Privacy Policy
What we collect, why, who we share it with, and how to exercise your rights.
Last updated
This is a draft, pending review by our lawyers
It describes how Unlockable works today and is published so that it exists rather than because it is final. Sections marked in square brackets are placeholders that must be completed from the company records. It is not legal advice to you, and you should not rely on it as a legal opinion.
This explains what Unlockable does with personal information. It covers the website at unlockable.org, the web app at unlockable.app, and the mobile apps.
DRAFT — pending review by our lawyers. It describes accurately what the service does with data today. It has not yet been reviewed by a qualified lawyer, and the sections marked for confirmation must be settled before this is final. It is not legal advice to you.
Before this is final, these must be completed
The data controller's registered name and address are placeholders. The international transfer mechanism, the retention periods marked for confirmation, and the identity of any Data Protection Officer must all be confirmed. Where personal data is processed on the basis of legitimate interests, a lawyer should confirm that the balancing test has been recorded.
1. Who is responsible for your data
The data controller is [COMPANY NAME TO BE CONFIRMED], registered at [REGISTERED ADDRESS TO BE CONFIRMED]. That is the company that decides how and why personal information is used.
For any privacy question, or to exercise any right in section 9, write to support@unlockable.org. [WHETHER A DATA PROTECTION OFFICER IS APPOINTED, AND THEIR CONTACT DETAILS IF SO, TO BE CONFIRMED.]
2. The short version
- We collect what we need to run a marketplace and meet our legal obligations.
- We never see your card number. Payments go through Stripe and PayPal.
- We do not sell your personal information, and we do not use it for advertising.
- Analytics on this website is off until you agree to it. If you decline, nothing about your visit is sent to Google.
- You can ask for a copy of your data, or ask us to delete it.
3. What we collect, and why
If you sell
| What | Why | Basis |
|---|---|---|
| Name, email address, password | To create and secure your account | Contract |
| Username and public profile | Your content URLs and public pages are built from them | Contract |
| Identity documents and a selfie | Legally required identity checks before paying you | Legal obligation |
| Bank account details | To pay you | Contract |
| Tax information | To meet tax and anti-money-laundering obligations | Legal obligation |
| Files you upload, and their metadata | To store and deliver what you sell | Contract |
| Sales, earnings and payout records | To pay you correctly and keep accounting records | Contract, legal obligation |
If you buy
| What | Why | Basis |
|---|---|---|
| Email address | To send your receipt and your download | Contract |
| Name, and billing country | Fraud prevention and tax records | Legitimate interests, legal obligation |
| What you bought, when and for how much | Your purchase record, and the seller's accounting | Contract, legal obligation |
| Payment method and last four digits | So you and we can identify the transaction | Contract |
You do not need an account to buy. We do not create one for you, and we do not ask for more than the above.
If you just visit
Our servers and our hosting provider keep standard technical logs — IP address, browser type, the page requested and the time — for security and to keep the site working. We do not use them to build a profile of you.
4. Cookies
Necessary cookies
We set only what is necessary for the site and the app to work: keeping you signed in, remembering your theme preference, and protecting forms against cross-site request forgery. These are strictly necessary, which is why they are not subject to a consent choice.
We also store your analytics choice in your browser's local storage. That is not a cookie and it is not sent to us — it exists so we can remember your answer.
Analytics cookies — only with your consent
We use Google Analytics 4 to understand which pages are useful and which are not. It sets cookies and sends data about your visit to Google, including the pages you view, your approximate location derived from your IP address, and your device and browser. Google Analytics does not store your IP address. It is not used for advertising, and we have turned off advertising personalisation and Google signals.
None of this happens unless you press Accept. Before you answer — and if you press Decline — the Google Analytics script is not loaded at all. There is no request to Google, no cookie, and no data about your visit leaves your browser. That is stricter than the usual "load it but ask Google not to store anything" approach, and it is deliberate: it means there is nothing to model, estimate or undo.
Changing your mind
There is a Cookie settings link in the footer of every page. It brings the question back, and if you decline after previously accepting, we delete the analytics cookies that were set.
You can also clear this site's data in your browser, which has the same effect.
5. Identity verification
Before we pay you, we are legally required to verify who you are. We use Veriff, a specialist identity verification provider, for this.
