Privacy Policy

Last updated 27 October 2026

This policy explains what personal data Shopper District collects when you use https://shopperdistrict.com, why, who it is shared with, and your rights. The data controller is Ahmed Razeen, trading as Shopper District, 61 Bridge Street, Kington, HR5 3DJ, United Kingdom (“we”). Contact us about privacy at support@shopperdistrict.com.

Sellers on the marketplace also receive some of your data to fulfil your orders (section 4); for that data each seller is a separate controller.

1. What we collect

Data	Where it comes from
Account: name, email address, password (stored hashed), or the identifier from Google/Facebook/Apple sign-in; role (buyer, seller, admin); account status. If you check out as a guest: just your name and email address, kept with your orders	You, or your social sign-in provider
Orders: items bought, prices, currency, delivery address and phone, notes to the seller, personalisation text, order status, dispatch and tracking details, refunds and disputes	You, the seller, and Stripe
Payments: Stripe payment, charge and refund identifiers; the last four digits and card brand as reported by Stripe. We never receive full card numbers	Stripe
Seller data: shop name and details, listings, delivery profiles including dispatch postcode, returns policy, Stripe connected-account identifier and its status	You (as a seller) and Stripe
Messages, reviews, refund requests and support tickets you send through the site	You
Favourites, basket contents, chosen display currency	You
Email sign-ups: your email address, which of our email lists you joined and when	You
Usage: pages and listings viewed (used for sellers' visit statistics), how you arrived (for example from a Google search, a Facebook ad, or by typing our address), whether you saw or clicked a sponsored banner, approximate timestamps, technical data such as IP address and browser type held briefly in server logs	Your browser

2. Why we use it (and the legal basis)

To run your account and provide the marketplace - sign-in, listings, basket, orders, downloads, messages, reviews (performance of our contract with you).
To take payments and pay sellers through Stripe, and to process refunds, chargebacks and disputes (contract; legal obligation).
To send transactional emails - order confirmations, dispatch and delivery notices, refund decisions, messages, support replies, password resets (contract). We do not send marketing emails unless you sign up for them (see Emails you sign up for).
To show sellers statistics about visits, favourites and sales for their own listings, without identifying individual visitors to them (legitimate interests).
To run sponsored banners - we count how many people see and click each sponsor's banner, in the same anonymous way as our visit statistics, and give the sponsor those totals (legitimate interests). Sponsors never learn who you are.
To keep the marketplace safe - detecting fraud and abuse, handling disputes, suspending accounts that break our Terms (legitimate interests; legal obligation).
To meet legal duties - tax and accounting records, consumer law, responding to lawful requests (legal obligation).

Businesses we invite to sell

We sometimes email businesses in the UK, the United States and Canada that already sell products, to invite them to open a shop on Shopper District. For this we hold the business name, its website or online shop, the business email address it publishes there, its country, where and when we found that address, and the emails we send and any reply. It comes from the business's own website or online shop and from public business registers such as Companies House.

Why - to tell businesses about selling with us (legitimate interests). In the UK we email only limited companies and similar organisations this way. In Canada we email only addresses a business publishes without asking not to be contacted, and only about its own business.
Stopping - reply “unsubscribe” to any of our emails, or write to support@shopperdistrict.com, and we will not email you again. We keep your email address on a do-not-contact list so that it stays that way.
How long - we send at most three short emails. If you don't reply, we delete your details 12 months after the last one, except the do-not-contact entry. If you open a shop, the rest of this policy applies.

Emails you sign up for

You can ask for our emails on our email sign-up page: seller news (new features, fee changes and selling tips) or gift ideas (Editor's picks and seasonal finds from our sellers). For each list you join we hold your email address, which list it is, and when you signed up.

Why - to send you the emails you asked for (your consent). We use your address only for that list.
Stopping - reply “unsubscribe” to any of our emails, or write to support@shopperdistrict.com, and we remove you from the list. You can do this at any time.
How long - until you unsubscribe.

3. Cookies and similar storage

We use only strictly necessary and preference cookies; there are no advertising or third-party tracking cookies. Sponsored banners set no cookies either.

Session cookie (“authjs.session-token” and related) - keeps you signed in. Deleted when it expires or you sign out.
Basket cookie (“sd_basket”) - set only when you add something to your basket without signing in, so it's still there when you check out. Lasts 60 days; signing in moves the basket into your account and removes it.
Preferences - your chosen display currency and Shop Manager view settings.
Stripe sets its own cookies on its checkout pages to prevent fraud; see Stripe's privacy policy.

