RaffleX Marketplace
Log in
RaffleX Marketplace
Toggle sidebar

Privacy Policy

Version 2026-07-19

Pending professional review
This document is a working draft prepared by Rafflex and has not yet been reviewed by a solicitor. It states our intended position in plain English and may change following professional review.

This policy explains what personal data the Rafflex community marketplace processes, why, and what your rights are.

Who controls your data

The controller of personal data processed on this platform is:

Rafflex (company details pending), registered in Northern Ireland under company number pending.
Registered office: Registered office address pending.
Contact: [email protected].

What we process

  • Account and profile data. There is no separate registration or password. Each time you open the marketplace from your Rafflex admin, rafflex.io passes us your name, email address, and role on your site (owner or admin), your Rafflex tenant and user identifiers, and your site's name, website address, and logo. We use them to recognise your account and keep these details up to date. If you publish as a creator, your public profile (username, bio, avatar) is processed too.
  • Content and submissions. Assets you upload, versions, reviews, comments, questions, and bug reports.
  • Purchase and sales records. What was bought and sold, when, for how much, and the commission split.
  • Wallet transactions. Credits, holds, confirmations, and clawbacks in the marketplace wallet.
  • Payment references. Your Stripe customer reference. We never see or store your card details; Stripe holds those.
  • Delivery and usage records. Installations, updates, and page views of assets.
  • Legal acceptances. Which versions of our legal documents you accepted and when, and per purchase, your consent to immediate supply.
  • Support correspondence. Emails you send us.
  • Connected AI apps. If you connect an AI assistant or another app to your account, the apps you connected, the permissions you granted each one, when each was last used, and an audit trail of every change it makes (the app, the action, the product, the outcome, and a fingerprint of what it sent, not the content itself).

Why we process it (lawful bases)

  • Performing our contract with you: running your account, delivering assets, processing purchases and sales, operating the wallet.
  • Our legitimate interests: securing the platform, moderating content, preventing fraud and abuse, and improving the marketplace. We balance these interests against your rights.
  • Legal obligation: keeping tax and accounting records of sales, and recording legal acceptances.

Who receives it

  • Stripe, which processes payments.
  • Our hosting infrastructure providers, which store the platform's data.
  • rafflex.io, the connected platform your account arrives from, which receives what is needed to link your community account to your tenancy.
  • The AI provider you choose, if you connect an AI app to your account. The app can read your products, their listings, templates, media, versions, and review decisions, and the bug reports and questions buyers left on your products (without the names or contact details of the buyers who wrote them). Whatever it reads goes to that app's provider, under the provider's own terms and privacy policy. You choose the provider, and we send nothing to any AI provider unless you connect an app. You can disconnect an app at any time from Connected apps in your account settings.

We do not sell personal data.

How long we keep it

  • Account and profile data: for the life of your account, then deleted or anonymised within 12 months.
  • Content: for as long as it is published, plus what moderation and legal defence reasonably require.
  • Sales, wallet, and tax records: 6 years after the tax year they relate to, as UK law requires.
  • Legal acceptances and waiver consents: as long as the contract they evidence could be disputed.
  • Support correspondence: up to 2 years after the matter closes.
  • Audit trail of connected app actions: 90 days, then deleted automatically.

International transfers

We aim to keep data in the UK or the European Economic Area. If a processor requires a transfer elsewhere, we rely on UK-approved safeguards such as the UK Addendum to the EU Standard Contractual Clauses.

Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, and to data portability, in each case as UK GDPR provides. To exercise any of them, email [email protected]. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you think we have handled your data unlawfully.

Cookies

The platform uses essential cookies only: the session cookies that sign you in and keep the site working, and a cookie that remembers which Rafflex site you came from, so we can send you back to the right Rafflex admin to sign in again. That cookie holds your site's name and admin address, and does not sign you in. We set no analytics, advertising, or other non-essential cookies, which is why there is no cookie banner. If that ever changes, this policy and our consent approach will change first.

Contact

Privacy questions: [email protected].