Privacy policy

This policy explains how Zinn Digital® Ltd uses personal data when you visit VIP Life Retail at vipliferetail.co.uk, create an account, list a product, buy something or contact us. We follow the UK GDPR, the Data Protection Act 2018, the EU GDPR where it applies, and the Privacy and Electronic Communications Regulations (PECR).

1. Who is responsible for your data

The data controller is Zinn Digital® Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, company number 16385785. For anything about your data, email launch@zinndigital.com or use the contact form and choose "Privacy or data request".

2. What we collect

• Account data: your name, email address, a securely hashed password (or a sign-in link instead), and your settings and notification choices.
• Founder profile data (public): photo, name, role, country, optional city, short bio and the personal links you add (for example LinkedIn or your own website). Your personal email is never shown.
• Listing content (public): what you publish about your product or company, and its edit history.
• Order and billing data: what you bought, the amounts, your billing country and address, VAT number if you give one and its VIES check result, invoices, and payment status. Card and wallet details are handled by our payment providers; we never see your full card number.
• Community data: votes, follows, reviews and comments, with the protective signals used to stop abuse (a random device ID, and hashed network data).
• Messages: what you send through the contact form, support chat or email, and our replies.
• Usage statistics: pages viewed, links clicked, the referring website, device type and country. We count these without cookies, using a code that changes every day and cannot be turned back into your IP address. We collect none of this after you choose "No thanks" in the cookie question, or if your browser sends Do Not Track or Global Privacy Control; visitors in the European Economic Area are counted only after saying yes.
• Technical and security data: IP address, browser details and error reports, used to keep the site working and safe.
• Data about businesses from public sources, for listings we add ourselves: company name, website, description and public founder information.

3. Why we use it, and our lawful basis

Purpose	Lawful basis
Running your account, publishing your listings and profile, and providing what you bought	Contract
Taking payment, issuing invoices, charging and reporting VAT, keeping accounts	Contract and legal obligation
Answering messages and support tickets	Legitimate interests (helping you), or contract where it concerns an order
Service emails (sign-in links, receipts, listing and badge status, security notices)	Contract and legitimate interests
Notifications you choose (votes, comments, milestones) and newsletters	Consent, or for customers our legitimate interests in telling you about similar services (soft opt-in); every email has a one-click unsubscribe
Emailing a business about a listing we added for it, so it can claim or remove it	Legitimate interests (business-to-business, with an easy opt-out)
Preventing fraud, fake votes, spam and attacks; keeping the site secure	Legitimate interests and legal obligation
Cookieless usage statistics to improve the site	Legitimate interests, and your consent where the law requires it
AI drafts and the support assistant	Contract (features you ask for) and legitimate interests

Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (section 8).

4. AI features

When you ask for an AI draft, or talk to the support assistant, the relevant text (for example your website's public pages, your listing, or your message and account details needed to answer it) is sent to Anthropic, which provides the AI models. Anthropic processes it for us under a data processing agreement and does not use it to train its models. AI suggestions never publish on their own and never make decisions with legal or similarly significant effects about you.

5. Who we share data with

We do not sell personal data. We share it only with providers that process it for us under contract, and only what they need:

• Cloudflare: security, bot protection (including the Turnstile human check), content delivery and DNS.
• Hetzner: our servers and backups, in the European Union.
• Stripe, PayPal and NOWPayments: payments, fraud checks and refunds. They are also independent controllers for their own legal duties.
• Resend: sending our emails.
• Anthropic: AI drafts and the support assistant (section 4).
• Google: Search Console (how the site appears in search) and Google Analytics 4, only if you allow analytics.
• Ahrefs and Majestic: website authority data. We send them website addresses, not personal data about you.
• The EU VIES service, to check an EU VAT number you give.

We may also share data with our professional advisers, with authorities when the law requires it, and with a buyer if the site or our company is sold (you will be told).

Public content (your listings and founder profile) is visible to everyone, and is available through our public API, MCP server and feeds, and to search engines and AI assistants.

6. International transfers

Our servers are in the EU. Some providers (for example Cloudflare, Stripe, PayPal, Resend, Anthropic and Google) may process data in the United States or elsewhere. When data leaves the UK or the EEA, we rely on adequacy regulations (including the UK-US data bridge and the EU-US Data Privacy Framework for certified providers) or on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, with extra safeguards where needed.

7. How long we keep it

• Account data: for as long as your account is open, then 30 days.
• Listings: for as long as the listing is published; unfinished drafts are archived after the period set in our listing settings and then deleted.
• Orders and invoices: 6 years after the end of the financial year of the sale (UK tax law).
• Support messages: 3 years after the ticket is closed.
• Email records: 24 months (delivery records and suppression list: as long as needed to respect an unsubscribe).
• Usage statistics: 25 months, without names, emails or full IP addresses.
• Security and error logs: 12 months.

Backups are overwritten on a rolling basis. We keep some data longer only where the law requires it or to deal with a dispute.

8. Your rights

You have the right to: access your data and get a copy; correct it; delete it; restrict or object to how we use it (including any direct marketing, at any time); move it to another service; and withdraw consent at any time without affecting what happened before. Most account and profile data you can view, change or delete yourself in your account. For anything else email launch@zinndigital.com. We answer within one month and may ask you to confirm who you are.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or, in the EU, to the data protection authority where you live or work.

9. Security

We use encryption in transit (HTTPS), hashed passwords, access controls and audit logs for staff actions, regular security updates, monitoring and encrypted backups. No system is perfectly secure; if a breach puts you at risk we will tell you and the regulator as the law requires.

10. Children

The site is for adults running products and businesses. It is not meant for children under 18, and we do not knowingly collect their data.

11. Cookies

Which cookies the site sets and how to change your choice is in the cookie policy.

12. Changes

We will update this policy when our use of data changes. The date at the top shows the last change, and earlier versions stay available on this page. We will email account holders about significant changes.