You can delete cookies in your browser settings; the site will not stay signed in without the session cookie. Our cookie policy lists each cookie and how long it lasts.

4. Who we share data with

Sellers - when you order, the seller receives your name, delivery address, phone (if given), items, personalisation and notes so they can fulfil the order, and can message you about it. Sellers may use this data only for the order and must not add you to marketing lists without your consent.
Buyers - buyers see your shop name and public shop details; they do not see your personal address or payment details. If you offer collection in person, buyers see the area you give, and a buyer who pays for a collection order receives the collection address and notes you entered.
Everyone - reviews you post are public, shown with your first name, the first letter of your surname and the date.
Stripe (payments, seller payouts, identity verification of sellers, sellers' monthly plan billing) - Stripe Payments UK Ltd / Stripe Inc.
Anthropic (the AI listing writer on sellers' monthly plans) - only the listing photos and notes a seller chooses to send it to draft a listing. Anthropic, PBC.
Hosting and infrastructure - Netlify (application hosting), Neon (database), Cloudflare (image and file storage, DNS), Resend (email delivery), Spacemail (our support mailbox). These providers process data on our instructions.
Sign-in providers - Google, Facebook or Apple, only if you choose to sign in with them.
Sponsors - totals only: how many people saw or clicked their banner, and on which of our pages. If you click a banner you go to the sponsor's own website, and its privacy policy applies there.
Authorities and advisers - where the law requires, or to establish or defend legal claims.

We do not sell personal data.

5. International transfers

Our database and file storage are located in the UK/EU where possible; some providers (for example Netlify, Stripe and Resend) process data in the United States under the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses. Sellers and buyers may be in other countries; order data is shared with them as needed to complete the sale.

6. How long we keep data

Account data: while your account is open, then up to 12 months.
Orders, payments, refunds and disputes: 6 years after the order, for tax and legal purposes.
Messages, reviews, support tickets: while the related account or order exists.
Listing-view statistics: 13 months.
Email sign-ups: until you unsubscribe.
Server logs: up to 30 days.

7. Your rights

Under UK GDPR (and EU GDPR where it applies) you can ask us to: access the data we hold about you; correct it; delete it (unless we must keep it, e.g. order records); restrict or object to processing based on legitimate interests; receive your data in a portable format; and withdraw consent where processing relies on it. Email support@shopperdistrict.com; we respond within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

8. Security

Data is transmitted over HTTPS, passwords are stored hashed, payment details are handled only by Stripe, and access to admin tools is restricted to the marketplace administrator. No system is perfectly secure; if we discover a breach affecting you we will inform you and the regulator as the law requires.

9. Children

The site is for people aged 18 or over. We do not knowingly collect data from children.

10. Changes

We will post updates here and change the date at the top; for material changes we will also notify account holders by email or on the site.

Privacy Policy

Last updated 27 October 2026

Sellers on the marketplace also receive some of your data to fulfil your orders (section 4); for that data each seller is a separate controller.

1. What we collect

Data	Where it comes from
Account: name, email address, password (stored hashed), or the identifier from Google/Facebook/Apple sign-in; role (buyer, seller, admin); account status. If you check out as a guest: just your name and email address, kept with your orders	You, or your social sign-in provider
Orders: items bought, prices, currency, delivery address and phone, notes to the seller, personalisation text, order status, dispatch and tracking details, refunds and disputes	You, the seller, and Stripe
Payments: Stripe payment, charge and refund identifiers; the last four digits and card brand as reported by Stripe. We never receive full card numbers	Stripe
Seller data: shop name and details, listings, delivery profiles including dispatch postcode, returns policy, Stripe connected-account identifier and its status	You (as a seller) and Stripe
Messages, reviews, refund requests and support tickets you send through the site	You
Favourites, basket contents, chosen display currency	You
Email sign-ups: your email address, which of our email lists you joined and when	You
Usage: pages and listings viewed (used for sellers' visit statistics), how you arrived (for example from a Google search, a Facebook ad, or by typing our address), whether you saw or clicked a sponsored banner, approximate timestamps, technical data such as IP address and browser type held briefly in server logs	Your browser

