Privacy Policy

Last updated: 28 August 2026 · about 8 minutes to read

BrandMyX is operated from the United Kingdom.

1. Who is responsible for your data

The operator of brandmyx.com is the data controller for the personal data described in this policy. Contact: privacy@brandmyx.com. This policy is written to comply with the UK GDPR and the Data Protection Act 2018.

2. What we collect

• Account data: your email address, handle, and optional bio. Sign-in is by magic link or one-time code — we never store a password.
• Postal address: only if you list an object and choose platform print, where we print the sticker and post it to you — we need somewhere to post it to. Most people never give us one: we don't ask at sign-up, and listers who print their own stickers are never asked at all. Inside BrandMyX it is seen by the 3 people with founder access, to write the label; it then goes on the parcel and so is handled by the postal operators that carry it, listed in section 5 — we post from the UK, so if your address is in another country the label leaves the UK with the parcel. It is never shown to sponsors, never on a listing, and never on any public page.
• Listing and proof photos: photos of your objects and applied stickers. Photos can contain personal data (faces, number plates, home interiors), and we do not edit or blur your photo for you — please check what is in the frame before you upload, and crop it yourself if you need to. We strip all EXIF metadata, including GPS location, server-side on upload, before any version of the photo is stored or shown publicly, so where the photo was taken is never published even when your camera recorded it.
• Sponsor content: logos, brand names, and brand website URLs. You can save these to your account before you win anything, so we can fill the form in for you and show you how your logo would look in a space before you bid. These are PUBLISHED on a listing in two cases: while you hold the top bid on a space, and — if you win — once the object's owner approves your logo. Both are on the Contract basis: showing your logo on the listing is what you are buying. A saved brand that has never led a bid or won a space is not published anywhere, and everything you have saved is deleted with your account. If your brand is your own name, or you trade as a sole trader, treat it as personal data — because the ICO does.
• Marketplace activity: bids, orders, strikes, reports you file, and click counts on sponsor links (IP addresses used for click counting and rate limiting are hashed).
• Payment and identity data: processed by Stripe. Card numbers never touch our servers. Listers receiving payouts complete Stripe's identity verification (name, date of birth, address, bank details) directly with Stripe, as described in Stripe's own privacy notice.
• Location: city-level only, and only where you choose to show it on a listing. We never publish coordinates — and because of the EXIF stripping above, your photos can't leak them either.
• Usage data: standard server logs (IP address, user agent, pages requested) kept briefly for security and debugging.

3. Why we use it (lawful bases)

4. Automated image screening

Uploaded photos and logos are screened automatically for safety and policy compliance using xAI's image models. Anything flagged goes to human review — no decision with legal or similarly significant effect on you (such as rejecting your listing or closing your account) is made solely by automated means, in line with UK GDPR Article 22. If your content is rejected, you can contest the decision at privacy@brandmyx.com.

4a. Linked social accounts and Google user data

You can link X, YouTube (a Google account), TikTok, Twitch, Kick, Bluesky and Instagram to show a verified handle on your listings. Linking is sign-in with the platform itself; we never see your password.

• What we receive: the platform's own id for your account and your handle, and for YouTube the channel's id and title, read with the youtube.readonly scope in one request at the moment you link. We do not read your videos, subscribers, comments, watch history, email or contacts, and we ask for no other Google scope. We store the sign-in token the platform issues so we can re-check the handle later; we never post, message or act as you.
• What we do with it: show the verified handle on your listings and profile, count how long we have known it (that is what lifts a listing's rank), and nothing else. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: it is never sold, never used for advertising, never transferred to anyone except as needed to provide this feature or as required by law, and never read by a human except to resolve a support request or investigate abuse, with your permission where the law requires it.
• How it is protected: the token and ids travel only over TLS (HTTPS) and live in our database on a server in Germany that only the 3 people with founder access can reach, over an authenticated private network, never on a public port. The database and its nightly backups are encrypted before they leave that server (with age, a modern public-key tool), so the storage provider cannot read them. Tokens are never written to logs, error reports or analytics, never sent to another processor, and are only ever used server-side — no browser or third party ever holds them.
• How long, and how to remove it: for as long as the account stays linked. Press Unlink on your settings page and the token is deleted at once and the handle stops showing; deleting your account does the same for every platform. You can also revoke our access from the platform itself (for Google, at myaccount.google.com/permissions), and for Instagram that revocation reaches us automatically and deletes what we hold. Deletion is immediate in the live database and reaches the encrypted backups as they rotate, within 30 days.

5. Who receives your data

We share personal data only with the processors and recipients needed to run the service:

For transfers outside the UK to our suppliers we rely on the UK–US Data Bridge where the recipient is certified, and otherwise on the International Data Transfer Agreement or the UK addendum to the EU Standard Contractual Clauses, with transfer risk assessments where required. The parcel label is the one exception: nobody contracts with a foreign post office, so that transfer rests on the Article 49(1)(b) derogation described in the row above. We do not sell personal data. Ever.

6. How long we keep it

• Account data: while your account is open, then deleted or anonymised within 90 days of closure (except records we must keep — below).
• Postal addresses: kept while that listing can still take orders, then deleted within 90 days of it closing or being removed. For a listing that keeps re-selling the same space on a repeating cycle, there is no closing date to count from — so the same 90 days runs from the moment you stop it, once the last cycle has finished. An address is never part of the 6-year transaction record below — we keep what we posted and when, not where we posted it.
• Rejected or removed content (listings, photos, logos that failed moderation): deleted within 90 days.
• Click records on sponsor links: the hashed IP and user agent behind each click are deleted within 90 days.
• Transaction and payout records: kept 6 years for tax, accounting, and dispute-evidence purposes. That includes the sticker proof photographs posted against an order — they are the record that it was fulfilled. The six years run from the order's last activity, not the date the photo was taken, and the image files are deleted when it expires.
• Server and security logs: rotated within 30 days.

7. Your rights

Under UK GDPR you have the right to:

• access your personal data (a data subject access request — just email us; no special format needed);
• rectify inaccurate data;
• erase data we no longer need to keep;
• restrict or object to processing based on legitimate interests;
• data portability for data you provided to us under contract or consent;
• withdraw consent at any time, where consent is the basis.

Send any request to privacy@brandmyx.com. We respond within one month. If you are unhappy with how we handle your data or your request, you can complain to the UK Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113. We'd appreciate the chance to sort it out first, but you don't need our permission to go to the ICO.

8. Cookies

We set one essential session cookie so you stay signed in. That's it. No advertising cookies, no cross-site tracking, no third-party analytics cookies. Because the only cookie is strictly necessary for the service, no consent banner is required — and you won't find one.

We also run self-hosted, cookieless analytics (Umami) to count visits and page views in aggregate so we can improve the product — it never identifies, tracks, or profiles you, and it's never used for advertising — email privacy@brandmyx.com if you'd like us to exclude your visits.

9. Changes to this policy

If we change this policy in any meaningful way, we'll email account holders and update the date at the top. Minor clarifications may be posted without notice. See also our Terms of Service.