Privacy Policy

1. Data controller

The data controller is Steven Hale trading as Treasure Scout (sole trader), Suncroft, Chapel Street, Guisborough, TS14 6QE, Redcar and Cleveland, England. For any privacy enquiry, contact privacy@treasurescout.co.uk.

2. What we collect

• Account data: email, display name, password hash, sign-in method (e.g. Google).
• Usage data: scans you perform, items you save, community posts, chat messages.
• Uploaded images: photos of items you scan or save.
• Payment data: handled by Stripe (our payments provider); we receive only the subscription status and last-four card digits.
• Technical data: IP address, browser type, device ID, error logs, basic analytics.

3. Why we use it (legal basis)

• Contract: to provide the service you signed up for.
• Legitimate interests: to keep the service secure, prevent abuse, and improve the product.
• Consent: for any non-essential analytics or marketing (you can withdraw at any time).
• Legal obligation: to keep tax and accounting records.

4. Who we share data with (processors)

• Lovable Cloud (Supabase): database, authentication, file storage — hosted in the EU.
• Stripe: payment processing, billing, tax and receipts.
• Google Gemini / OpenAI (via Lovable AI Gateway): AI inference on the images you upload. Providers do not retain images for training.
• Email provider: transactional emails (receipts, password resets).

We do not sell your data.

5. How long we keep it

• Account and scan data: while your account is active, plus 30 days after deletion.
• Payment records: 6 years (HMRC requirement).
• Error logs: 90 days.

6. International transfers

Some processors (e.g. OpenAI) may transfer data outside the UK. Where this happens we rely on UK adequacy decisions or Standard Contractual Clauses.

7. Your rights

Under UK GDPR you can: access your data; correct it; delete it; restrict or object to processing; receive a portable copy; and lodge a complaint with the Information Commissioner's Office. Email privacy@treasurescout.co.uk to exercise any of these.

8. Security

Data is encrypted in transit (HTTPS) and at rest. Access is restricted to authorised personnel. We use row-level security to scope your data to your account.

9. Cookies

See our Cookie Policy.

10. Changes

We'll notify you of material changes by email or in-app at least 14 days before they take effect.