How Set Trader uses your data

1. Who we are

Set Trader is run by [Company name] Ltd (company number [company number]), [registered office address]. We are the controller of your personal data and are registered with the Information Commissioner's Office under number [ICO registration number].

For anything about your data, email hello@settrader.co.uk or use our contact form. We reply within one month.

2. What we collect

We don't collect special category data, and we don't use advertising or analytics trackers.

3. Why we use it and our legal basis

We only send the newsletter if you ask for it and confirm by email. Automatic screening deletes content that clearly breaks the community rules (for example swearing, sexual content or sharing contact details), tells you why, and logs it for our team; three automatic removals in 30 days suspends community access until a person reviews it. This only affects what you can post in the community, not your account, purchases or sales, and you can ask a person to review any decision through the contact form.

4. Who we share it with

We don't sell your data. We share it only with these service providers, who process it for us under written data processing agreements, and with the other party to your order.

Set photos in the catalogue are loaded from Rebrickable's image servers, so your browser's IP address is visible to them when you view a set. No other personal data is shared with Rebrickable.

5. International transfers

Some of our providers are based in the United States. Where your data leaves the UK, it's protected by the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Email hello@settrader.co.uk for a copy of the safeguards.

6. How long we keep it

Deletion runs automatically every night.

7. Cookies

We use one cookie, and it's strictly necessary, so we don't need to ask for consent and there's no cookie banner.

The on-site assistant keeps your current conversation in your browser's session storage so it survives page changes; it's cleared when you close the tab and is never sent to us except as your next question. No analytics, advertising or social media cookies. When you pay, you're taken to Stripe's checkout page, which sets its own cookies for fraud prevention under Stripe's privacy policy. Our fonts are served from our own domain, so no data goes to Google when you visit.

8. Your rights

• Access and portability. Download everything we hold about you, including your posts and community activity, from Account → Your data and privacy, in a machine-readable file, at any time.
• Withdraw consent. Unsubscribe from the newsletter from any issue or your Account page.
• Control what's public. Make any set in your collection private, delete posts and comments, and block other members.
• Erasure. Delete your account from the same page. We erase what we can straight away and keep only what the law requires (section 6).
• Rectification. Correct your details on your Account page, or email us.
• Restriction and objection. Ask us to stop or limit how we use your data, including anything based on legitimate interests.

For anything you can't do yourself, email hello@settrader.co.uk. We'll respond within one month and won't charge you.

9. Security

All traffic is encrypted (HTTPS with HSTS). Passwords are hashed and never stored in readable form. Seller tax references are encrypted in the database. Sign-in attempts are rate-limited, and admin actions are logged. Card details never reach our servers.

If we have a data breach that risks your rights, we'll tell the ICO within 72 hours and tell you without undue delay.

Found a security issue? Email hello@settrader.co.uk or use the contact form. Our security.txt has the details. Please don't access other people's data while testing.

10. AI features

We use Anthropic's Claude models for four things. Under Anthropic's commercial terms, what we send isn't used to train its models; Anthropic may keep it for a short period for safety and abuse monitoring.

• Snap a set. Your photo is shrunk on your device and sent to identify the set. We don't store it. The result is only a suggestion. Avoid including people, documents or addresses in the photo.
• The assistant. Your question and the conversation so far are sent so it can answer. If you're signed in, it can look up your own orders, offers, listings and collection to answer questions about them. We don't store the conversation. Don't share card details or passwords in the chat.
• Screening community content. New posts, comments, bios, groups, listing descriptions and every uploaded photo are checked. Content that clearly breaks the rules is deleted automatically and logged for our team; off-topic content is flagged to our team; if the check can't run, content waits for a person.
• Newsletter drafts. The monthly newsletter is drafted from public site data (listings, prices and popular public posts with display names). A person reviews it before it's sent.

Photos you upload are re-encoded on your device before upload, which removes location and camera data.

11. Children, changes and complaints

You must be 16 or over to create an account, and 18 or over to sell. For members aged 16 and 17 we follow the ICO's Age Appropriate Design Code: their collections start private, they're never suggested to other members to follow, their profiles aren't shown to search engines, and we don't profile them for marketing. We don't knowingly collect data from anyone under 16; if we find an account belongs to someone under 16 we delete it.

If we change this notice materially, we'll tell you by email or on the site before the change takes effect.

If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.