App privacy
Last updated: 13 October 2026
This notice covers the VanStock.trade app: what we collect, why, who sees it, how long we keep it and your rights. Plain English, no small print. Our website has its own privacy page.
Who we are
VAN STOCK TRADE LTD (company no. 17464436), registered office 16 Heronsgate Trading Estate, Paycocke Road, Basildon SS14 3EU, is the data controller. We're registered with the Information Commissioner's Office (ICO) under registration number ZC253854.
Questions or requests: [email protected].
What we collect and why
| When | What | Why | Lawful basis |
|---|---|---|---|
| You sign up | Name, business name, mobile number, email, account type, business-use confirmation, referral code | To create and run your account and confirm it's a business account | Contract |
| We text you a code | Mobile number, the code, whether it was checked | To confirm the number is yours and stop fake accounts | Legitimate interest (preventing fraud) |
| You use the app | Your location when you open the app or tap "Use current location"; your home or depot postcode; for shops, address and opening hours | To send requests to people nearby and show distance on offers | Contract |
| You post a request | Part description, photo, category, area | To show it to nearby responders | Contract |
| You add a part photo | The photo and your description | To suggest a category for the part (you can change it) | Legitimate interest (making posting quicker) |
| You make or accept an offer | Price, offer details, timings, collection point | To match buyer and seller | Contract |
| An offer is confirmed | Both phone numbers, shared with the other party only | So you can arrange collection | Contract |
| You pay or get paid | Payment and payout details (held by Stripe; we see card type, last 4 digits and payout status), amounts, fees, VAT | To take payment, hold sellers' money until their payout set-up is complete (up to 60 days), and pay sellers | Contract; legal obligation (tax and accounting records) |
| You set up to sell | Business type, legal name, address; company number, or NI number + date of birth + home address (sole traders), or partnership UTR | To meet our legal duty to report sellers' sales to HMRC | Legal obligation |
| Stripe checks a seller | Stripe's verification result, verified name, date of birth and address | To check seller details match | Legitimate interest (preventing fraud); legal obligation |
| You report, or are reported | Report reason, notes, related request | To keep users safe and enforce the terms | Legitimate interest |
| Strikes and account actions | Expired payment holds, no-shows, cancellations, strikes, suspensions | To enforce the rule that matched collections are paid in the app | Legitimate interest |
| Notifications | Device push token, notification settings, quiet hours | To send request and payment alerts | Contract |
| You use the app (technical) | Device type, app version, error logs, event log of actions | To keep the app working and secure, and measure the pilot | Legitimate interest |
| Marketing (only if you tick the box) | Email, mobile | Launch news and offers by email or text | Consent (withdraw any time) |
Location. We take your location once when you open the app, bring it back to the screen, or tap "Use current location". We don't track you in the background or while the app is closed, and we keep only your latest location. Other users see your area blurred to about 500m until an offer is confirmed. You can refuse location access; the app then uses your home or depot postcode.
Part photos. When you add a photo, it and your description may be sent to an AI provider to suggest a part category. We remove location data from the photo first, send no account details, and only use providers that don't keep the data or train on it.
Reports about suspected crime. A report may suggest someone has committed an offence (for example, selling stolen goods). We only record what's needed to act on it, restrict who can see it, and may share it with the police.
Decisions about you. Some steps are automatic (a reminder or lower ranking after an unpaid matched collection). Suspensions and closures are always decided by a person. You can ask us to review any decision.
Who else sees it
Other users see your name or business name, area (blurred), offers and requests. Your phone number is shown only to the other party in a confirmed offer, until the request closes.
Suppliers process data only on our instructions:
| Supplier | What for | Where |
|---|---|---|
| Supabase | App database, login and file storage | UK (London) |
| Stripe | Payments, payouts, seller identity checks | UK / EU / USA |
| Twilio Inc. | Delivering login codes by text | USA |
| Expo (650 Industries), Apple, Google | Push notifications | USA |
| OpenRouter and the AI provider it routes to | Suggesting a part category from a photo | USA |
| Brevo (Sendinblue SAS) | Account and marketing emails | EU (France) |
| Resend | Alert emails to our own team | USA |
| Google (Workspace, Looker Studio) | Our email and pilot reporting | USA / EU |
| Synergetx LLC | Building and supporting the app | USA |
HMRC receives sellers' tax details and sales totals each year, as the law requires. The police or other authorities may receive information where the law allows or requires it, for example about suspected stolen goods.
We don't sell your data or use it for advertising profiles. Where data goes outside the UK it's protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Addendum.
How long we keep it
| Data | Kept for |
|---|---|
| Account details | While your account is open, then deleted within 30 days of closure (except below) |
| Requests, offers, photos, collection records | 24 months after the request closes, then anonymised |
| Latest location | Overwritten each time; deleted with your account |
| Payment and transaction records | 6 years (tax and accounting law) |
| Seller tax details and HMRC reports | 5 years after each reporting year |
| Reports, strikes, suspensions | 2 years after the last related event |
| Marketing consent | Until you opt out, plus proof of consent or opt-out |
Keeping it safe
Data is encrypted in transit and at rest. NI numbers and dates of birth are stored with extra encryption and only the admin role can see them. Admin accounts use two-factor login and every admin action is logged.
Your rights
You can ask us to see, correct, delete or hand over your data, to restrict or object to how we use it, and to review an automatic decision. Where we rely on consent, you can withdraw it at any time. Delete your account in the app, or email [email protected]. We'll reply within one month. Some records must be kept by law even after deletion (see above).
If you're unhappy, you can complain to the ICO at ico.org.uk or on 0303 123 1113. We'd like the chance to sort it first.
Age and changes
The app is for businesses and people aged 18 or over. If we change this notice in a way that matters, we'll tell you in the app or by email.