Privacy Policy

This policy explains what personal data minefirst collects, why we collect it, who we share it with, and the rights you have. Graby Ltd, trading as minefirst, is the data controller for the personal data described here.

Data we collect

• Account data: your email address and a password, stored securely and hashed by our authentication provider, never in plain text.
• Alert preferences: the brands, categories, price limits, sizes, conditions, and excluded words you set up alerts for.
• Subscription data: your plan and billing status. Payments are handled by Stripe; we do not see or store your card details.
• Delivery data: your chosen alert channel and, if you enable push notifications, a device push token.
• Alert history: which listings we matched and sent to you, so we can enforce daily limits and avoid repeats.
• Feedback: anything you send us through the feedback form, together with your account email.
• Usage and analytics: how you interact with the service, for example pages viewed and alerts created, collected through our analytics provider.
• Technical data: your IP address is processed to protect the service, for example rate limiting and abuse prevention. We do not use it to locate you.

How we use your data, and our legal bases

• To provide the service (run your alerts, deliver matches by email or push): performance of our contract with you.
• To take payment and manage subscriptions: performance of contract.
• To secure and improve the service (rate limiting, preventing abuse, fixing bugs, understanding usage): our legitimate interests in running a reliable, safe product.
• To send you service messages (alerts you set up, billing, account notices): performance of contract.
• To send marketing (updates and tips): your consent, which you can withdraw at any time in Settings or via the unsubscribe link.
• To meet legal obligations (for example accounting): compliance with a legal obligation.

Who we share it with

We do not sell your personal data. We share it only with the service providers that help us run minefirst, each acting under a contract that requires them to protect it:

• Supabase: our database and authentication provider, hosted in the European Union, which stores your account, alert preferences, and alert history.
• Stripe: payment processing. Stripe collects and holds your payment details directly; we only receive your subscription status.
• Resend: sends our alert and account emails to you.
• Brevo: sends marketing emails, only if you have opted in.
• PostHog: product analytics, hosted in the European Union, which records how you use the service.
• Vercel: our hosting provider, which processes requests to run the site.
• Railway: hosts the background service that scans marketplaces and sends your alerts.

The AI provider we use to screen listings for authenticity receives only marketplace listing data, never your personal data.

International transfers

Our database and our analytics provider are both hosted in the European Union. Some other providers we use may process limited data outside the UK or EEA. Where that happens, we rely on appropriate safeguards such as the provider's UK adequacy status or standard contractual clauses.

How long we keep it

We keep your account data for as long as your account is open. If you delete your account, we delete or anonymise your personal data unless we need to keep some of it to meet a legal obligation (for example billing and tax records held by Stripe) or to resolve disputes.

Deleting your account

You can delete your account at any time from Settings. Deletion is immediate and permanent: your alerts, preferences, push registrations, and account data are erased, and any active subscription is cancelled.

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted ("right to erasure");
• restrict or object to certain processing;
• receive a copy of your data in a portable format;
• withdraw consent (for example to marketing) at any time.

To exercise any of these, email info@saesr.com. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk).

Marketing and unsubscribing

We only send marketing emails if you have opted in. Every marketing email includes an unsubscribe link, and you can withdraw consent at any time in Settings. Withdrawing marketing consent does not stop essential service messages such as the alerts you set up or billing notices.

Cookies

We use a small number of cookies that are essential to sign you in and keep your session active. Our analytics provider may also set cookies to understand usage. We do not use advertising cookies.

Children

minefirst is not intended for anyone under 18, and we do not knowingly collect data from people under 18. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will change the "last updated" date and, for significant changes, tell you directly.

Contact

For any privacy question or request, email info@saesr.com.