2. Why we use it (and the legal basis)

To run your account and provide the marketplace - sign-in, listings, basket, orders, downloads, messages, reviews (performance of our contract with you).
To take payments and pay sellers through Stripe, and to process refunds, chargebacks and disputes (contract; legal obligation).
To send transactional emails - order confirmations, dispatch and delivery notices, refund decisions, messages, support replies, password resets (contract). We do not send marketing emails unless you sign up for them (see Emails you sign up for).
To show sellers statistics about visits, favourites and sales for their own listings, without identifying individual visitors to them (legitimate interests).
To run sponsored banners - we count how many people see and click each sponsor's banner, in the same anonymous way as our visit statistics, and give the sponsor those totals (legitimate interests). Sponsors never learn who you are.
To keep the marketplace safe - detecting fraud and abuse, handling disputes, suspending accounts that break our Terms (legitimate interests; legal obligation).
To meet legal duties - tax and accounting records, consumer law, responding to lawful requests (legal obligation).

Businesses we invite to sell

Why - to tell businesses about selling with us (legitimate interests). In the UK we email only limited companies and similar organisations this way. In Canada we email only addresses a business publishes without asking not to be contacted, and only about its own business.
Stopping - reply “unsubscribe” to any of our emails, or write to support@shopperdistrict.com, and we will not email you again. We keep your email address on a do-not-contact list so that it stays that way.
How long - we send at most three short emails. If you don't reply, we delete your details 12 months after the last one, except the do-not-contact entry. If you open a shop, the rest of this policy applies.

Emails you sign up for

Why - to send you the emails you asked for (your consent). We use your address only for that list.
Stopping - reply “unsubscribe” to any of our emails, or write to support@shopperdistrict.com, and we remove you from the list. You can do this at any time.
How long - until you unsubscribe.

3. Cookies and similar storage

We use only strictly necessary and preference cookies; there are no advertising or third-party tracking cookies. Sponsored banners set no cookies either.

Session cookie (“authjs.session-token” and related) - keeps you signed in. Deleted when it expires or you sign out.
Basket cookie (“sd_basket”) - set only when you add something to your basket without signing in, so it's still there when you check out. Lasts 60 days; signing in moves the basket into your account and removes it.
Preferences - your chosen display currency and Shop Manager view settings.
Stripe sets its own cookies on its checkout pages to prevent fraud; see Stripe's privacy policy.

You can delete cookies in your browser settings; the site will not stay signed in without the session cookie. Our cookie policy lists each cookie and how long it lasts.

4. Who we share data with

Sellers - when you order, the seller receives your name, delivery address, phone (if given), items, personalisation and notes so they can fulfil the order, and can message you about it. Sellers may use this data only for the order and must not add you to marketing lists without your consent.
Buyers - buyers see your shop name and public shop details; they do not see your personal address or payment details. If you offer collection in person, buyers see the area you give, and a buyer who pays for a collection order receives the collection address and notes you entered.
Everyone - reviews you post are public, shown with your first name, the first letter of your surname and the date.
Stripe (payments, seller payouts, identity verification of sellers, sellers' monthly plan billing) - Stripe Payments UK Ltd / Stripe Inc.
Anthropic (the AI listing writer on sellers' monthly plans) - only the listing photos and notes a seller chooses to send it to draft a listing. Anthropic, PBC.
Hosting and infrastructure - Netlify (application hosting), Neon (database), Cloudflare (image and file storage, DNS), Resend (email delivery), Spacemail (our support mailbox). These providers process data on our instructions.
Sign-in providers - Google, Facebook or Apple, only if you choose to sign in with them.
Sponsors - totals only: how many people saw or clicked their banner, and on which of our pages. If you click a banner you go to the sponsor's own website, and its privacy policy applies there.
Authorities and advisers - where the law requires, or to establish or defend legal claims.

We do not sell personal data.

5. International transfers

6. How long we keep data

Account data: while your account is open, then up to 12 months.
Orders, payments, refunds and disputes: 6 years after the order, for tax and legal purposes.
Messages, reviews, support tickets: while the related account or order exists.
Listing-view statistics: 13 months.
Email sign-ups: until you unsubscribe.
Server logs: up to 30 days.

7. Your rights

8. Security

9. Children

The site is for people aged 18 or over. We do not knowingly collect data from children.

10. Changes

We will post updates here and change the date at the top; for material changes we will also notify account holders by email or on the site.