Privacy Policy
How Your Shop Local collects, uses, shares and protects personal information.
1. Controller and contact
Your Shop Local is operated by Grzegorz Wojtowicz, sole trader, trading as Your Shop Local. Grzegorz Wojtowicz is the controller responsible for personal data used to run the Service.
Service name: Your Shop Local
Legal operator: Grzegorz Wojtowicz
Legal status: Sole trader
Trading as: Your Shop Local
Business / geographic service address: 37 Browning Close, Blacon, Chester, CH1 5XD, United Kingdom
Email: graffcraft@outlook.com
ICO data protection fee status: Pre-launch — ICO self-assessment completed; fee not due yet. Reassess when trading starts.
For privacy questions, data-rights requests or a data-protection complaint, email graffcraft@outlook.com. Please include enough information for us to understand the issue, but do not send unnecessary identity documents or sensitive information.
The operator and contact details above are the current privacy contact details for the Service.
2. Personal data we collect
- Account and verification data: first name or nickname, UK mobile number, Firebase Authentication user identifier (UID), phone-verification status and related authentication/security data.
- SELL advert data: item title, description, category, condition, price/free status, area, collection/delivery preference, photos, advert status, timestamps and acceptance records.
- Wanted data: what a person is looking for, optional budget, area, nickname, verified account identifier, status, timestamps and matching information.
- Moderation and reporting data: public listing reports, report reason/details, listing ID, moderation decisions, rejection/removal reasons and action history.
- AI-assisted processing data: advert photos and relevant advert information submitted for photo analysis, description/category/price assistance and safety screening. AI output is assistance; users can edit advert content and public approval remains subject to human/admin control.
- Service activity data: records used for owner/admin counters, recent activity, possible matches and verified-presence information used for the “Live now” operational view.
- Technical and security data: device/browser and network information, IP address and logs generated by Firebase/Google Cloud, authentication, App Check/reCAPTCHA and hosting/security systems.
- Local-device technical data: limited operational cache, authentication/security state and technical markers as described in the Cookie & Local Storage Policy. YSL does not keep a separate convenience profile containing your nickname, phone and delivery preference.
- Business seller details: if you choose Business seller, we collect the legal trader/business name, optional trading name, business email, geographic business/service address and optional VAT number. These details are intended to be shown publicly with the business listing so buyers can identify and contact the trader.
3. Why we use data and lawful bases
| Processing | Purpose | Lawful basis |
|---|---|---|
| SELL, Wanted, nickname and contact features | Provide the marketplace features the user asks us to provide, including publishing/managing a post and enabling buyer/seller contact. | Contract — processing necessary to provide the requested service under the Terms. |
| Phone verification and account identifiers | Verify control of the contact number needed for account/listing functions and reduce impersonation or misuse. | Contract for verification needed to provide the requested account/listing service; Legitimate interests for proportionate anti-abuse and service-security controls. |
| Possible Matches | Compare live SELL and Wanted information to provide the matching feature requested as part of the Service. | Contract. |
| Business seller details | Identify a self-declared trader to buyers and support transparent, safer marketplace contact. | Contract for publishing the business listing as requested; Legitimate interests in marketplace transparency and reducing misleading trader presentation. A specific legal-obligation basis is used only where a UK legal duty actually requires the processing. |
| AI safety screening, Owner moderation, reports, abuse/fraud prevention and service integrity | Prevent prohibited or unsafe content, investigate concerns, enforce rules and protect users and the Service. | Legitimate interests in operating a safe, trustworthy and abuse-resistant marketplace. The Owner keeps human control over publication and complaint outcomes. |
| AI advert assistance | Generate or suggest advert information requested by the seller. | Contract where necessary to provide the requested assisted-listing feature. |
| Operational statistics, recent activity and short-lived verified presence | Operate, troubleshoot, secure and understand the Service using limited operational information. | Legitimate interests in reliable and secure service operation, subject to data minimisation and retention controls. |
| Data-rights requests and data-protection complaints | Receive, verify where proportionate, investigate and respond to statutory data-protection requests and complaints. | Legal obligation where UK data-protection law requires the response; legitimate interests may apply to related record-keeping or legal-claims handling where appropriate. |
| Lawful regulator/court/authority requests and legal claims | Comply with binding UK legal duties and establish, exercise or defend legal claims. | Legal obligation where a specific binding duty applies; otherwise another appropriate basis is assessed for the particular disclosure or claim. |
| Optional direct marketing or non-essential tracking, if introduced later | Only if a future feature is separately introduced and assessed. | Consent where required by UK GDPR/PECR. It is not treated as necessary for the core marketplace service. |
Lawful-basis audit completed 14 August 2026. The operator maintains an internal Lawful Basis Register and Legitimate Interests Assessment (LIA). Lawful bases are assigned by processing purpose, not by convenience. If a purpose or production configuration changes, the basis and LIA must be reviewed before the new use begins.
