DRAFT — for internal visual review only. Not yet in effect. Pending legal review.
Home › Privacy Policy

Privacy Policy

Your data, in plain English. This policy explains what information ReGraded collects when you use our website or sign up for a demo, what we do with it, and your privacy rights.

Data retention (draft)

We keep personal data only as long as we need it:

  • Completed trade-ins & customer accounts — 6 years after your last transaction (UK tax / record-keeping).
  • Walk-ins that never completed — 90 days.
  • Email / notification logs — 90 days.
  • Support tickets & attachments — 2 years after the ticket is resolved.
  • Short-lived security data (one-time codes, password-reset links, expired sessions) — removed as soon as they are no longer usable.

Your right to erasure (draft)

You can ask us to delete your personal data. We action verified requests within one month. Where we are legally required to keep certain financial records, we anonymise the personal details and retain only the financial skeleton — see below.

Financial-records exemption — applicable data protection law (draft)

We are legally required to keep certain payment records for up to 7 years (the Payment Services Regulations 2017, HMRC record-keeping, and to defend potential legal claims). For those records we erase or mask the personal identifiers (name, contact details, full bank / PayPal details) but retain the minimum financial skeleton — transaction reference, amount, date and a masked payment destination — under the Article 17(3) exemption. A "delete my data" request therefore cannot remove those specific financial-audit entries.

Who we share data with — sub-processors (draft)

We use trusted providers to deliver the service: payment providers (Stripe, PayPal, Revolut), shipping (the carrier), device checking (CheckMEND), address lookup (address verification), email delivery, and analytics (Google). Each receives only the data needed for its purpose, under a data-processing agreement.

Email residue (draft)

Confirmation and notification emails we send leave a copy in our outbound email provider's systems. When you ask us to erase your data we remove it from our platform; copies held by the email provider are purged separately according to that provider's own retention settings.

How to make a data request (draft)

Email info@regraded.io with "Data request" in the subject. We may ask you to verify your identity before we act.

Last updated: 26 May 2026

Who we are

Regraded Ltd ("ReGraded", "we", "us") is the data controller for personal data processed through regraded.io and the ReGraded platform. We are a company registered in England & Wales, company number 17241185. You can reach us at info@regraded.io.

ReGraded is a business-to-business (B2B) platform: we provide trade-in management software to business customers ("Operators"). This policy covers the personal data we process as a controller — primarily about visitors to our website and the staff of our Operator customers. Where an Operator uses the platform to process data about their own end customers, the Operator is the controller of that data and ReGraded acts as a processor on their behalf.

What data we collect

  • Account information — name, business name, email address and login credentials for Operator users.
  • Contact details — information you give us when you request a demo, complete a contact form, or email us.
  • Usage data — how you interact with the website and platform, including pages viewed and actions taken.
  • Cookies and analytics — see our Cookie Policy. We use Google Analytics to understand site usage.
  • Technical data — IP address, browser type and device information, collected automatically by our servers and analytics.

Why we collect it

  • To provide, operate and maintain the platform and your account.
  • To respond to enquiries and provide support.
  • To send service-related communications.
  • To improve and develop the platform.
  • To keep the platform secure and prevent abuse.

Legal basis for processing

  • Performance of a contract — to provide the service you have signed up for.
  • Legitimate interests — to operate, secure and improve our business and platform, where those interests are not overridden by your rights.
  • Consent — for non-essential cookies and analytics, which you can withdraw at any time.
  • Legal obligation — where we must process data to comply with the law.

How we store and protect data

Sensitive data is encrypted at rest. Each Operator's data is isolated from every other Operator's data. Our infrastructure is hosted within the UK/EU, access is restricted to authorised personnel, and we apply appropriate technical and organisational safeguards.

Data retention

We keep personal data only for as long as necessary for the purposes above. Account data is retained for the life of the account and for a reasonable period afterwards to meet legal and accounting obligations. Enquiry and contact-form data is kept for up to 24 months. After an Operator terminates, their data is available for export for 30 days and is then deleted.

Third-party processors

We use a small number of trusted providers to deliver the service, each bound by data-processing terms:

  • Google Analytics — website usage analytics.
  • Stripe — payment processing.
  • Mailgun — transactional email delivery.
  • the carrier — shipping labels and tracking.
  • Our hosting provider — UK/EU-based infrastructure.

Data sharing

We never sell your personal data. We only share data with the processors above to deliver the service, or where we are required to by law.

International transfers

We aim to keep data within the UK and EU. Where a processor transfers data outside the UK/EU, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.

Your rights

You have the right to access, correct, delete, restrict and port your personal data, and to object to processing. To exercise these rights, email info@regraded.io. You also have the right to lodge a complaint with the applicable regulatory authority in your state.

ICO registration

Our registration with the Information Commissioner's Office is pending.

Changes to this policy

We may update this policy from time to time. Changes will be posted here with a revised "last updated" date.

Contact

For any privacy question, or to exercise your rights, email info@regraded.io.