unKeep
<- All policies

unKeep Privacy Policy

Last updated: 30 June 2026

This Privacy Policy explains how we collect, use, share, and protect your personal data when you use unKeep. "Personal data" means any information that relates to you and can identify you, directly or indirectly.

unKeep is a collection-only second-hand marketplace for the UK. Sellers list items, our AI helps draft and price the listing, and buyers reserve and collect items in person. The sale price for goods is paid directly, in cash, between buyer and seller at collection. unKeep is never a party to that sale. This policy sits alongside our Terms of Service, our Cookie Policy, our Acceptable Use Policy, our Reservation Fee Policy, and our Illegal Content and Takedown Policy. Please read it with those documents. A full list is in section 19.

This policy uses plain language. Where a word has a specific legal meaning we explain it. References to "UK GDPR" mean the United Kingdom General Data Protection Regulation, and references to "DPA 2018" mean the Data Protection Act 2018.

1. Who we are and how to contact us

1.1 The "controller" of your personal data is the organisation that decides why and how your personal data is processed. For unKeep, the controller is:

  • AllMumsTalk Limited
  • Company number: 08233578
  • Registered office: 5 Golden Mede, Waddesdon, England, HP18 0NG

1.2 We are registered with the Information Commissioner's Office (the "ICO"), the UK's data protection regulator. Our ICO registration reference is ZA728215.

1.3 You can contact us about this policy or about your personal data:

1.4 We have assessed whether we are legally required to appoint a statutory Data Protection Officer. We have concluded we are not required to appoint a statutory Data Protection Officer under Article 37 UK GDPR. Our data protection contact is connect@unkeep.co.uk.

2. The personal data we collect

We only collect data we need to run the service. The data we hold depends on whether you are a seller, a buyer, or both.

2.1 Account and profile data

  • Your name and chosen display name.
  • Your email address and, where you provide it, a mobile number.
  • Your password (stored only in a hashed, non-readable form) or details from any sign-in provider you use.
  • Your subscription status and plan (for example Seller Agent, Buyer Agent, or Ultra Radius).

2.2 Location data (approximate and exact)

Location is central to a collection-only service, so we explain it carefully.

  • When you set up an item or a search area, we collect a postcode or location you provide.
  • We derive an "approximate area" from this (for example a neighbourhood or town-level area). The approximate area is what other users see before a reservation is made.
  • We hold a more precise "exact handover point" for a listing, which we reveal to the matched buyer in stages. From the moment of reservation, the buyer sees the street name and full postcode with an approximate area pin. The exact address (house number and second address line) and the precise map pin are revealed only from the start of the collection day (00:00 UK time), and to the seller for that reservation. If the seller has no booked time slot, the full address is shown to the matched buyer immediately. It is never shown publicly or to other buyers.
  • We use location to apply the default 15-mile collection radius and, if you subscribe to Ultra Radius, to remove the 15-mile limit so you can reserve and collect anywhere in the UK.
  • When you report that a seller did not turn up for a collection, your device asks for a one-off precise location reading at that moment, which we compare once to the seller's exact collection point to confirm you were there before refunding your reservation fee. We keep a record that this check happened and its result (so we can spot abuse), but we do not track your location continuously, follow your movements, or use this reading for any other purpose. If you do not allow the reading, you can still contact us about the collection.

2.3 Listing content, including photographs

  • Photographs you upload of the items you list.
  • Item descriptions, categories, condition notes, and prices, including text our AI drafts and text you edit or confirm.
  • Important: photographs may unintentionally contain other people, vehicles, registration plates, house interiors, or other identifying details. This can be personal data about you and about third parties who did not upload the photo. Please only photograph what you need to, and avoid capturing other people where you can.

2.4 Reservation and collection data

  • Records of items you reserve, reservations drafted for you, and reservations you confirm.
  • The 1.00 GBP reservation fee charged when you reserve (a real charge, captured immediately, not an authorisation or hold), and whether it was later refunded. See section 4 for how this works.
  • QR-code handover confirmations (that a handover was confirmed, and when).
  • The ratings buyers and sellers give each other after a completed collection, and any automatic downvote applied where a party did not turn up.
  • Collection reminders: about 24 hours and about 2 hours before a booked collection time, we send push notifications to both the buyer and the seller for that reservation.