Where we rely on legitimate interests, the interests are specifically: marketplace safety, fraud/abuse prevention, service security and integrity, transparent trader presentation, and proportionate operational reliability. We assess purpose, necessity and the balance against users’ rights and reasonable expectations.
4. What other people can see
A live SELL advert can display the seller’s nickname, area, item information, photos, price and collection/delivery information. For adverts and requests, the poster’s verified phone number is private by default. The poster may actively choose to allow direct phone/text contact. Only when that option is enabled may the verified phone number be made available to people who choose CALL or TEXT on that live post. If the option is not enabled, the private contact-request route is used. When a user calls or texts through their own phone, their phone/network may disclose their number to the recipient. After users exchange contact details outside Your Shop Local, we cannot control how the recipient stores or uses those details, although applicable law still applies.
Wanted posts display the information needed to describe the request and area. Contact and matching features use the verified account information where enabled. Moderation-only information, authentication identifiers and report-management data are not intended to be public.
5. Who processes or receives data
The Service currently uses Google services including Firebase Hosting, Firestore, Firebase Authentication, Cloud Functions, App Check/reCAPTCHA and Google Cloud/Vertex AI functionality used by the photo-analysis feature. Google processes relevant data to deliver, secure and operate those services under its applicable terms and data-processing arrangements.
We also use Microsoft Outlook for the operator contact email. If you email us, Microsoft may process the email and related account/technical information as part of providing that email service.
Information may also be disclosed to professional advisers, insurers, regulators, courts or law-enforcement bodies where lawful and necessary. We do not sell personal data.
6. International transfers
Your Shop Local is a UK-only marketplace, but some of our technology and email providers may process personal information outside the United Kingdom. Where UK data-protection law treats this as a restricted transfer, we rely on the lawful transfer mechanism applicable to the provider and transfer, such as UK adequacy regulations or appropriate contractual safeguards made available under the provider's data-processing terms. We keep these arrangements under review. You may ask for more information about the safeguards relevant to your data using the privacy contact details above.
7. Retention
Personal data is kept only for as long as it is needed for the purpose for which it is held. Your Shop Local maintains a documented retention schedule and Owner review workflow covering marketplace records, reports, activity and relevant account/verification information. Routine review dates do not override open complaints, safety/fraud investigations, legal holds or protected regulatory/compliance records.
Retention controls are deliberately review-led: reaching a review date does not by itself authorise deletion.
8. Your data-protection rights
Depending on the circumstances, you may have rights to access, correct, erase or restrict personal data, object to certain processing, receive portable data and withdraw consent where consent is the basis used. Rights can be subject to legal exceptions.
Open the Your Data Rights page → for the request route and what happens next. Requests do not require special wording and are not automatically accepted or deleted by the system.
You can make a data-protection complaint by emailing graffcraft@outlook.com. You may also complain to the UK Information Commissioner’s Office (ICO) where applicable.
9. Security and authentication
The current service uses Firebase Authentication for verified phone accounts, Firestore security rules, separate admin authentication, App Check/reCAPTCHA security controls and server-side Cloud Functions. We use these controls to reduce unauthorised access and abuse. No online service is completely secure.
Users should avoid placing unnecessary personal information, identity documents, addresses or other sensitive information in advert descriptions or photographs.
10. Children
The Service may be accessed by children, so protective privacy and moderation measures are applied across the Service rather than relying on a user declaring that they are 18 or over. Phone numbers are private by default, unnecessary personal information should not be included in adverts, and user listings are subject to moderation before publication. We do not use an age-verification system. Children’s access, privacy and safety risks are assessed and reviewed under the applicable data-protection and online-safety framework.
11. AI and automated decisions
AI currently assists with photo analysis, advert preparation and safety signals. It does not make a solely automated decision that is intended to produce legal or similarly significant effects on a person. Sellers can review and change generated advert information, and moderation/approval remains subject to human/admin action.
12. Browser storage and similar technologies
The Service uses limited browser storage for operational functions. Firebase Authentication, reCAPTCHA/App Check and related security technology may use storage or identifiers necessary to authenticate users, verify phone numbers and protect the Service. YSL does not use a separate local-storage seller profile merely to remember contact details for convenience. See the Cookie & Local Storage Policy for the current register.
13. Changes
We will review this notice when the Service, providers or applicable law changes. The current version and review date are shown above. Material changes should be brought to users’ attention where appropriate.