Privacy Policy

Effective 18 October 2026

What we collect, why we collect it, and the controls you have.

In short

Key points

We only collect what we need to run your account and process payments
Card details go straight to Stripe (PCI-DSS Level 1) and are never received by us; we keep only the card brand, last four digits and issuing country against your order
We do not sell your data and do not use account data to train AI models
You can access, correct, port, or delete your data. Write to support@supa.place
We comply with the Australian Privacy Act and the Notifiable Data Breaches scheme
You must be 18 to use supa.place; the service is not directed to anyone under 18

Who We Are

supa.place is operated by Noah Harvard Biesse, trading as SUPA PLACE, ABN 44 590 119 237, an Australian sole trader. In this policy “supa.place”, “we” and “us” mean that business, and it is the data controller for the personal information described here. Where the EU or UK GDPR applies, it is the controller for the purposes of those regulations.

Contact. support@supa.place reaches us for any privacy question, request or complaint, and is the fastest route. Our registered business address and phone number are published under “Business identification” in the footer of every page except sellers’ storefronts (the pages at supa.place/@username).

We have not appointed a data protection officer, and are not required to: we do not carry out large-scale monitoring or process special categories of data at scale. Privacy requests are handled directly by the business owner.

Information We Collect

To provide our service, we collect the information you give us: your name and email for account creation, profile details, content you upload, and messages you send to other users on the platform. When you make a purchase, we collect the billing country you select and, if you provide one, a business tax or VAT identification number, so we can calculate any tax due and issue a valid tax invoice. Card details are entered directly into the secure fields hosted by our payment provider and are never received or stored by us. What the provider does return to us, and what we keep against your order, is limited to: the card brand and last four digits (so your receipt and purchase history are recognisable), the country that issued the card, and the payment and refund reference numbers the provider assigns. We use the card-issuing country as corroborating evidence of where you are located for consumption-tax purposes, alongside the billing country you select and your IP country, so that our record of where you were located rests on more than your own selection alone. If you open an account after following one of our invite links, or after typing an invite code into the Referral code box when you sign up, we record which link or code it was, so we can see which of our invitations bring people to supa.place; we also count visits to each link. Some invite links and codes belong to partners we pay for bringing sellers to supa.place: for those, we also use this record to work out the share we owe the partner of what we earn from that account. We pay that share out of our own earnings, so it never changes your fees. Links and codes from some partners also come with our Founder tier, and for those we use this record to offer it to you once your identity check has passed. If you buy through a seller’s payment link or buy button, we record which one it was (and any tag the seller added to the link) with your order, and the seller sees it with the sale. In the same way, we record how you reached each seller you buy from in the same browser tab (a link to their storefront or one of their products from another site, a search engine, or browsing supa.place), and that seller sees it with their sale; we never record the address of the site you came from. We also note on your order whether it is your first on supa.place, for our own figures; sellers do not see this. We also collect basic technical information, such as IP address, device, and browser type, that we need to keep the platform secure and reliable.

Legal Basis for Processing

We process personal information on the following bases:

Contract: to run your account, process your payments, and deliver products you purchase.
Consent: where required, for non-essential cookies, optional marketing communications, or sharing your email with a creator you choose.
Legitimate interests: to operate, secure, and improve the platform, balanced against your privacy.
Legal obligation: to meet tax, anti-fraud, accounting, and information-request requirements.

Where the EU General Data Protection Regulation (GDPR) or UK GDPR applies to you, these are our Article 6 lawful bases. The face match in a seller's identity check also uses biometric data, for which we rely on your explicit consent under Article 9 (see Didit under Service Providers and Data Sharing).

