting Rules (DAC7-equivalent) — for sellers who meet the reportable-seller threshold in a given calendar year, we retain the transaction summary required by HMRC for the period specified in the regulations (currently five years from the end of the reportable period).

7. Automated decisions

Rare Kind does not make solely automated decisions that have a legal or similarly significant effect on you. Account suspensions, review removals, and dispute outcomes are all taken by a member of our moderation team after human review, even where an automated alert drew the account to our attention (for example, unusual dispute patterns or volume triggers).

Where automated processes do run — rate limiting on auth, off-platform-payment language detection on messages (which flags a message for human moderation but doesn't block delivery), the cron that flips shipped orders to “delivered” after ten days, the auto-cancel cron at seven days for unshipped orders, and the return-flow timers — they do not result in account restrictions or other significant effects on your use of the Service, and they are rebuttable where they do affect a specific transaction (see our returns policy).

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you and obtain a copy.
• Correct inaccurate data, or complete incomplete data.
• Erase personal data where the legal basis no longer applies, subject to our overriding obligations (e.g. tax retention of transaction records).
• Restrict or object to processing.
• Receive a portable copy of data you provided to us.
• Lodge a complaint with the UK Information Commissioner's Office (ICO) — ico.org.uk. Our ICO registration number is ZC133494.

You can self-serve account deletion (which redacts personal data and disables login, with a 30-day reversibility window) at /account/delete. For the other rights above — access, correction, restriction, portability — email privacy@joinrarekind.co.uk. The same address handles deletion reversals during the 30-day window.

9. Security

We use row-level security at the database layer, TLS in transit, server-only access to service credentials, and bucketed signed uploads for images. No system is perfect; if you believe your account has been compromised, contact us at the address above.

10. Children

Rare Kind is intended for adults aged 18 and over. Stripe Connect KYC requirements and the buyer-protection / dispute-resolution flow assume the parties are 18+. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data to us, email privacy@joinrarekind.co.uk and we'll delete it.

11. Marketing

We do not currently send marketing email. If we ever do, we'll obtain your explicit opt-in consent first and provide an unsubscribe link in every message. Transactional email about your orders, payouts, and disputes — and the optional platform notifications described in section 2 — is separate from marketing and is governed by the legal bases noted there.

12. Cookies

See our Cookie policy for the specific cookies we use.

13. Changes to this policy

We may update this policy. Material changes will be notified by email or in-app notice at least 14 days in advance.

14. Contact

Privacy queries — including subject access requests, data deletion reversals, and complaints — go to privacy@joinrarekind.co.uk. The data controller is Simpson's Ventures Ltd (company number 17169404), trading as Rare Kind, registered office 61 Bridge Street, Kington, HR5 3DJ, United Kingdom.