Privacy Policy
DRAFT — solicitor review required before launch. This wording has been prepared in-house as a working draft. It has not been checked by a qualified lawyer and must not be relied on as legal advice. The ICO registration number must be added before publication.
This policy explains what we do with your personal data when you use lodestock.com, buy from us, sell us a device, or contact us.
1. Who is responsible for your data
The data controller is NanoSoft Corporation Limited, company number 06579146, registered office Unit 8-9 Maldon Trade Park, The Causeway, Heybridge, Maldon, England, CM9 4LJ, trading as Lodestock.
For anything to do with your data, email support@lodestock.com.
2. What we collect
When you buy something: your name, email, delivery and billing address, phone number if you give one, what you ordered, and the order's payment status. We never receive or store your full card number — Stripe handles the card and tells us only whether payment succeeded, along with the card type and last four digits.
When you create an account: your email, password (stored only as a cryptographic hash, never in readable form), and anything else you choose to add such as saved addresses.
When you sell us a device: your name, contact details, collection address, your answers about the device's condition, and the device's serial number once it reaches us.
When you apply for a trade account: your business name, company number, contact details and the trading information you give us.
When you contact us: whatever is in your message, and your contact details.
When you browse: the pages you visit, the site you arrived from, and your approximate country. This is collected first-party and without cookies, and is not tied to your identity. Optional analytics and session-recording tools only run if you accept them in the cookie banner.
Server logs: IP addresses and request details, kept briefly for security and fraud prevention.
3. Why we use it, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Take and fulfil your order | To supply what you bought | Performance of a contract |
| Handle returns, warranty claims and refunds | To meet our obligations to you | Contract, and legal obligation |
| Run trade-in quotes and payouts | To buy your device | Contract |
| Run your account | So you can see orders and manage details | Contract |
| Keep invoices and transaction records | Tax and accounting law | Legal obligation |
| Prevent fraud and secure the site | To protect you and us | Legitimate interests |
| Understand how the site is used | To improve it | Legitimate interests (first-party, cookie-free) or consent (optional tools) |
| Send marketing email | To tell you about stock and offers | Consent, which you can withdraw at any time |
Where we rely on legitimate interests, we have considered whether it is fair to you, and we do not use your data in ways you would find unexpected or intrusive.
4. Who we share it with
We share personal data only with the organisations that make the service work:
- Stripe — payment processing.
- Supabase — our database and file storage.
- Vercel — hosting.
- Resend — transactional email such as order confirmations.
- Couriers — the name, address and phone number needed to deliver your parcel.
- Our accountants and, if we must, HMRC — for tax records.
- Professional advisers, or a buyer of the business — if we ever sell or restructure the company.
Each of these acts on our instructions under a written contract, except where they are a controller in their own right — Stripe is, for the payment itself.
We never sell your personal data.
5. Where your data is held
Our systems are hosted in the United Kingdom and the European Economic Area wherever possible. Some suppliers process data in the United States. Where data leaves the UK, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum, which contractually protect it to UK standards.
6. How long we keep it
- Orders, invoices and tax records — 7 years, because tax law requires it.
- Account details — while your account is open, then deleted or anonymised within 12 months of closure.
- Trade-in records — 6 years, so we can evidence provenance of equipment we bought.
- Support correspondence — 3 years.
- Marketing consent — until you withdraw it.
- Page-view analytics — 24 months, and it is not linked to you personally.
- Server logs — 90 days.
7. Your rights
Under the UK GDPR you have the right to:
- be told how your data is used — that is what this policy is for;
- get a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have data erased, where we do not have to keep it;
- restrict how we use it while a concern is being resolved;
- object to processing based on legitimate interests, and to object to direct marketing at any time, absolutely;
- portability — receive data you gave us in a machine-readable form;
- withdraw consent at any time, where we relied on consent.
To exercise any of these, email support@lodestock.com. We respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
8. Complaining
If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — ico.org.uk/make-a-complaint — 0303 123 1113.
9. Security
Data is encrypted in transit. Passwords are hashed. Access to customer data inside the business is limited to the staff who need it, controlled by role, and administrative actions are logged. Files containing personal data, such as courier labels and invoices, are held in private storage and served only through short-lived links.
No system is perfectly secure. If a breach ever puts your rights at risk, we will tell you and the ICO as the law requires.
10. Children
The site is not intended for children, and we do not knowingly collect data from anyone under 16.
11. Changes
We may update this policy. The version on the site is the current one, and the date it was last changed is shown in the admin record. Material changes will be flagged on the site.