Privacy Policy

Account data: your name, email address, password (stored only as a secure hash), role (buyer or seller) and optional phone number.

Listing data (sellers): business details, financial estimates, descriptions and contact preferences you submit when creating a listing.

Enquiry data (buyers): the messages and contact details you send to sellers through the platform.

Payment data: handled by our payment processor, Stripe. We do not store full card details on our servers.

Usage data: listings viewed, saved listings and saved searches, used to power your dashboard and match alerts.

To provide the service and your account (performance of a contract).

To generate business analysis from listing data, and to operate match alerts and dashboards (our legitimate interests in running a useful marketplace).

To process listing-fee payments (performance of a contract).

To meet legal and regulatory obligations, including any anti-money-laundering checks that may apply.

When AI analysis is generated, the listing details a seller provides are sent to our AI provider, OpenAI, to produce an indicative business analysis. Only listing information is shared for this purpose, never buyer account credentials or passwords.

When our built-in offline analysis mode is in use, no listing data leaves our own systems.

The resulting analysis is cached and regenerated only when the listing changes. It is indicative and is not financial, investment or legal advice.

We use the following third-party providers (sub-processors) to run the service. Each only receives the data it needs for its role:

Database: Supabase (supabase.com). All account, listing, enquiry, message, notification and usage data is held in a managed PostgreSQL database provided by Supabase, hosted in the European Union (Stockholm) region on Amazon Web Services. Data is encrypted in transit and at rest.

Image storage: Supabase Storage (supabase.com), which hosts the photos uploaded to listings and serves them over a content delivery network. Only the images you add to a listing are stored there.

Application hosting: Hostinger (hostinger.com), which serves the website and runs our server-side code and API routes. Hostinger may process data on infrastructure located outside the UK.

Payments: Stripe (stripe.com), which processes listing-fee and subscription payments. Stripe receives the payment and billing details you enter at checkout. We never see or store your full card number.

AI analysis: OpenAI (openai.com), which generates the Acquisition Intelligence analysis from listing details, as described above. OpenAI processes this data in the United States.

Web research: a search provider (Tavily) is integrated for optional company look-ups but is currently disabled. No data is sent to it unless we enable this feature and update this policy first.

We keep this list current. If we add or change a key provider, we will update this policy.

Beyond the service providers listed above, we share data only where you direct us to. When you contact a seller, the contact details and message you choose to send are shared with that seller.

We may disclose data where required by law or to protect our rights. We do not sell your personal data.

Some providers process data outside the UK. Supabase stores your core data and listing images in the European Union (Stockholm) region, which benefits from UK adequacy. Stripe, OpenAI and Hostinger may process data in the United States or other countries.

Where data leaves the UK, we rely on appropriate safeguards such as the UK's adequacy regulations, the UK International Data Transfer Agreement, or standard contractual clauses.

We use essential cookies to keep you signed in and secure. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for the full list. If analytics are added in future, we will request consent first.

We keep account and listing data for as long as your account is active, and for a reasonable period afterwards to meet legal, accounting and dispute-resolution requirements. You can request deletion at any time.

Under UK data protection law you have rights to access, correct, delete, restrict, port and object to processing of your personal data.

To exercise any right, contact us using the details below. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Passwords are hashed with bcrypt, connections are encrypted in transit (HTTPS and TLS to our database), and data is encrypted at rest by our database provider. Access to personal data is limited. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

Questions or requests about this policy or your data: hello@wemborough.com.