How We Use Your Information

Your information is used to operate and improve supa.place. This includes processing payments, enabling communication between buyers and sellers, personalising your experience, and protecting the platform from fraud and abuse. We infer your approximate country from your IP address to display prices in your local currency by default, and we use the billing country you confirm at checkout to determine any consumption tax due on your purchase; you can change your currency at any time from Dashboard → Settings. A couple of days after you first download a purchase, we may email you to ask how it was and invite a review. We ask about each purchase once, and never send more than one of these emails every two weeks; each one has a link to stop them, and with an account you can also turn them off in Dashboard → Settings → Notifications. We do not sell your personal data to third parties, and we do not use your account data to train AI models.

Key point

Service Providers and Data Sharing

We share data only with the service providers we need to run the platform, and with a creator when you choose to share your email with them (see Sharing Your Email With Creators):

Stripe: card and wallet payment processing, fraud screening, and refunds. Stripe receives your card details directly from your browser, along with your email address and billing country, and acts as an independent controller for its own fraud-prevention and regulatory purposes. Stripe is a United States company and also operates through local entities including Stripe Payments Australia Pty Ltd.
Airwallex: the accounts that hold settled funds, currency conversion, and payments out to sellers. Airwallex receives the payout details the seller's bank country requires: the bank account details and the account holder's name and, where that country's banks require them, an address and an email address; it does not receive buyer card details.
Klarna, Apple Pay, Google Pay and Link: alternative ways to pay, offered at checkout alongside the card form depending on your device, browser and country. These run inside the payment sheet, so if you choose one you deal with that provider directly: it receives the payment details you give it, the order amount and currency, and the email and billing address you supply in its sheet, and it hands back to us only what we need to fulfil the order. Each acts as an independent controller for its own purposes, and Klarna additionally assesses you for the credit it is providing. If you never select one of these, it receives nothing about you. supa.place is not a party to your agreement with any of them.
Didit: identity verification for sellers only, which is required before a seller can launch products or receive payouts. Didit carries out the check for us, as our processor. When you verify your identity as a seller, Didit photographs your government-issued photo ID and reads the details printed on it (such as your name, date of birth and nationality, and your address where the document shows one), takes a live selfie to confirm you are really there, and compares your face in the selfie with the photo on the ID (a face match). It also checks the IP address you verify from, and we give it your account email address, the country you registered in and a reference to your account (and, for a business check, the company name and registration number you gave us and the name on your verified ID) to check against what it reads. It uses these to confirm the document is genuine, that you are the person it belongs to, and to screen your name against international sanctions and politically-exposed-person lists, which we are required to check before paying anyone out. For a business, Didit also checks the company against its official register, including its key people, and reviews the company documents you upload.
The selfie and the face match are biometric data: information about your face, used to confirm who you are. Under the GDPR and UK GDPR that is a special category of personal data, and under the Australian Privacy Act it is sensitive information. It is used only to verify your identity as a seller, so that you can launch products and be paid. Where the GDPR or UK GDPR applies we rely on your explicit consent to it (Article 9(2)(a)), and under the Privacy Act we collect it only with your consent. You give that consent by choosing to start the check, which we tell you beforehand needs a photo ID and a live selfie, and you can stop at any point before you submit; without a passed check, though, you cannot launch products or receive payouts.
