Privacy Policy
1. Introduction
This Privacy Policy explains how vBuy Ltd (“vBuy”, “we”, “us”, “our”) collects, uses, stores, and protects your personal data when you use the vBuy marketplace platform (“Platform”) at vbuy.io.
We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
Data Controller: vBuy Ltd
Contact: privacy@vbuy.io
Last updated: 24 October 2026
2. Data We Collect
2.1 Information You Provide
| Data Category | Examples | When Collected |
|---|---|---|
| Account details | Name, email address, phone number, password | Registration |
| Delivery address | Shipping address(es) | Checkout |
| Payment information | Card details (processed by Stripe — we never see your full card number) | Checkout |
| Communications | Messages to Sellers, refund requests, dispute evidence | Platform use |
2.2 Information We Generate
| Data Category | Examples | Purpose |
|---|---|---|
| v£ wallet data | v£ balance, transaction history, pending rewards | Reward system operation |
| Order history | Products purchased, order totals, Seller details | Order management |
| Internal identifiers | Unique user ID (UUID) | Account identification |
2.3 Information Collected Automatically
| Data Category | Examples | Purpose |
|---|---|---|
| Device & browser data | IP address, browser type, operating system, screen resolution | Security, analytics |
| Usage data | Pages visited, products viewed, time on site | Platform improvement |
| Cookies | Session cookies, preference cookies, analytics cookies | See Section 9 |
2.4 Live Shows
When you watch, chat or buy in a live show, we also process the data below. Other viewers see your nickname and your chat messages; the shop sees your nickname next to what you buy, and your name and delivery address on its order, as for any order. Viewers are never filmed.
| Data Category | Examples | When Collected |
|---|---|---|
| Nickname | The name you chat under (never your real name) | When you first chat, or buy in a show |
| Chat messages | What you write in a show’s chat, and when | When you chat |
| Reports and moderation | Messages you report (reason, note), reports about your messages, time-outs and bans, helper invitations | When you or others report a message, or a shop, helper or vBuy moderates the chat |
| Show recordings | The shop’s video and sound during the show, including anyone the shop shows on camera | Every show |
| Show purchases | The item, the show, the moment it was on screen, whether it was bought by one tap | When you buy in a show |
| Saved cards | Card type, last 4 digits, expiry date and Stripe’s reference to the card (never the full card number), when you agreed and to which wording | When you tick “Save this card” |
| One-tap setting | On or off, your limit per show, when you switched it on and to which wording | When you switch one-tap buying on |
| Connection data | Your IP address, kept in coded form for up to an hour to limit how often a device can join a show | When you open a show |
3. How We Use Your Data
| Purpose | Lawful Basis (UK GDPR) |
|---|---|
| Creating and managing your account | Performance of contract (Art. 6(1)(b)) |
| Processing orders and payments | Performance of contract (Art. 6(1)(b)) |
| Operating the v£ reward system | Performance of contract (Art. 6(1)(b)) |
| Communicating order updates and refund status | Performance of contract (Art. 6(1)(b)) |
| Sending marketing emails (only with your opt-in) | Consent (Art. 6(1)(a)) |
| Fraud prevention and platform security | Legitimate interest (Art. 6(1)(f)) |
| Improving the Platform and user experience | Legitimate interest (Art. 6(1)(f)) |
| Running live shows: chat, nicknames, purchases, saved cards and one-tap buying at your request | Performance of contract (Art. 6(1)(b)) |
| Moderating live chat, handling reports, and keeping show recordings and chat messages for disputes and safety | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal and tax obligations | Legal obligation (Art. 6(1)(c)) |
4. Who We Share Your Data With
We share your personal data only where necessary and with appropriate safeguards:
4.1 Third-Party Sellers
When you place an order, the relevant Seller(s) receive your name, delivery address, and order details to fulfil your purchase. Sellers are independent data controllers for the data they receive. Sellers do not receive your payment details, email address, or v£ wallet information.
4.2 Payment Processors
Stripe processes all card payments. Your payment card details are sent directly to Stripe and are never stored on our servers. Stripe’s privacy policy applies to their processing of your data.