2.5 Payment data (via Stripe)

  • We use Stripe as our payment processor for subscriptions, Ultra Radius, and the 1.00 reservation fee.
  • We do not store your full card number. Stripe handles card details and returns to us payment tokens and limited details such as the card brand, the last four digits, expiry, the status of a payment or refund, and billing identifiers.
  • Stripe is an independent controller of card data for its own compliance and fraud-prevention purposes, and our processor for taking payments on our instructions. See Stripe's own privacy notice for how it handles your data.

2.6 Device, technical, and usage data

  • IP address, device and browser type, operating system, and app version.
  • Log data such as pages or screens viewed, actions taken, timestamps, and error reports.
  • Cookies and similar technologies. How we use these, and your choices, are set out in our Cookie Policy.

2.7 Communications and support data

  • Messages you send us, support tickets, and our replies.
  • Reports you make under our notice-and-takedown process (see our Illegal Content and Takedown Policy), and reports made about your content or conduct.

2.8 AI processing of your images and text

  • When you create a listing, we send your photographs and any text you provide to our AI provider so the AI can draft a description, suggest a category, and suggest a price.
  • This involves automated analysis of the image content (for example recognising what an item is and its apparent condition). The output is a draft only. You review, edit, and confirm every listing before it goes live, so there is a person in control of the final listing.
  • AI-generated listing copy is labelled as AI-generated. The seller, not unKeep, warrants the accuracy, legality, ownership, genuineness, and safety of items.
  • This drafting and pricing assistance does not produce a legal or similarly significant decision about you. It does not, by itself, decide your eligibility, price you pay, or any right. See section 11 on automated decision-making.

2.9 Data we do NOT collect

  • We do not record the final agreed cash sale price of goods. That price is settled in person, in cash, between buyer and seller, and unKeep is not told it and does not store it.
  • We do not handle, hold, or route the goods money, and we do not operate any stored balance or wallet for you.

3. EXIF, GPS, and metadata stripping

3.1 Photographs often carry hidden "metadata" (sometimes called EXIF data), which can include the exact GPS coordinates where a photo was taken, the date and time, and device details.

3.2 To protect your privacy and the privacy of anyone in or around your home, we strip location metadata (including GPS and EXIF location fields) from photographs when they are ingested, before the photograph is published or shown to other users. This means the exact place a photo was taken is not exposed through the image file.

3.3 Stripping metadata reduces but does not eliminate privacy risk, because the visible content of a photo can still reveal information. Please review your photos before uploading.

4. How the reservation fee works (and what we do with that data)

4.1 Reserving an item charges a 1.00 GBP reservation fee to your card. This is unKeep's platform service fee for facilitating the reservation - reserving the item for you, taking it off the market for other buyers, revealing the handover point, and arranging the QR-confirmed collection. It is a real charge, captured immediately when you reserve; the money leaves your account at reservation. It is not an authorisation or a hold. Our Reservation Fee Policy sets out the full rules; this section explains only how we handle the related data.

4.2 The reservation fee is non-refundable if you (the buyer) cancel your reservation or do not turn up to collect (a no-show). You paid for the reservation service and unKeep provided it.

4.3 The reservation fee is refunded where the collection cannot go ahead through no fault of yours, for example the seller cancels, delists, does not turn up, the item is not as described, or the seller closes their account, or where unKeep cancels (for example a prohibited item, a takedown, or a suspension). Refunds are automatic where unKeep can determine fault; otherwise you can contact us and we refund.

4.4 If you do not turn up to collect, the consequence is reputational, not extra money: an automatic downvote is applied to your rating. The fee was already taken at reservation, and nothing extra is captured.

