This notice explains what personal data ThreadQuarters collects, why, and what you can do about it. It is written to be read, not to be survived — if anything is unclear, email info@threadquarters.net and I'll explain it.
Who is responsible for your data
ThreadQuarters is a trading name of Alex Clark, based in the United Kingdom. I am the data controller for the personal data described here. A UK limited company is currently being incorporated and will take over as controller on registration; its name, registration number and registered office will be published here at that point, and account holders will be told.
Postal address: available on request (info@threadquarters.net).
Contact: info@threadquarters.net.
ICO registration: in progress.
What I collect
| Data | Where it comes from |
|---|---|
| Name and email address | You, when you apply to test or create an account |
| Account details and settings | You, when you use the service |
| Photographs of items you are selling | You, when you upload them |
| Listing titles, descriptions, prices, stock records and sales history | You, or imported from a file you provide |
| Technical data — IP address, browser type, pages visited, error logs | Automatically, when you use the site |
| Messages you send me | You |
I do not ask for, receive or store your Vinted, Depop or eBay password. There is no field for one anywhere in the service.
If your uploaded photographs or imported records happen to contain other people's personal data — a buyer's name on a despatch note, for example — that data is processed only as part of storing your records, and you remain responsible for what you upload.
Why I use it, and my lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the service: storing your stock, generating listing drafts, showing your statistics | Performance of a contract with you |
| Contacting you about testing, support and service changes | Performance of a contract, or legitimate interests in running the service |
| Emailing you about ThreadQuarters when you are not yet a user | Your consent, which you can withdraw at any time |
| Keeping the service secure, investigating misuse, fixing faults | Legitimate interests in protecting the service and its users |
| Keeping business and tax records | Legal obligation |
Artificial intelligence
To draft listing titles and descriptions, the photographs and text you provide are sent to OpenAI, which operates the AI models ThreadQuarters uses. This happens only when you ask for a draft.
OpenAI processes this data on my instructions as a processor under a data processing agreement. Under OpenAI's API terms, content submitted through the API is not used to train their models, and is retained only for a limited period for abuse monitoring before deletion. Inputs sent via the API are held by OpenAI for up to 30 days for abuse monitoring, then deleted.
Generated listing text is a suggestion. You review and publish it yourself, and you remain responsible for the accuracy of anything you post to a marketplace.
Who else handles your data
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, databases, file storage | eu-west-2 (London) |
| OpenAI | Generating listing drafts | United States |
| Amazon SES | Sending service and support email | eu-west-2 (London) |
I will tell users before adding a new provider that handles their data. I do not sell your data, and I do not share it with advertisers.
Your sold prices and sales history are used only to serve your own account. They are not pooled with other users' data.
Data leaving the UK
OpenAI processes data in the United States. That transfer is covered by the UK International Data Transfer Addendum (IDTA) to the EU Standard Contractual Clauses in the data processing agreement with them, which provides the safeguards UK law requires. You can ask me for a copy of the mechanism relied on.
How long I keep it
- Account data, listings and photographs: while your account is open, then deleted within 30 days of closure.
- Tester applications that don't proceed: 12 months.
- Technical and security logs: 90 days.
- Records needed for tax: six years, as UK law requires.
Your rights
Under UK data protection law you can ask me to: give you a copy of your data; correct it if it's wrong; delete it; restrict or object to how I use it; send it to you or another provider in a portable format; and withdraw consent where consent is what I relied on.
Email info@threadquarters.net and I'll respond within one month. There's no charge.
You can export your data yourself at any time from your account settings, and delete your account without asking me.
If you think I've handled your data badly, please tell me first so I can fix it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Cookies
ThreadQuarters uses only strictly necessary cookies (to sign you in and keep you logged in). We set no analytics, advertising or tracking cookies, so there is no cookie banner.
Security
Data is encrypted in transit and at rest, access is limited, and backups are held securely. There's more detail on the security page. If a breach happens that puts your rights at risk, I'll tell you and the ICO as the law requires.
Children
ThreadQuarters is for people aged 18 or over. I don't knowingly collect data from anyone younger.
Changes
If this notice changes materially I'll email account holders before it takes effect. The date at the top always shows the current version.