supa.place receives the outcome of each check and a reference to the session, and uses the outcome to show you where your check stands. When a check passes, we also keep the details Didit verified: the name, date of birth and nationality read from your ID, the type of document and the country that issued it, and the result of the sanctions and politically-exposed-person screening (its status, a risk score, whether there were any matches and how many). For a business we also keep the company details Didit found in the official register (name, registration number, country, company type, tax number, date of incorporation, registry status and a risk level) and how they compare with the details you gave us. We use these details to check the name on a payout account (see Automated Decision-Making) and as our record of the screening. We never store images of your ID document, your selfie, your document number or a template of your face: those stay with Didit, under its own retention schedule. When a check is referred for a person to review, the alert we are emailed lists the checks that held it, with Didit's score and warning for each (for example a low face-match score), so we can review it in Didit's systems. Buyers are never asked to verify identity, and Didit receives nothing about buyers.
Google Cloud / Firebase: application hosting, authentication, database (Firestore), and file storage.
Google reCAPTCHA: bot and abuse protection. Firebase App Check attaches a token to the requests your browser makes to our sign-in, database, file storage and server functions, and it earns that token through Google reCAPTCHA v3, which tells people from automated traffic. It runs in the background, with no puzzle to solve: Google's script collects information about your device and browser and how you interact with our pages (such as your IP address and browser details) and sends it to Google, which scores how likely the visitor is to be a bot. Your browser receives a token only with a good enough result, and some of our services refuse a request without one, such as signing in with a username, resetting a password, changing your email address and sending the help contact form, so blocking reCAPTCHA (as some content blockers do) can stop those from working. reCAPTCHA starts the first time you scroll, tap, click or press a key on a page (or, if you are already signed in, shortly after a page loads), whether or not you have answered the cookie banner, and declining analytics does not turn it off. Google processes this information under its own Privacy Policy and Terms of Service, and sets its own cookie, _GRECAPTCHA (see Cookies and Tracking).
Resend: transactional email delivery (receipts, verification, password resets, refund notifications).
Zoho: hosts our support mailbox (support@supa.place), so the messages you send us there, with your email address and anything you include, are stored and processed by Zoho.
YouTube and Vimeo: a product's gallery or description can embed a video the seller hosts with one of them. When that video is displayed, its player loads from YouTube (through its privacy-enhanced youtube-nocookie.com domain) or from Vimeo, which sends your IP address and browser details to that provider.
PostHog: product analytics (pageviews, feature-usage events, and JavaScript error reports) to help us understand how the site is used and diagnose bugs. This runs in your browser only if you accept analytics, and while you are signed in it is linked to your account ID, username and seller tier; each event also carries the country we derive from your IP address. Separately, whatever your cookie choice, our servers send PostHog order-level figures (an order paid or a free order claimed, a Diamond subscription started, a refund approved: the amount, currency, item count and order reference) and server error reports, so we can report revenue and fix faults. These carry no account ID, name or email and are not linked to a person. Session recordings, autocapture, and surveys are disabled.
Google AI (Gemini): powering the “Ask Supa” assistant on our Help page (see AI Processing below).
EU VIES (European Commission): if you enter an EU business VAT number at checkout to claim reverse-charge (B2B) treatment, we send that VAT number and your country to the EU Commission's VIES service solely to confirm the number is valid.
HM Revenue & Customs (UK): we report and remit the UK VAT we collect to HMRC under Making Tax Digital; those returns carry VAT totals for the period, not your individual purchase details. UK VAT registration numbers are not accepted at checkout yet, so none is sent to HMRC to be checked.

