Privacy Policy
Last updated: May 2026
1. Information We Collect
We collect information you provide directly (name, email, payment details), information generated through your use of the Platform (purchase history, usage analytics, page views), and technical information (browser type, IP address, cookies).
2. How We Use Your Information
We use your information to: process transactions and deliver Products; send transactional emails (order confirmations, seller notifications); improve and personalise your experience; prevent fraud and abuse; comply with legal obligations.
3. Payment Processing
Payments are processed by Stripe. We do not store your card details. Stripe's privacy policy applies to payment data. For sellers, Stripe Connect processes payouts and handles identity verification.
4. Data Sharing
We do not sell your personal data. We share data with: Stripe (payment processing); Supabase (database hosting); Resend (email delivery); Anthropic (AI features — only product descriptions, no personal data). All third parties are bound by data processing agreements.
5. AI Features
Some features use Claude (by Anthropic) to process product descriptions and search queries. We do not send personal identifiable information to AI services. AI-generated content is reviewed before being shown publicly.
6. Cookies
We use essential cookies for authentication and session management. We do not use advertising cookies. You can control cookies through your browser settings, though disabling essential cookies will prevent you from logging in.
7. Data Retention
We retain your account data for as long as your account is active. Order and transaction records are retained for 7 years for tax and legal compliance. You may request deletion of your account by contacting us.
8. Your Rights (UK GDPR)
You have the right to: access your personal data; rectify inaccurate data; request deletion (where legally permitted); object to processing; data portability. To exercise these rights, contact privacy@braehq.co.
9. Security
We use industry-standard security measures including TLS encryption, secure authentication via Supabase Auth, and row-level security on all database tables. We regularly review our security practices.
10. Contact
Data controller: Brae Group, Scotland, UK. For privacy queries: privacy@braehq.co. You have the right to lodge a complaint with the ICO (Information Commissioner's Office) if you believe we have mishandled your data.
Questions? Contact us at privacy@braehq.co