4.5 You can have a maximum of five active reservations at any time.

4.6 We process the data needed to charge, track, and refund each reservation fee, and to enforce the five-reservation limit. The reservation fee is not stored value, a deposit, a wallet, e-money, customer money held by unKeep, a penalty, or a balance, it is not transferable or spendable, and we hold no money on your behalf.

5. The lawful bases we rely on

Under UK GDPR we must have a "lawful basis" for each use of your personal data. We rely on the following.

5.1 Performance of a contract (Article 6(1)(b))

We use this where processing is necessary to provide the service you signed up for, including:

  • creating and managing your account and subscription;
  • publishing listings you confirm;
  • matching buyers and sellers, drafting and confirming reservations, and revealing the handover point to a matched buyer;
  • charging and, where due, refunding the 1.00 reservation fee;
  • confirming handovers by QR code; and
  • providing customer support about your use of the service.

5.2 Legitimate interests (Article 6(1)(f))

We use this where processing is necessary for our or a third party's legitimate interests and is not overridden by your rights. Our legitimate interests include keeping the platform safe and lawful, preventing fraud and abuse, operating notice-and-takedown checks (see our Illegal Content and Takedown Policy) and prohibited-items checks (see our Prohibited and Restricted Items Policy), improving and securing the service, and analysing aggregate usage. Where we rely on legitimate interests we carry out a Legitimate Interests Assessment (an "LIA") to balance our interests against your rights. You can ask us for a summary of the relevant LIA using the contact details in section 1. You can object to processing based on legitimate interests (see section 10).

5.3 Consent (Article 6(1)(a))

We rely on your consent for direct marketing by email or push notification, and for any non-essential cookies and similar technologies (see our Cookie Policy). You can withdraw consent at any time, for example by using the unsubscribe link, changing your settings, or contacting us. Withdrawing consent does not affect processing carried out before you withdrew it.

5.4 Legal obligation (Article 6(1)(c))

We use this where we must process data to comply with the law, for example to respond to a valid request from a regulator or law-enforcement body, to meet tax or accounting duties, or to act on a valid takedown obligation.

5.5 Special category and other sensitive data

We do not ask for special category data (such as health, race, or religion). Photographs of items should not contain such data. If you choose to include it, for example by photographing something revealing, you do so on your own initiative. We ask you not to upload special category data, and we will remove it if asked.

6. Direct marketing

6.1 We will only send you marketing about unKeep where you have consented, or where the law otherwise allows it. We will not share your data with third parties for their own marketing.

6.2 You can opt out of marketing at any time using the unsubscribe link in any marketing message, your in-app settings, or by contacting us. Service messages (for example about a reservation, a reservation fee, a security issue, or a change to terms) are not marketing and will still be sent.

7. Who we share your data with (processors and recipients)

7.1 We share data with service providers who process personal data on our behalf and on our instructions. These are our "processors", and we have written contracts with each of them as required by Article 28 UK GDPR. Our key processors and recipients are:

  • Stripe - payments, subscriptions, Ultra Radius, and the 1.00 reservation fee. (Stripe also acts as an independent controller for card data, as noted in section 2.5.)
  • Anthropic (its Claude models) - analyses listing photographs and text to draft titles, descriptions and prices, on our instructions under Article 28; it does not use your content to train its models.
  • Vercel - website hosting, content delivery, and consent-gated Web Analytics.
  • Supabase - database, authentication, file storage, and transactional email.
  • Apple - app distribution and, for devices that opt in, push notifications via the Apple Push Notification service.
  • postcodes.io - converts a postcode to an approximate location to power nearby search; no account data is shared.

A current list of our sub-processors is kept in our Sub-processors page.

7.2 We also share data with the other party to a transaction, but only as the service requires. Before a reservation, other users see only your approximate area and listing content. After a confirmed, matched reservation, the matched buyer and the seller can see the information needed to complete the collection. The exact handover point is revealed to the matched buyer in stages (street and postcode from reservation, the exact address from the start of the collection day), as described in section 2.2.

