Privacy

This notice explains how Acre collects, uses, shares, and protects personal data when you visit our sites, use the platform, contact us, or buy through an Acre store.

1. Who is responsible

The operator identified in your Acre account, invoice, or other commercial documentation is responsible for Acre's own processing. For buyer data processed on a seller's instructions, the seller is the controller and Acre acts as its service provider or processor.

2. Data we collect

• Identity and contact data, such as name, email address, and support messages.
• Account and business data, such as workspace, store, offers, and settings.
• Transaction data, such as orders, prices, refunds, and payment status.
• Content and files uploaded to create, sell, or deliver an offer.
• Technical data, such as IP address, device, browser, logs, and security events.
• Usage data, such as pages viewed, checkout events, and feature interactions.
• Information received from Stripe, Supabase, and other providers you connect.

Acre does not receive or store full payment-card numbers. Stripe processes card details.

3. How we use data

• Provide accounts, storefronts, checkout, delivery, support, and administration.
• Process transactions, refunds, subscriptions, payment plans, and access rights.
• Authenticate users, prevent fraud, enforce policies, and secure the service.
• Send service messages, receipts, access links, and account notices.
• Measure performance, diagnose errors, and improve Acre.
• Meet legal, tax, accounting, and regulatory obligations.

4. Legal bases

Where UK or European data protection law applies, we rely on performance of a contract, legitimate interests in operating and securing Acre, compliance with legal obligations, and consent where required. You may withdraw consent at any time, without affecting earlier processing.

5. Sharing

We share data only where needed with sellers and buyers involved in a transaction, payment providers such as Stripe, infrastructure and authentication providers such as Supabase, hosting providers, email providers, analytics and error-monitoring providers, professional advisers, and authorities where legally required. Providers may only use data for the services they provide to us, subject to their contracts and applicable law.

6. International transfers

Some providers may process data outside the United Kingdom or your country. Where required, we use recognised safeguards such as adequacy regulations or approved contractual clauses.

7. Retention

We keep personal data only as long as needed for the purposes above. Account and transaction records may be retained after account closure to meet payment, tax, fraud-prevention, dispute, and legal requirements. Security logs are retained for a proportionate period. Uploaded content is deleted or anonymised under our retention process unless it must be preserved.

8. Security

We use access controls, encryption in transit, protected storage, signed links, logging, monitoring, and tested operational procedures. No system can guarantee absolute security. Contact us promptly if you believe an Acre account or buyer record has been compromised.

9. Cookies and local storage

Acre uses essential cookies and local storage for authentication, security, checkout idempotency, referral attribution, and user preferences. We may use privacy-conscious analytics to understand aggregate site usage. Where consent is legally required for a non-essential technology, we will request it before use.

10. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data, and to complain to a supervisory authority. We may need to verify your identity. For buyer data controlled by a seller, we may direct your request to that seller.

11. Children

Acre accounts are not intended for people under 18. Sellers must not knowingly use Acre to collect children's data without the permissions and safeguards required by law.

12. Changes and contact

We may update this notice and will identify the effective date above. Privacy questions and rights requests may be sent to privacy@runacre.com. You may also complain to the UK Information Commissioner's Office or the relevant authority in your country.