Where we act as the merchant of record for consumption tax (VAT), we report and remit the tax we collect to the relevant tax authorities: the EU member states (through the EU One Stop Shop) and, for UK supplies, HMRC. These filings report VAT aggregated by country and rate, not your individual purchase details; the underlying transaction and tax-invoice records are retained to meet our tax obligations (see Data Retention). When you list a public profile or leave a public review, that information is visible to other users. If you are a seller and turn on Location in your account settings, your storefront also shows the country you registered in as a seller; it stays hidden unless you turn it on. We may also share information when required by law, regulation, or valid legal process, or to protect the rights, safety, and integrity of supa.place and its users.

AI Processing

The “Ask Supa” assistant on our Help page is an AI service powered by Google Gemini. The questions and conversation history you submit during a session are sent to Google to generate a response. We do not retain those conversations after your session ends, and they are not used to train Google's models under the service tier we use. Please do not share account credentials, payment details, or sensitive personal information with the assistant; for those, use the human contact form on the same page.

International Data Transfers

Some of the service providers listed above process data outside Australia, including in the United States, the European Union and the United Kingdom. Payment data in particular is processed by Stripe in the United States, and settlement and payout data by Airwallex in the jurisdictions where it holds our accounts. Where we act as the merchant of record for consumption tax (VAT), a limited amount of transaction and VAT-number data may also be shared with EU tax authorities, the EU VAT-validation service (VIES), and HM Revenue & Customs in the United Kingdom, to charge the correct tax and validate business VAT numbers. When personal information is transferred internationally, we rely on the safeguards required by the Australian Privacy Act and, where applicable, the GDPR Standard Contractual Clauses or equivalent mechanisms approved by the relevant authorities.

Data Retention

We keep personal data only for as long as we need it. As a guide:

Account information: while your account is active, plus up to 12 months after deletion to handle disputes and legal requests.
Purchase, refund, payout, and tax-invoice records: 10 years, to meet Australian tax and accounting rules and, where we act as merchant of record, EU VAT record-keeping obligations (the EU One Stop Shop record-keeping period). The same 10 years comfortably covers the UK's 6-year VAT record-keeping requirement.
Identity check records (the outcome of a seller's checks and the verified details listed under Didit, never images of your ID or your face): while you have an account, then for 10 years, the period we keep the payout records they support. The images and selfie themselves stay with Didit, as described there.
Support correspondence: up to 24 months.
Email sharing: your address stays on a creator's list while you share with them and for 30 days after you stop, then we delete it. Our record of each choice (which creator, the wording you saw and when), with your address stored only in hashed form, is kept with the order records for 10 years.
Review requests: your email address is kept with your queue of purchases waiting to be asked about, and removed once nothing is waiting. So that we never ask about the same purchase twice, and never email more often than every two weeks, we keep which purchases we asked about and when, filed under a hashed form of your address. Closing your account deletes the queue; if you stop these emails, we keep the hashed address only to remember not to send them.
Server and security logs: up to 12 months.
“Ask Supa” chat content: not retained after the session ends.

After these periods, data is deleted or irreversibly de-identified.

Key point

Security

We take the security of your data seriously. All payment processing is handled by Stripe, a PCI-DSS Level 1 provider. Internally we use access controls, encryption in transit, Firebase App Check with Google reCAPTCHA to keep bots and automated abuse away from our services (see Google reCAPTCHA under Service Providers and Data Sharing), and monitoring to guard against unauthorised access. While no online service can be perfectly secure, we apply industry-standard protections and review them regularly.

Your Rights and Choices

You have the right to:

access the personal information we hold about you;
correct or update inaccurate information;
delete your account and associated data, available in Dashboard → Settings → Account → Delete account, or by writing to support@supa.place;
restrict or object to certain processing;
receive your data in a portable format;
withdraw consent where you previously gave it; and
lodge a complaint with the Office of the Australian Information Commissioner (OAIC), or a relevant supervisory authority outside Australia.

We will respond to verified requests within 30 days. Some statutory and tax records (see Data Retention) cannot be deleted before their retention period expires, but those records are not used for any purpose other than the legal one for which they are kept.

Key point

Data Breach Notification

If a data breach occurs that is likely to result in serious harm to affected users, we will notify those users and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme of the Australian Privacy Act 1988. Where the GDPR or UK GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, in line with Article 33.

Age Requirement and Minors

You must be at least 18 years old to use supa.place, as set out in our Terms of Service. The service is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If we become aware that an account belongs to someone under 18 we close it and delete the personal information held for it, other than any record we are legally required to keep. If you believe a minor has provided us with personal information, please contact support@supa.place and we will delete it.

Cookies and Tracking

We use cookies and similar technologies (your browser's local and session storage, and its IndexedDB database) in three groups. Strictly necessary items keep you signed in, protect the site and your account, make checkout, your cart and downloads work, and keep work you have not saved yet. Preferences remember choices you make, such as your theme and currency, and keep pages the way you left them. Both groups are always on: the site cannot work without the first, and the second only remembers what you chose. Analytics (PostHog, and keeping on your device which of our invite links, or which seller's payment link or buy button, brought you) is optional and stays off in your browser until you accept it on the consent banner shown on your first visit. Without that consent, the link you arrived through is held only in the open page's memory, which stores nothing and ends when you close or reload the page. The choice does not cover the order-level figures our servers record without linking them to you (see Service Providers and Data Sharing), our record of which invite link or code an account was opened through, or our record of which payment link or buy button an order came through (see Information We Collect). You can change your choice at any time via the Cookie preferences link in the site footer, or control cookies directly through your browser settings.