If you save a card for live shows, Stripe keeps the card and your email address and name for it, and we keep only the card type, the last 4 digits, the expiry date and Stripe’s reference. When you remove a saved card or delete your account, the card is removed from Stripe; Stripe keeps its own records of past payments under its policy.
4.3 Service Providers
| Provider | Purpose | Data Shared |
|---|---|---|
| Google Cloud Platform | Hosting & infrastructure | All Platform data (encrypted at rest) |
| Amazon Web Services (Ireland) | Live show video, chat delivery and show recordings | Show video and sound, chat messages and nicknames as they are sent, a random or account-based viewer reference |
| Resend / SendGrid | Transactional email delivery | Email address, name, order references |
4.4 Legal & Regulatory
We may disclose your data to law enforcement, regulators, or courts when required by law or to protect the rights, property, or safety of vBuy, our users, or the public.
5. Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Account data | Duration of account + 2 years after deletion | Dispute resolution, legal claims |
| Order & transaction data | 7 years from order date | HMRC tax record requirements |
| v£ wallet transactions | 7 years | Financial record keeping |
| Marketing preferences | Until consent is withdrawn | Consent-based |
| Server logs | 90 days | Security monitoring |
| Live show recordings | 180 days after the show, then deleted, unless kept longer for a dispute, an investigation or a legal requirement | Disputes about what was shown or said, investigations, legal requests |
| Live chat messages | 180 days. If you delete your account, your messages stay until then, shown as “Deleted account” with no link to you | Disputes, safety, legal claims |
| Live chat reports | 180 days | Moderation, safety |
| Time-outs and bans | Until they end or are lifted; when you delete your account they end and are no longer linked to an account | Moderation, safety |
| Nickname, saved cards and one-tap setting | Until you remove a card or switch one-tap off, or delete your account (earlier chat messages keep the nickname shown at the time, for 180 days) | Running live shows |
6. Your Rights
Under the UK GDPR, you have the following rights:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — request correction of inaccurate or incomplete data.
- Right to erasure — request deletion of your data (subject to legal retention requirements).
- Right to restrict processing — request that we limit how we use your data.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests or for direct marketing.
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, contact us at privacy@vbuy.io. We will respond within 30 days.
7. International Transfers
Your data is stored on servers within the United Kingdom and European Economic Area (Google Cloud Platform, europe-west2 region, London). Where any data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses or adequacy decisions.
Live show video, chat and recordings are handled by Amazon Web Services in Ireland (European Union), which the UK recognises as providing adequate protection for personal data.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of data in transit (TLS/SSL) and at rest.
- Payment card data handled exclusively by PCI DSS-compliant processors (Stripe).
- Access controls limiting employee access to personal data on a need-to-know basis.
- Regular security reviews and monitoring.
No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
9. Cookies
9.1 What Are Cookies?
Cookies are small text files placed on your device when you visit the Platform. They help us provide a better experience and understand how you use the site.
9.2 Cookies We Use
| Cookie Type | Purpose | Duration | Lawful Basis |
|---|---|---|---|
| Essential | Session management, login state, shopping cart, CSRF protection | Session / up to 2 weeks | Strictly necessary — no consent required |
| Functional | Remember your preferences (e.g. currency display, recently viewed) | Up to 1 year | Legitimate interest |
| Analytics | Understand how visitors use the Platform (page views, popular products) | Up to 2 years | Consent |
9.3 Third-Party Cookies
Our payment processor (Stripe) may set cookies for fraud detection. These are governed by Stripe’s own cookie policy.
9.4 Managing Cookies
You can control cookies through your browser settings. Most browsers allow you to:
- View and delete individual cookies.
- Block cookies from specific or all websites.
- Set preferences for first-party and third-party cookies.
Please note that disabling essential cookies may prevent you from using core features of the Platform, such as your shopping cart and checkout.
10. Children’s Data
The Platform is not intended for children under 16. We do not knowingly collect personal data from anyone under 16. If we discover that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at privacy@vbuy.io.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice on the Platform. The “Last updated” date at the top of this policy indicates when it was last revised.
12. Complaints
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Phone: 0303 123 1113
13. Contact Us
For any privacy-related queries:
- Email: privacy@vbuy.io
- Website: vbuy.io/contact