Privacy Policy

This policy explains what personal data Graby collects, why we collect it, who we share it with, and the rights you have. Graby is the data controller for the personal data described here.

Data we collect

• Account data: your email address and, if you sign up with a password, a password (stored securely and hashed by our authentication provider, never in plain text). If you sign in with Google, we receive your email and a Google account identifier.
• Subscription data: your plan, search allowance, and billing status. Payments are handled by Stripe; we do not see or store your card details.
• Preferences: shopping preferences you choose to give us, such as department, buying intent, and clothing or shoe sizes.
• Search activity: the search terms you enter, stored with your account, so we can enforce your allowance, improve results, and understand what people look for.
• Activity and saved items: items you mark as purchased or made offers on, and any price alerts you set.
• Referral data: a referral code, if you were referred or refer someone.
• Community requests: if you ask to join our WhatsApp group, the email, phone number, and reason you provide.
• Usage and analytics: how you interact with the Service (for example pages viewed, searches run, upgrades clicked), collected through our analytics provider and linked to your account.
• Technical data: your IP address is processed to protect the Service (for example rate-limiting and abuse prevention). We do not store your IP address in our database or use it to locate you.

How we use your data, and our legal bases

• To provide the Service (create your account, run searches, apply your plan) — legal basis: performance of our contract with you.
• To take payment and manage subscriptions — performance of contract.
• To secure and improve the Service (rate-limiting, preventing abuse, fixing bugs, understanding usage) — our legitimate interests in running a reliable, safe product.
• To personalise results using the preferences you give us — performance of contract and your consent where relevant.
• To send you service messages (for example verification, billing, and price alerts you set up) — performance of contract.
• To send marketing (updates, tips, community invites) — your consent, which you can withdraw at any time.
• To meet legal obligations (for example accounting) — compliance with a legal obligation.

Who we share it with

We do not sell your personal data. We share it only with the service providers that help us run Graby, each acting under a contract that requires them to protect it:

• Supabase — our database and authentication provider, hosted in the European Union, which stores your account, preferences, search history, and saved activity.
• Stripe — payment processing. Stripe collects and holds your payment details directly; we only receive your subscription status and the email associated with the payment.
• Resend — sends our transactional and alert emails to you.
• PostHog — product analytics, hosted in the European Union, which records how you use the Service linked to your account email.
• Google — only if you choose to sign in with Google, as the identity provider.
• Vercel — our hosting provider, which processes requests to run the site.

Some processing services we use for authenticity scoring and search infrastructure (for example our AI and scraping providers) receive only marketplace listing data, not your personal data.

International transfers

Our database and our analytics provider are both hosted in the European Union. Some other providers we use may process limited data outside the UK or EEA. Where that happens, we rely on appropriate safeguards such as the provider's UK adequacy status or standard contractual clauses.

How long we keep it

We keep your account data for as long as your account is open. If you close your account, we delete or anonymise your personal data unless we need to keep some of it to meet a legal obligation (for example billing and tax records) or to resolve disputes. Analytics and search history are kept while your account is active and then removed or aggregated.

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted ("right to erasure");
• restrict or object to certain processing;
• receive a copy of your data in a portable format;
• withdraw consent (for example to marketing) at any time.

To exercise any of these, email layne@graby.ai. We will respond within one month. You can also close your account or request deletion at any time. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk).

Marketing and unsubscribing

We only send marketing emails if you have opted in. Every marketing email includes an unsubscribe link, and you can withdraw consent at any time by using it or by emailing us. Withdrawing marketing consent does not stop essential service messages such as billing or security notices.

Cookies

We use cookies and similar technologies as described in our Cookie Policy.

Children

Graby is not intended for anyone under 18, and we do not knowingly collect data from people under 18. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will change the "last updated" date and, for significant changes, tell you directly.

Contact

For any privacy question or request, email layne@graby.ai.