Google reCAPTCHA, which keeps bots away from our services (see Service Providers and Data Sharing), is part of the strictly necessary group. It starts the first time you scroll, tap, click or press a key on a page (or, if you are signed in, shortly after a page loads), whether or not you have answered the cookie banner, and declining analytics does not turn it off.

Everything supa.place stores on your device is listed below, with the cookies Google reCAPTCHA and Stripe set while you use our pages. Names ending in * stand for a family of entries that share that start.

Name	Kept in	Purpose	Retained	Leaves your device
Strictly necessaryAlways on: sign-in, security, checkout, your cart and downloads, and work you have not saved yet.
gc	cookie	Holds the three-letter code of the currency for the country we derive from your IP address (for example EUR), so prices can default to your local currency without detecting it again on every page.	30 days	With every request to our site, as every cookie is, but only read in your browser
guestDlToken	cookie	Proves a guest download link belongs to you, so you can download what you bought without an account. Server-only (HttpOnly) and scoped to the download endpoint.	1 hour	To our download service only
firebase:authUser:*	local storage	Keeps you signed in between visits: your account ID, email address, the name and profile photo you signed in with, and the tokens that renew your session. Set by Firebase Authentication, our sign-in provider.	Until you sign out	Its tokens go to Google (Firebase) to renew your session, and to our services to identify you
Firestore offline cache, firestore_*, spFirestoreCacheWipe	IndexedDB and local storage	Firestore, our database, keeps a copy of what the site has loaded for you (such as your profile, cart, notifications, messages and the products you looked at) in an IndexedDB database whose name starts firestore/, so pages can load from your device first. The firestore_* entries let your open tabs share that copy, and some carry your account ID in their name. spFirestoreCacheWipe marks the copy for clearing after you sign out.	Until you sign out, then cleared on a later visit once no other supa.place tab is open; older entries are dropped as the copy fills up	No: it is a copy of what our servers sent you, and changes you make go to us as you make them
firebase-app-check-database	IndexedDB	Holds the short-lived Firebase App Check token that Google reCAPTCHA earns your browser, which shows our services that a request comes from our site rather than from a bot (see Google reCAPTCHA under Service Providers and Data Sharing).	Short-lived; replaced automatically while you use the site	With each request to Google (Firebase) and to our services
firebase-heartbeat-database	IndexedDB	Firebase’s own record of which versions of its software ran on which days. It holds no identifier.	Up to 30 days of entries	To Google, with Firebase requests
_GRECAPTCHA	cookie set by Google on google.com	Google reCAPTCHA’s cookie, used to tell people from bots when App Check checks your browser (see Google reCAPTCHA under Service Providers and Data Sharing). The reCAPTCHA script may also keep its own entries in your browser storage for the same purpose.	Set by Google, which states 6 months	To Google
__stripe_mid, __stripe_sid	cookies set by Stripe	Stripe’s fraud-prevention cookies, set on supa.place by Stripe’s payment script when the cart, the checkout or the Diamond payment form loads, so Stripe can recognise the device and spot fraud.	Set by Stripe: up to 1 year (__stripe_mid) and 30 minutes (__stripe_sid)	To Stripe, and with every request to our site, as every cookie is
cookieConsent	local storage	Records your cookie choice and when you made it, so we do not ask again on every visit and analytics stays off unless you accepted it.	Until cleared	No
cart, recipientEmail	local storage	While you are signed out, remembers what is in your cart (each product, tier, name, price and image) and the email address you last entered at checkout, so neither is lost if you navigate away or reload. When you are signed in, your cart is kept with your account instead.	Until you sign in, sign out or complete a purchase, each of which empties it	The cart moves to your account when you sign in; the email address goes with your order
