Privacy policy

HitHub is the data controller for the account, shop, listing and order data described in this policy. That means we decide how and why it is used. You can contact us at privacy@hithub.uk.

When an order is placed, we share the details the seller needs to fulfil it. The seller then acts as an independent data controller for their own records and customer service. Their shop and privacy practices apply to how they use that information. We have not appointed a statutory Data Protection Officer.

• Account data: your name, email address, password hash, account role and the date you joined. We never store your password in plain text.
• Shop data: shop name, bio, policies, banner and avatar images, shipping settings, payment gateway preferences, Stripe publishable key, PayPal client ID, and encrypted Stripe/PayPal secret credentials. Secret keys are encrypted at rest.
• Listing data: the cards you list, printing variant, condition or grade, price, quantity, photos and descriptions.
• Order data: buyer name and email, the shipping name and address collected at checkout, the items and amounts, payment provider, provider reference, order status and timestamps.
• Feedback data: the star rating, optional comment and the order a review relates to. Reviews are shown publicly with your first name and surname initial; we do not publish your email or delivery address.
• Contact messages: the name, email address and message you submit through a shop’s contact form. The message is sent to that seller so they can reply.
• Alert data: the cards and sets you watch and the searches you save, so we can email you when a new listing matches.
• Payment data: card details are entered with Stripe or PayPal and are not stored by HitHub. We receive confirmation that a payment succeeded and a provider reference, not your full card number.
• Technical data: our web server keeps standard logs such as IP address, browser type, requested page and time of request. We also use the cookies described below.
• Analytics data: only if you allow analytics, Google Analytics collects information such as the pages you visit, how you arrived at the site, your approximate location derived from your IP address, and device and browser information.
• Support data: any information you send us by email when you ask for help.

We do not use advertising cookies or cross-site advertising trackers. We use Google Analytics 4 only when you choose “Allow analytics”. It helps us understand how the site is used; it is not used to build an advertising profile. We do not send marketing emails. If our use of analytics changes, we will update this policy and ask for consent where the law requires it.

• You give it to us when you sign up, open a shop, list a card, contact support, leave feedback, message a seller, watch a card or set, or save a search.
• It is created when you use the marketplace — for example, when an order is placed or a shop is reviewed.
• Payment providers return order and shipping details to us after checkout so we can create your order record and show it to you and the seller.
• Our server automatically records technical information when your browser requests a page.

• To provide the service (contract): creating and securing your account, running your shop, publishing listings, taking and recording orders, connecting seller payment accounts, and answering support requests.
• To operate buyer feedback and shop contact (contract / legitimate interests): publishing verified reviews, showing shop ratings, and passing contact-form messages to the seller so they can respond.
• To send alerts you request (consent): emailing you when a new listing matches a card, set or search you chose to watch. You can remove any alert from your account page.
• To keep the marketplace safe (legitimate interests): preventing fraud, counterfeit listings, abuse and security threats; reviewing shops; and enforcing our Terms & conditions.
• To understand how the site is used (consent): if you allow analytics, Google Analytics helps us see which pages are useful, how buyers and sellers move through the marketplace, and where the site needs improving.
• To meet legal duties (legal obligation): keeping records for tax, accounting, consumer protection and lawful requests from public authorities.
• To establish or defend legal claims (legitimate interests): retaining order records if a dispute, chargeback or legal claim arises.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights. You can object — see section 9.

• The seller: when you buy, we share the buyer name, email, shipping name and address, items purchased and order details with that shop so it can fulfil the order and handle customer service. If you use the shop contact form, we also send your name, email and message to that seller so they can reply.
• Stripe and PayPal: payments are processed on the seller’s own account. The provider receives the information needed to take payment and may collect your card and address details directly. See the Stripe privacy policy and the PayPal privacy policy.
• Google Analytics: if you allow analytics, Google LLC processes analytics data on our behalf so we can understand how the site is used. See the Google privacy policy.
• Hosting and service providers: our hosting, database, backup and email providers process data on our instructions and under confidentiality and data protection terms.
• Legal and safety: we may share information if required by law, to investigate fraud or abuse, to protect someone’s safety, or to establish or defend legal claims.
• A business transfer: if HitHub is sold or merged, data may transfer to the successor, subject to this policy and applicable law.

We do not sell your personal data.

We use essential cookies to keep you logged in and remember your cart. We use Google Analytics 4 only if you choose “Allow analytics” in the cookie banner. You can change your choice at any time using the “Cookie settings” button in the footer. Rejecting analytics does not affect checkout, your account or any other part of the marketplace.

Google may set additional cookies described in its cookie policy. You can clear cookies through your browser settings. Clearing the session cookie logs you out, clearing the cart cookie empties your cart on that device, and clearing the consent preference makes the cookie banner appear again.

HitHub is based in the UK and aims to keep its core hosting and database in the UK. Some providers — particularly Stripe, PayPal and, if you allow analytics, Google — may process data in the United States or other countries. Where data leaves the UK, we rely on an adequacy regulation or appropriate safeguards such as the UK International Data Transfer Addendum or standard contractual clauses. You can ask us for more information about the safeguards used.

• Account and shop data: while your account is open. If you ask us to close it, we will delete or anonymise it within 30 days, except where we need to keep records for legal reasons.
• Sessions: up to 30 days from login, or until you log out.
• Password reset links: stored as a hash; unusable after 60 minutes and deleted when used or replaced, or within 7 days of expiry.
• Cart: up to 30 days, or until you clear it or complete checkout.
• Order records: up to six years after the order, to meet accounting, consumer protection and dispute needs. Sellers may keep their own copies for the same reasons.
• Reviews: while the shop is active, or until you ask us to remove your review. We may retain a record that a review was submitted to prevent duplicate feedback.
• Contact messages: in the seller’s email inbox and our email records for as long as needed to handle the enquiry and keep a record of our dealings.
• Watchlist and saved searches: while your account is open or until you remove the alert. Alert emails are kept in our email records in the same way as support email.
• Server logs: for a short period, normally no more than 30 days, unless needed to investigate a security incident.
• Analytics: if you allow analytics, Google Analytics retains event data for up to 14 months. Our Google Analytics property is configured to retain it for no longer than that.
• Support emails: for as long as needed to resolve the issue and keep a record of our dealings.

Under the UK GDPR, you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete data where there is no good reason for us to keep it;
• ask us to restrict how we use it while a concern is investigated;
• receive data you gave us in a portable format, where applicable;
• object to processing based on legitimate interests, including profiling;
• withdraw consent at any time, where we relied on consent;
• complain to the Information Commissioner’s Office (ICO), the UK regulator.

To exercise a right, email privacy@hithub.uk. We may ask for proof of identity, and we will normally respond within one month. The right to object to legitimate interests is not absolute; we may continue if we have compelling grounds that override your rights. You can contact the ICO at ico.org.uk or on 0303 123 1113, although we would appreciate the chance to address your concern first.

We use HTTPS across the site, hash passwords, encrypt seller payment secrets, restrict access to production systems, and keep backups. No online service can be completely secure. If you believe your account or a seller’s credentials have been compromised, email support@hithub.uk straight away.

HitHub is intended for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will investigate and remove the data where appropriate.

We may update this policy as the marketplace or the law changes. The revised version will be posted here with a new “last updated” date. If a change is significant, we will take reasonable steps to let account holders know.

For any privacy question or request, email privacy@hithub.uk. For general marketplace support, use support@hithub.uk.