Privacy
This explains what we collect when you use Classiry, why we collect it, what legal basis we rely on, how long we keep it, and what you can make us do about it. It is written to be read, not to be survived.
1. Who is responsible
Classiry is operated by Bolrach Technologies Limited, which is the data controller for everything described here. You can reach us through a support ticket, which is the fastest route and creates a record both of us can refer back to.
2. What we collect
Because you gave it to us
- Your email address and a password, which is stored only as a hash and never in plain text.
- Your display name, and a neighbourhood if you set one.
- Listings, requests, messages, offers and reviews you write.
- Payment details, which go to our payment provider and are never stored on our systems.
Because you used the service
- Which listings you viewed and saved, so search and alerts can work.
- Approximate location, to the neighbourhood, so distance can be shown.
- Technical data: IP address, device and browser, and the pages you requested.
What we deliberately do not collect
- Your exact address. We store the neighbourhood; your street and door number are never shown on a listing, in a message, or through the API.
- Your phone number, unless you type it somewhere yourself.
- The identity document used in a verification check. We keep the result, not the document.
3. Why we may use it
| Purpose | Data | Lawful basis |
|---|---|---|
| Running your account | Email, password hash, display name | Performance of a contract |
| Showing and searching listings | Listing content, neighbourhood, saves | Performance of a contract |
| Classiry Shield checks on every listing | Listing text, photos, price, account history | Legitimate interests: keeping a marketplace usable and preventing fraud |
| Identity and address verification | Document check result, address confirmation | Legitimate interests, and legal obligation where it applies |
| Holding and releasing payment | Transaction records, deal history | Performance of a contract, and legal obligation for records |
| Alerts you asked for | Saved searches, email address | Consent, withdrawable at any time |
| Advertising measurement | Ad impressions and clicks | Consent, through the cookie banner |
| Investigating abuse and disputes | Messages, offers, reports, scan results | Legitimate interests, and legal claims |
4. Identity checks
Trust levels are the point of this product, so it matters how they are earned. An identity check matches a government document to a live selfie through a specialist provider. We receive the outcome, the date, and the document type. We do not keep the image of the document.
An address check is a code sent by post. All we learn, and all we store, is that you could receive post at the address you gave.
5. Who else sees it
- Other members see your display name, trust level, rating, neighbourhood and your listings. That is what the seller page shows.
- Our providers: hosting, storage, email delivery, identity verification, payment processing. Each is bound by contract to use the data only to provide that service.
- Authorities, where we are legally required, or where it is necessary to establish or defend a legal claim.
We do not sell personal data, and we never have.
6. Sending data abroad
Some providers operate outside your country. Where that happens we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum where the UK regime applies, together with additional technical measures such as encryption in transit and at rest.
7. How long we keep it
| What | How long | Why |
|---|---|---|
| Account and profile | While the account is open, then 30 days | So a deletion can be undone if it was a mistake |
| Listings and requests | While live, then 12 months | Disputes and repeat-offender detection |
| Deal messages, offers, meetings | 6 years from the deal | Limitation periods for contractual claims |
| Payment and payout records | 7 years | Tax and accounting obligations |
| Verification outcomes | While the account is open, then 12 months | Fraud prevention |
| Technical logs | 90 days | Security and abuse investigation |
8. Your rights
You can ask us to:
- give you a copy of your data, in a portable form;
- correct anything that is wrong;
- delete it, where we do not have to keep it for the reasons in the table above;
- restrict or object to a use that relies on legitimate interests;
- withdraw a consent, which does not affect anything done before you withdrew it.
Open a ticket and we will answer within one month. If you are not satisfied you can complain to your data protection supervisory authority; in Nigeria that is the Nigeria Data Protection Commission, and in the EU or UK it is your national regulator.
9. How it is protected
Passwords are hashed with Argon2. Traffic is encrypted in transit and data is encrypted at rest. Access to production data is limited to the people who need it and is logged. Payment card details never touch our servers.
10. Children
Classiry is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has an account, tell us and we will remove it.
11. Changes
If we change something that matters we will say so on this page and, for a material change, by email before it takes effect.