7.3 We may share data where the law requires or allows it, for example with regulators, law enforcement, or our professional advisers, or in connection with a sale or reorganisation of our business (in which case we will protect your data and tell you if your rights change).

7.4 We keep an internal register of processors. You can ask us for the current list using the contact details in section 1.

8. International transfers

8.1 Some of our processors may store or process personal data outside the United Kingdom. Where they do, we make sure your data is protected to UK standards.

8.2 Where we transfer personal data outside the UK, we rely on one of the following safeguards:

  • a UK adequacy decision (the destination country is recognised as offering adequate protection); or
  • the ICO's International Data Transfer Agreement (the "IDTA"), or the UK Addendum to the European Commission's Standard Contractual Clauses, together with any extra measures needed.

8.3 You can ask us which safeguard applies to a given transfer and request information about it using the contact details in section 1.

9. No-shows and two-way ratings

9.1 After a completed collection, the buyer and the seller rate each other. We process these ratings as personal data about the user being rated and store them against that user's account.

9.2 If a party does not turn up to collect (a no-show), we apply an automatic downvote to that party's rating. The consequence of a no-show is reputational, not financial: the 1.00 reservation fee was already taken at reservation, and nothing extra is charged. We do not move money between users, and there is no seller credit or rebate.

10. How long we keep your data (retention)

10.1 We keep personal data only for as long as we need it for the purposes set out in this policy, then delete it or anonymise it.

10.2 Our general retention approach is:

  • Account and profile data: for as long as your account is open. When you close your account we delete the personal data linked to it, keeping only the anonymised financial records described below and anything we are legally required to retain.
  • Listing content and photographs: while the listing is live or remains in your account. When you delete a listing it stays recoverable for up to 90 days and is then permanently deleted, including its photographs. When you close your account, your listings and their photographs are deleted with it. Where a listing was part of a reservation, we keep the anonymised reservation record below but still delete the photographs.
  • Reservation fee and transaction records: we keep an anonymised record of each reservation fee (the amount, dates, payment reference, and outcome, with no personal identifiers) for at least 6 years, to meet tax and accounting law and to handle legal claims. We keep this even if you close your account, as the law allows. The wider reservation, rating, and collection (QR) details linked to your account are kept while your account is open and deleted when you close it.
  • Subscription records: we keep an anonymised record of each subscription you take out (the plan, the start and renewal dates, the payment reference, and the status, with no personal identifiers) for at least 6 years, to meet tax and accounting law, including after you close your account.
  • Payment data: we never hold full card numbers. Card details are tokenised by Stripe; the tokens linked to your account are deleted when you close it. The transaction records are kept anonymised for the 6 years tax and accounting law requires, as set out above, and by Stripe as our payment processor.
  • Support and safety records: kept while your account is open, and deleted when you close it. The exception is illegal or harmful content: where we act on a report, we keep an anonymised record of the report and the moderation action we took (with no personal identity) to evidence how we met our online-safety duties, including after you close your account.
  • Marketing consent and analytics: your marketing choices are kept until you opt out or close your account. Usage analytics are kept for up to 24 months, and any analytics linked to your account are deleted when you close it.

10.3 When you close your account, we delete the personal data linked to it, including your listings and their photographs. The only things we keep are the anonymised financial records described above, which tax and accounting law requires us to retain, and any record we are under a specific legal obligation to keep.

11. Automated decision-making and profiling

11.1 Our AI drafts listing descriptions and suggests prices, and our Buyer Agent suggests matches and drafts reservations. These are assistance tools. A person (you) reviews and confirms listings, and confirms reservations, so there is meaningful human involvement.

11.2 We do not make decisions that have a legal or similarly significant effect on you using solely automated processing. If this ever changes, we will update this policy and tell you about your rights under Article 22 UK GDPR.

