Privacy Notice

This notice explains how Cavri, a trading name of Sandbanks Digital Limited ("we", "us"), handles personal data under the UK GDPR and the Data Protection Act 2018. Sandbanks Digital Limited is registered in England and Wales under company number 17268570, with its registered office at 457 Ashley Road, Poole, England, BH14 0AX, and is the controller for the data described here. Contact: write to us at 457 Ashley Road, Poole, England, BH14 0AX.

1. What we collect

Account data — email address, hashed authentication data, plan and billing status.
Inventory data — listing titles, descriptions, prices, categories, item photos and sales history you import or create.
Marketplace connection data — your public marketplace username and listing identifiers. Your marketplace password and session cookies stay in your own browser and are never uploaded to our servers.
Usage data — actions taken in the app, AI usage counts, and technical logs (IP address, timestamps) needed to secure and operate the Service.
Billing data — handled by Stripe; we store your Stripe customer and subscription identifiers, never your card number.

2. Why we process it (lawful bases)

Contract — providing the workspace, sync, automation and billing you sign up for.
Legitimate interests — securing the Service, preventing abuse, improving features using aggregate usage patterns.
Legal obligation — tax and accounting records for payments.
Consent — any marketing emails (none are sent today); you can withdraw consent at any time.

3. AI processing

When you use AI listing generation, the item photos and text you submit are sent to the AI provider configured for your account (Google Gemini, OpenAI, or Anthropic) solely to generate your listing content. We do not use your data to train models.

4. Who processes data for us

Supabase — authentication and database hosting.
Railway — application hosting and file storage.
Stripe — payment processing.
Google / OpenAI / Anthropic — AI listing generation, only when you use AI features.

Some processors store data outside the UK/EEA; where they do, transfers rely on adequacy decisions or standard contractual clauses.

5. How long we keep it

Account and inventory data — for as long as your account exists, then deleted within 30 days of account closure.
Payment records — 6 years (legal requirement).
Security logs — up to 12 months.

6. Your rights

You can ask for access to, correction of, deletion of, or a portable copy of your personal data, and you can object to or ask us to restrict processing. Write to us at the contact above; we respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

7. Cookies and local storage

The app uses essential local storage for your sign-in session only. See the Cookie Notice for detail.

8. Changes

If this notice changes materially we will tell you in the app or by email before the change takes effect.