guestPiSecrets, lastCheckoutIntentId, checkoutPendingIntent, receiptCartCleared:*	session storage	Carry a payment through to its receipt in this tab: the reference and secret of each payment you make (the secret proves to us that this browser completed that checkout, so your receipt and any guest downloads load, including after Klarna or your bank sends you back), and which receipt may empty your cart.	Until you close the tab	The payment reference and secret go to us to load your receipt and downloads; the rest stay on your device
guestOwnedProducts, guestOrderMap, guestPiEmails	session storage	After you buy as a guest, or open the access link we email you, remember in this tab which products you bought, with the order reference and email address for each, so product pages show them as yours and can offer the receipt, a review and updates on a refund request. guestPiEmails fills in the support email on the receipt page if your receipt fails to load.	Until you close the tab (the first two also when you sign in or out)	Order references and email addresses go with your requests about those orders
discountCode	session storage	A seller’s discount code that arrived in a link you followed (?code=), so checkout can apply it without you typing it.	Up to 24 hours, until you close the tab, or until you remove the code or complete a purchase	With your checkout, so the code can be applied
awaitingEmailVerification, pendingUsername, pendingUserCurrency	local storage	While a new account waits for its email address to be verified: its account ID, the username you chose and a currency guessed from your location, time zone or browser language, so your profile can be created with them once you verify, even from the link opened in another tab.	Until your profile is created or you sign out	The username and currency go to us when your profile is created
emailVerificationLastSent	local storage	The account ID and time a verification email was last sent from this browser, so the resend button waits 5 minutes between emails.	Until cleared; replaced at each send	No
lastAuthUid	local storage	The account ID last signed in on this browser, so that when a different account signs in, the earlier account’s unsaved product drafts are removed rather than shown to it.	Until cleared; replaced at each sign-in	No
postLogoutRedirect	session storage	Set for a moment while you delete your account, so you land on the sign-up page afterwards.	Removed as soon as it is used	No
draftProduct:create, draftProduct:create:media, draftProduct:edit:*	local storage	For sellers: your unsaved product (its text, settings and prices, and which picked file goes where), so a reload or a closed tab does not lose your work.	Until you save, launch or discard the product, or sign out	Only when you save or launch the product
supa-place-draft-files	IndexedDB	For sellers: copies of the files you have picked for a new product that is not saved yet (up to 512 MB per draft), so a reload does not lose them.	Until you save, launch or discard the draft; files kept when you sign out stay, unused, until the next draft on this device is saved or discarded	Only when you save or launch the product, when they are uploaded
discountDraft	session storage	For sellers: a sale you are setting up (the product, the discount and its dates), so a reload does not lose it.	Until you create the sale or close the tab	Only when you create the sale
sellerReg_draft, sellerReg_mfaNagged	session storage	Seller registration: your answers so far (the step you are on, your country, whether you sell as an individual or a business, a company name and registration number, and which version of the seller statement you ticked), and whether the two-factor reminder has been shown in this tab.	Until you close the tab; your answers also go once you finish registering	Your answers are sent when you confirm your details
refundReceiptsBackfillRan:*	session storage	Notes, under your account ID, that a one-off check that your refund receipts are complete has already run in this tab, so it is not repeated on every page.	Until you close the tab	No
PreferencesAlways on: choices you make, and pages kept the way you left them.