Your identity documents are submitted to Veriff, not to us. We receive the result of the check — whether it passed, and the data needed to make a compliance decision — rather than a copy of your passport. Veriff's own privacy policy governs what they do with the documents.
We never ask for identity documents by email, and neither does anyone acting for us. If you receive such a request, it is not from us.
6. Payments
Payments are handled by Stripe and PayPal. When you pay, you are redirected to the processor and your card details are entered on their page.
We never receive, store or have access to your full card number. We receive confirmation that a payment succeeded, the amount, the currency, and limited reference data such as the card's last four digits for reconciliation.
We also process payments through those providers as a seller ourselves, and we receive fraud and dispute signals from them.
7. Who we share data with
We share personal information only with organisations that help us run the service, and only what each one needs:
| Provider | What they do | What they receive |
|---|---|---|
| Google Cloud / Firebase | Hosting, database, file storage | Everything stored in the service |
| Stripe | Card payments, payouts, fraud signals | Payment and payout data |
| PayPal | Alternative payments | Payment data |
| Veriff | Identity verification | Identity documents and selfie |
| Resend | Transactional email — receipts, notifications | Email address and message content |
| Google (Gemini) | Automatic content screening on upload | The uploaded file |
| Google Analytics | Website usage measurement — only if you consent | Pages viewed, approximate location derived from your IP (the IP itself is not stored), device and browser, and which calls to action were clicked |
We may also disclose information where we are legally required to, where it is necessary to establish or defend a legal claim, or to a buyer or seller where it is needed to resolve a dispute between them.
We do not sell personal information, and we do not share it for advertising.
8. How long we keep it
| What | How long |
|---|---|
| Account and profile data | While your account is open, then [PERIOD TO BE CONFIRMED] |
| Identity verification records | [PERIOD TO BE CONFIRMED — set by anti-money-laundering rules] |
| Transaction and payout records | [PERIOD TO BE CONFIRMED — set by tax and accounting rules] |
| Uploaded content | Until you delete it, plus any backup copy on the backup schedule |
| Server logs | [PERIOD TO BE CONFIRMED] |
| Support messages | [PERIOD TO BE CONFIRMED] |
Backups are retained on a rolling schedule described in our security documentation: point-in-time recovery for seven days, daily snapshots for fourteen days, and a daily export kept for ninety days. Data deleted from the live system therefore disappears from backups within that window.
9. Your rights
Depending on where you live, you may have the right to:
- Ask for a copy of the personal information we hold about you
- Correct anything inaccurate
- Delete it, where we are not required to keep it
- Object to or restrict certain processing
- Receive it in a portable format
- Complain to your data protection authority
To exercise any of these, write to support@unlockable.org. We will respond within the period the law allows. We may need to verify your identity first, particularly where identity documents are involved.
Some rights are limited. We cannot delete transaction records we are legally required to keep, and we cannot delete data that is needed to defend a legal claim.
10. International transfers
Our providers are global, and personal information may be processed outside the country you live in, including in the United States.
[THE TRANSFER MECHANISM — FOR EXAMPLE UK INTERNATIONAL DATA TRANSFER AGREEMENT ADDENDA OR EU STANDARD CONTRACTUAL CLAUSES — MUST BE CONFIRMED WITH EACH PROVIDER BEFORE THIS IS FINAL.]
11. Security
The measures we take are described on the security page, including how payments, files and accounts are protected, and what we do not claim. That page is written from the code rather than from a template, and it says where the limits are.
No system is perfectly secure. If you find a vulnerability, tell us at support@unlockable.org and we will act on it.
12. Children
Unlockable is not for children. You must be at least 18 to sell, and we do not knowingly collect personal information from children. If you believe a child has given us their information, contact us and we will delete it.
13. Changes to this policy
We may update this policy. Material changes will be communicated to account holders before they take effect. The date at the top of this page is when it last changed.
14. Contact and complaints
support@unlockable.org for anything in this policy, including requests to exercise your rights.
If you are not satisfied with our response, you can complain to the data protection authority in your country. [THE RELEVANT SUPERVISORY AUTHORITY FOR THE CONTROLLER TO BE CONFIRMED.]