Legal
Privacy
Version 1, in force since 15 September 2026.
The short version
We collect what the platform needs to work: who you are, the enquiries and messages you send, and aggregate counts of what gets looked at. We do not sell it, and we do not run third-party advertising or tracking.
What we hold
Your account. Name, email address, job title, and which side of the platform you are on. Passwords are stored hashed and cannot be read back, by us or anyone else.
Your organisation. Company name and details, and who belongs to it. Suppliers additionally publish listing content, which is public by design.
What you send. Enquiries, the messages in a thread, quotes, and the projects you attach them to. Both sides of a thread can see it; other suppliers on the same enquiry cannot see each other.
How the site is used. Which listings are viewed and what is searched for. Views are counted with a one-way hash of IP address, browser and date — it rotates daily, cannot be reversed to a person, and answers "how many different people" rather than "who". These raw records are deleted after 90 days; the daily totals derived from them are kept.
On the public pages, and only if you allow it, Google Analytics and Microsoft Clarity collect their own usage data under their own retention. Declining means neither is loaded.
Billing. Handled by Stripe. Card details are entered on Stripe's own pages and never reach our servers. We store the subscription status and invoices.
Why we are allowed to
To perform the contract with you (your account, your enquiries, your subscription); because we have a legitimate interest (keeping the platform working, counting usage in aggregate, preventing abuse); and where you have consented, which you can withdraw at any time.
Who else sees it
Stripe, for payments. Our email provider, to deliver the messages the platform sends. Our hosting provider, which stores the database. We do not sell personal data.
If you allow analytics, Google Analytics and Microsoft Clarity also receive information about how you use the public pages. Clarity records a replay of the page, with text and form fields masked. Neither runs in your workspace or the back office, and neither is loaded at all if you decline — see the cookie policy.
A supplier you send an enquiry to sees that enquiry, your name, and your organisation. That is the point of sending it.
How long
Account data is kept while the account exists. When you ask us to delete it, the account is locked immediately and permanently erased after 30 days — a grace period so a mistaken or hostile request can be undone, not a delay in honouring it.
Usage records are deleted after 90 days. Data exports are available for 7 days and then deleted, because an export is the most concentrated file of personal data this platform produces.
Your rights
From Privacy in your account settings you can download everything we hold about you, and request erasure. Both are self-service and neither requires asking us.
You also have the right to correct what we hold, to object to processing based on legitimate interest, and to complain to your data protection authority.
Contact
Write to the address in the site footer. We answer data requests within one month.