themePref, accentColor, notificationSettings, currency	local storage	Display preferences you set: light, dark or system theme; your accent colour (signed in only, copied from your account); which notifications you see and which are emailed to you; and, while you are signed out, your chosen display currency (only a currency you pick is stored, never the one we detect).	Until cleared (accentColor until you sign out)	A display currency you picked goes with a checkout, which charges in it; the rest stay on your device
marketplaceReveal, nav-history-v1, cosmosSeed	session storage	Keep pages the way you left them in this tab: how far down each marketplace view you had got and where you had scrolled (keyed by its filters, sort and search, for up to 30 views), the page you came from so back buttons do not loop, and the random number the animated starfield is drawn from, so it looks the same on every page.	Until you close the tab	No
firebase-messaging-sw.js, firebase-messaging-database, firebase-installations-database	service worker and IndexedDB	Push notifications, for signed-in accounts with a verified email address. We register a small background script that can show notifications, and your browser asks whether to allow them. Only if you allow them does Firebase Cloud Messaging create a push token (kept with an installation ID in these databases), which we save to your account so new messages can reach you as notifications.	The push token until you sign out, when it is deleted from your account and revoked and the script is removed; the installation ID stays in your browser until you clear this site's data	The push token is saved to your account, and Google uses it to deliver your notifications
Analytics (optional)Off until you accept analytics on the cookie banner.
PostHog, __ph_opt_in_out_ followed by our project key	local storage	PostHog product analytics: counts pageviews and feature usage so we can see what is used and diagnose errors. Runs only after you accept analytics. Its identifier for you is kept in page memory, not in a cookie or browser storage, so each visit starts afresh; the one entry PostHog stores on your device is this one, which records that analytics is on (or, after you turn it off, off). While you are signed in, these events are linked to your account ID, username and seller tier, and every event carries the country we derive from your IP address. Session recording, autocapture and surveys are disabled.	The entry until cleared; the identifier ends when you close the page	The events go to PostHog; the entry itself stays on your device
inviteLink	browser storage	Set only if you arrive through one of our invite links and have accepted analytics. Remembers which link it was, so that if you open an account on this device within 30 days we can record which invitation brought you; it is sent to us only when an account is opened, and removed once it has been. Also removed if you turn analytics off.	Up to 30 days, then deleted on your next visit	Only when an account is opened
checkoutAttribution	session storage	Set only if you arrive through a seller’s payment link or buy button and have accepted analytics. Remembers which one it was (the product, link or button, and the seller’s tag for it), so a reload of the checkout still credits your purchase to it. Without analytics consent the open page holds it in memory instead, and nothing is stored. Also removed if you turn analytics off.	Up to 24 hours, or until you close the tab	With your order, which keeps it, and the seller sees it on the sale
checkoutSources	session storage	Set only if you have accepted analytics. Remembers how you reached each seller in this tab: through a link to their storefront or one of their products from another site (with any tag the seller put on that link), through a search engine, or by browsing supa.place. If you then buy from that seller, the sale records which of these it was. It never holds the address of the site you came from. Without analytics consent the open page holds it in memory instead, and nothing is stored. Also removed if you turn analytics off.	Up to 24 hours, or until you close the tab	With your order, which keeps it, and each seller sees how their own sale came about

