BUYANDSELLHAIR

Privacy Policy

Updated 2 October 2026. These policies describe the refreshed BuyAndSellHair service. Earlier purchases retain their original commitments.

1. Who is responsible

Vortex Media Ltd operates BuyAndSellHair and is responsible for the personal information described in this notice. For privacy or support enquiries, contact info@buyandsellhair.com.

2. Information used by the service

• Account information: your sign-in identity, email and verification status, and account details you provide. Clerk provides account authentication.
• Adverts: descriptions, hair measurements, asking prices, location details you choose to provide, photographs, publication status and revisions.
• Purchases: site orders, payment-provider references, payment status and the dates of purchased access. Card or PayPal payment details are entered with the payment provider.
• Messages and support: conversations, unread status, notification preferences, reports, support correspondence and staff notes or action history.
• Saved activity: saved searches and other account records, including retained records from the previous site where relevant to the migration.
• Technical information: requests, security events and information needed to provide and troubleshoot the service.

3. What other people can see

Published advert details and the main photograph can be browsed publicly. Additional photographs may require buyer access. Do not include your address, email, phone number or other information in an advert or photo unless you intend viewers to see it. Search engines or other people may retain copies of information that was public.

Drafts, saved searches, account and payment records are not public listings. A conversation is available to its participants. Authorized staff may read it when handling support, safety or moderation, and staff access/actions are audited. Messages are not end-to-end encrypted. Avoid sending unnecessary sensitive information.

Where a parent or guardian lists a child’s hair, they manage the listing and all contact with buyers. We ask them to leave the child’s name, face, school and contact details out of the listing. Contact us if an advert or message exposes a child’s personal information or raises a safety concern.

4. Why information is used

Information is used to operate accounts, publish and manage adverts, provide purchased access, deliver messages, investigate reports, resolve support issues, prevent misuse and maintain reliable records. Legacy records needed for the rebuild are handled through a controlled migration rather than being made public automatically.

Where applicable data-protection law requires a lawful basis, we use information necessary to provide the service you request on the basis of our contract with you, including account management, adverts, paid access, messages and related support. Necessary security, fraud prevention, moderation, service reliability and proportionate record-keeping serve our legitimate interests in running a safe marketplace, balanced against people’s rights. Legal obligations apply to records or disclosures we must keep or make. Optional analytics relies on your consent; marketing requires the permission or other basis required by the law that applies.

Information supplied about another person, including a child in a guardian-managed listing, is limited to what is needed for that listing and safety. Their privacy interests must be respected. Providing someone else’s information is not blanket consent on their behalf. Required account and payment information is needed to provide the relevant service; optional advert details can be left blank where the form permits.

5. Service providers and disclosures

The rebuild uses Clerk for sign-in, Stripe and PayPal for available site-fee payments, Vercel for hosting and image storage, a managed database, and rsync.net for encrypted off-site backups. Providers receive the information needed for their role. Authorized service staff may access records to support and operate the marketplace. Information may also need to be disclosed to meet a legal obligation or address a safety or security issue.

Support email is handled through Google Workspace and Help Scout. The site uses Resend for application email. Our AI support assistant uses OpenAI to review selected support enquiries, prepare replies and flag issues for staff. Selected support text and relevant site guidance are processed for this purpose. Replies currently stay as drafts for staff review; automatic customer sending is off. Staff remain responsible for sensitive decisions, including refunds, identity changes and account access. The assistant cannot change customer passwords, grant paid access or deploy site changes. Site inbox conversations are not automatically supplied to the support assistant.

Some providers may process information outside the country where you live. International processing is subject to the transfer rules and safeguards required by applicable law. You can ask us for information about the providers, processing locations and safeguards relevant to your information. Payment providers may also use information for their own regulated services under their separate privacy notices.

6. Cookies, local storage and notifications

The service uses browser storage and session mechanisms for sign-in and to keep entered advert details and photographs through the listing/sign-up process. Shared devices may retain unfinished work; take care when using one. Security and hosting services may also use necessary cookies.

Message notifications depend on availability and your account preferences. Review-site customer email sending remains disabled. The final cookie information must match the services actually enabled; this rebuild does not carry forward the old policy’s statements about advertising trackers as though they are currently installed.

Optional Google Analytics loads only after you choose Allow analytics. A separate, unchecked choice lets you also measure which Google ads lead to advert purchases; this permits advertising cookies and measurement data sharing with Google Ads. We do not enable personalised advertising. You can decline or change either choice using Cookie choices; preferences are kept for up to 180 days. Existing analytics consent does not opt you into advertising measurement.

We measure public pages and selected steps in creating and paying for an advert. Inbox and admin pages are excluded. We do not send form contents, account or order identifiers, private messages, or search text in these events. If you opt into advertising measurement, a bounded Google ad-click identifier can be retained on a paid-search landing so a later advert purchase can be attributed to that click. Analytics is off on protected previews.

7. Keeping and removing information

Changing an advert’s public status does not necessarily erase its underlying account, transaction or support records. Backups and audit records may need separate handling. A request to delete information must be assessed alongside any obligations to retain it and other people’s rights.

We keep account and advert information while it is needed to provide the service and support returning users. Closed support cases and private conversations are reviewed when they are no longer needed for support or safety. We retain limited payment, dispute and security records where needed for accounting, legal obligations or resolving a claim. An ongoing dispute or legal requirement may justify longer retention. We aim to remove or anonymise information that no longer serves a necessary purpose.

Our normal review point is two years without activity for accounts and adverts, and two years after closure or the last relevant activity for ordinary support cases and private conversations. At review, information that is no longer needed can be removed or anonymised. Active services, unresolved disputes, safety concerns and legal record-keeping duties may require longer retention. These review points are not fixed automatic deletion dates.

Encrypted backups are kept separately for recovery. Information removed from the working service may remain in older backups until they expire. Backups are restricted to recovery and operational purposes; restoring one must not be used to disregard a previously completed deletion request.

8. Your choices and requests

You can update available account details, manage your adverts and use the message controls provided in your account. Depending on the law that applies, you may have rights to access, correct or erase personal information, restrict or object to processing, receive a portable copy, or withdraw consent where processing relies on it. Some rights have exceptions. Contact info@buyandsellhair.com to make a request. We may need to verify identity before acting; do not send us your password or a sign-in code.

You can raise a concern with us or complain to the data-protection authority where you live or work, where applicable. In the UK, this is the Information Commissioner’s Office (ICO). We will explain material changes to this notice and update the date above.