12. Your rights

12.1 Under UK GDPR you have the following rights, which you can exercise free of charge in most cases:

  • The right to be informed - this policy is part of how we meet that right.
  • The right of access - to get a copy of your personal data (a "data subject access request" or "DSAR").
  • The right to rectification - to have inaccurate data corrected.
  • The right to erasure - to have your data deleted in certain circumstances (sometimes called the right to be forgotten).
  • The right to restrict processing - to limit how we use your data in certain circumstances.
  • The right to data portability - to receive certain data in a portable format, or have it sent to another provider where technically feasible.
  • The right to object - including to processing based on legitimate interests, and an absolute right to object to direct marketing.
  • Rights relating to automated decision-making and profiling - see section 11.
  • The right to withdraw consent - where we rely on consent.

12.2 How to make a request. You can exercise any of these rights, including a DSAR, using our online form at unkeep.co.uk/complaints or by emailing connect@unkeep.co.uk. We may need to verify your identity before we act, to protect your data. We will respond within one month. We can extend this by up to two further months for complex or numerous requests, and we will tell you if we need to.

12.3 Some rights are not absolute and may not apply to all of your data, for example where we must keep records to meet a legal obligation or to defend a legal claim. If we cannot fully meet a request, we will explain why.

13. How we protect your data (security)

13.1 We use appropriate technical and organisational measures to protect personal data, which include:

  • encryption of data in transit and, where appropriate, at rest;
  • storing passwords only in hashed form;
  • access controls, so staff and processors only access what they need;
  • stripping location metadata from photographs on ingest (see section 3);
  • revealing handover locations only to a matched buyer and the relevant seller;
  • monitoring, logging, and regular review of our security; and
  • contractual security obligations on our processors.

13.2 No service can be completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the ICO within 72 hours where required, and tell affected users where the law requires it.

14. Children

14.1 unKeep is not intended for children. You must be at least 18 to use unKeep. Age-restricted items are banned at launch because we cannot verify age at an in-person handover (see our Prohibited and Restricted Items Policy). If we learn that we hold data about someone under 18, we will delete it.

15. Cookies and similar technologies

15.1 We use cookies and similar technologies for essential functions, and, with your consent, for analytics and other non-essential purposes. Full details, and how to change your choices, are in our Cookie Policy. Our use of cookies is governed by the Privacy and Electronic Communications Regulations ("PECR") as well as UK GDPR.

16. Our internal Data Protection Impact Assessment

16.1 Because our processing includes location data, the processing of photographs that may contain third parties, and AI analysis of images, we have carried out a Data Protection Impact Assessment (a "DPIA") to identify and manage privacy risks. The DPIA is an internal document. You can ask us for a summary of its key findings using the contact details in section 1.

17. How to complain

17.1 You have the right to complain to us if you think we have not handled your personal data properly. The easiest way is to use our complaints form at unkeep.co.uk/complaints, which goes straight to the team that handles data protection requests and complaints; you can also email connect@unkeep.co.uk. Under the Data (Use and Access) Act 2025 we will acknowledge your complaint within 30 days and respond without undue delay, taking longer only where the law allows (for example for complex or numerous matters) and telling you if we do.

17.2 You also have the right to complain to the ICO, the UK supervisory authority for data protection. The ICO may ask you to raise your complaint with us first:

  • Information Commissioner's Office
  • Website: ico.org.uk
  • Helpline: 0303 123 1113
  • Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

17.3 We would, however, appreciate the chance to address your concerns before you approach the ICO.

18. Changes to this policy

18.1 We may update this policy from time to time. If we make a significant change, we will tell you by a suitable method, for example by email or an in-app notice. The "Last updated" date at the top shows when this version took effect. Please check this policy regularly.

19. Related policies

  • Terms of Service
  • Cookie Policy
  • Acceptable Use Policy (how you may behave on unKeep)
  • Prohibited and Restricted Items Policy (what you may and may not list, including the age-restricted-items ban)
  • Illegal Content and Takedown Policy (our notice-and-takedown process under the Online Safety Act 2023)
  • Reservation Fee Policy (the full rules for the 1.00 reservation fee)
  • Subscription Terms (including your 14-day cooling-off right)
  • Complaints and Dispute Resolution Policy (how to raise and escalate a complaint)