Most of the entries above are browser storage rather than cookies. A cookie travels with requests to the site that set it; browser storage stays on your device except where the last column says otherwise. We list both, because the distinction matters less to you than knowing what is stored. Your cookie choice itself is recorded in browser storage rather than a cookie, so it is not sent to our servers; clearing your browser storage will make the consent banner appear again.

Services that run in their own window or frame may keep their own data in your browser for that window or frame, governed by their own privacy notices rather than this one: the payment fields Stripe hosts and the other payment methods inside them, Didit's identity check, Google's sign-in window and the Firebase sign-in helper behind it (served from auth.supa.place), and the YouTube and Vimeo players for videos a seller embeds.

Automated Decision-Making

Some decisions on supa.place are made automatically, without a person looking at them first. Each is listed below with the kinds of personal information it uses and what it decides. We use none of them for advertising or marketing. Some can significantly affect you: a failed identity check holds a seller's payouts and takes their listings off sale, and a failed name check stops a bank account being added. You can ask for a person to review any of these decisions: write to support@supa.place, tell us which decision and why you disagree, and a person will look at it again, consider your point of view, and change the outcome if it was wrong.

Fraud screening on payments. Stripe scores each payment attempt using the card details, the amount, the country, and device and network signals, and may decline a payment on that basis. The decision is Stripe's, made under its own fraud-prevention responsibilities. A declined payment does not create an account record against you and you can simply try another payment method or contact us.
Identity verification for sellers. Didit checks your ID document, your selfie and the face match between them automatically, screens your name against sanctions and politically-exposed-person lists, and checks the IP address you verify from; it returns a pass, fail, or refer outcome. A referred check is reviewed by a person. You cannot launch products until a check passes. A failed check does not close your account, but any listings you have on sale are archived automatically (nothing is deleted) and payouts are held until a check passes, when the listings go back on sale by themselves. You can retry the check, and a person will review a failed outcome on request; you can send us further documents.
Payout account name check. When a seller adds a bank account for payouts, the account holder's name is compared automatically with the name on the seller's verified ID (and, for a business, with the company name the seller gave us and the one found in the company register). If the names have nothing in common, the account is not added, and the seller is asked to check the details or to contact us if the name is right. A partial match, such as a married name or an initial, is let through but flagged for us to look at, and we keep the name that was entered with the flag. If we hold no verified name, or the bank's country asks for no account name, the account is added and flagged as unchecked. This uses the name entered for the account, the verified name and those company names.
Payout risk reserve. If refunds and chargebacks on your sales exceed a published threshold over a rolling 90-day window, part of your withdrawable balance is automatically held back at a published rate. This is computed from your own sales and refund history only. It delays access to funds and never takes them, and it falls away on its own as the rate comes down. The thresholds are set out in the Fee Disclosure.
File storage limits. When a product is saved, the total size of its files is checked automatically against the limit for the seller's tier and Diamond membership, and a free tier's files against the free-tier limit. A product over its limit is marked Rejected, which takes it off sale, and the seller is notified with the reason and what to change; editing the product once it is within the limit resubmits it. Only a save that adds files or puts the product on sale is checked, so a listing is not rejected merely because a limit changed after its files were added. This uses the seller's tier and membership and the size of the product's files.
Unverified sign-ups. An account whose email address has not been verified within 24 hours of signing up is deleted automatically by a daily job, together with any record of an invite link or code it was opened through. This uses only the time the account was created and whether its email address was verified. You can sign up again at any time.
Location from your IP address. We look up the country of your IP address in a geolocation database we keep ourselves. It chooses the currency prices are first shown in and whether they carry a note that VAT is added at checkout. At checkout it is compared with the billing country you choose: if your choice would lower the tax due, the tax is worked out for the country of your IP address instead (both countries are kept with the order, so a person can review it if you ask), and if either country is under comprehensive sanctions, the checkout is refused. A seller's Diamond membership is taxed the same way, from the seller's registered country and IP address. This uses your IP address, the billing country you choose and, for a membership, the country you registered in.
Refund escalation. A refund request a seller has not decided within 14 days is escalated automatically to supa.place. The escalation is automated; the decision that follows it is made by a person.
Abuse limits and bot protection. Rate limits on downloads, messages and requests are applied automatically, counted against your account or your IP address, to protect the platform. Hitting one is temporary and clears by itself. Google reCAPTCHA also scores whether your browser looks automated (see Service Providers and Data Sharing), and without a good enough result some requests are refused until you try again; turning off a content blocker that stops reCAPTCHA usually clears it.

Privacy Contact

For privacy-related questions, requests to exercise your rights, or to report a privacy concern, please contact support@supa.place. For all other support enquiries, use the contact form on our Help page.

Policy Updates

We may update this policy from time to time. We will notify you of any significant changes, but we recommend reviewing it periodically. Your continued use of the platform after changes constitutes acceptance of the updated policy.