Privacy Policy

1. Who we are

TreeBay (“we”, “us”) runs the classifieds site at treebay.uk. We are the data controller for the personal data processed through it.

TreeBay is run by Treebay Trade Limited, trading as TreeBay (private limited company registered in England and Wales, company number 17498951), registered office 20 Wenlock Road, London N1 7GU.

We are registered with the Information Commission's Office (ICO), registration number ZC267351.

Contact: hello@treebay.uk

2. What we collect

2.1 Your account

• Your email address, which you use to sign in (we email you a sign-in link).
• Your display name: the name on your account, or a username if you choose one and choose to be shown by it. Your phone number and location if you add them. If you change your username, we keep the old one, hidden, with the dates you used it, for 12 months, so our moderators can trace a report that names it. For the first 90 days nobody else can take it.
• Your home postcode, if you add one. We keep only its first half (like CH7) and use it only to show how far listings are from you. It's never shown to anyone.
• If you sign in with Google, Google tells us your email address, whether Google has confirmed it, and your name, and gives us an ID for your Google account. We use them to sign you in, and to link Google sign-in to the TreeBay account that has the same confirmed email address. We don't keep your Google profile photo.
• A record that you confirmed you're 18 or over, and when (we don't ask for your date of birth).
• When you create an account, we record when, and which version of our Terms was in force. If you tick the box to get TreeBay news and offers by email, we record when and where you ticked it (such as when you joined, or in your settings) and the words you agreed to, and when you turn it off.
• When you sign in from a new device or browser, we note the time, the browser and the type of device, and email you about it, to protect your account.

2.2 Listings

• What you put in a listing: title, description, photos, price and location.
• Category details, such as a machine's make and model, a job's salary or a course's dates, and the serial or PIN number if you give one.
• For bladed tools, your confirmation that you'll sell only in person, to someone aged 18 or over.
• If you sell as a business, your trading name, business address and business email (if you give one) are shown on your listings, as the law requires.
• If you save a search, we keep it and email you when new listings match it, until you stop its emails or delete it.
• If you save a listing to finish later, we keep what you've entered so far, including photos, until you publish it or delete it (see section 5). Your browser also keeps a copy on your device until then, or until you sign out.
• If you add a listing to your watchlist, we keep which listing and when, so you can find it again.
• If you mark a listing as sold to a member, or confirm a deal a seller marked with you, we keep a record of it: the listing, the two of you, the dates, how it changed hands and any condition note. Never the price. You can both see it, and the number of deals you've both confirmed is shown with your listings and in your conversations. Your seller page also shows how many of your listings you've marked sold.

2.3 Messages and community posts

• Messages you exchange with other users through TreeBay, including any photos you send in them, and the members you block (who, and when).
• You can download a copy of a conversation you're in, including the other member's messages, for example as evidence for your bank or a court.
• From the times of messages, never what they say, we work out how quickly you usually first reply to people who message you. Once at least 3 people have messaged you, we show it with your listings and in your conversations, if it's within a few days.
• Requests to tip you send (what you want to tip, roughly how much, when, your vehicle, your waste carrier registration number if you give it, and any note) and the owner's answer.
• Threads and replies you post on the community board, which anyone can read, with your display name. Threads started from 7 October 2026 can also appear in search engines such as Google; earlier threads don't. To have a post of yours removed, email hello@treebay.uk. Questions you ask about a listing, and replies, are community posts: they're public, they're linked from that listing, and we tell the seller.
• Your votes on community posts (which posts, up or down), and when you voted.
• Reports you send us about listings, private messages, community posts, tip sites and members. We store the report: what was reported, the reason you choose, your note, and your email address if you give one while signed out (if you are signed in, the report is linked to your account). If you report while signed out, we also store a scrambled (salted, hashed) version of your internet connection address, used only to stop abuse of the report button. For a report of an intimate image shared without consent, we also store your answer to who is in the image and your confirmation that the report is made in good faith. Reports are also emailed to the TreeBay team. An intimate-image report can reveal sensitive information about the person shown, including you if you tell us it is you. We use it to deal with the report.
• We use reports to moderate TreeBay, including removing content and restricting or closing accounts.
• To deal with reports, prevent fraud and keep TreeBay safe, we may read private messages.
• When we restrict or ban an account, we record the decision, the reason and the dates. If a banned account, or an account whose restriction hasn't ended yet, is later erased, we keep a scrambled fingerprint of the email addresses linked to it, and of its username (not the addresses or the username themselves) so it can't simply sign up again. We keep it even though the rest of the account's data is erased, because we still need it to enforce the ban or restriction. Our legal basis is our legitimate interest in keeping banned people off TreeBay. We delete the fingerprint when a restriction ends or if we lift a ban.
• Messages you send through our contact form: your name (if you give it), your email address, the topic, your message, a link to your account if you were signed in with the same email address, and the same kind of scrambled connection address, used to limit abuse. A message about how we use personal data is also logged as a data protection complaint.
• Emails you send us: see 2.4.

2.4 Messages to our support team

When you email hello@, info@, safety@ or abuse@treebay.uk, or any other treebay.uk address, send us a message through our contact form, or reply to one of our emails, we keep the conversation in our support system. We keep:

• your email address and name as they appear in your email;
• what you and we wrote, and when;
• technical email details that link replies to the right conversation;
• our notes on it, including how we sorted it and who dealt with it.

We don't keep attachments. We record only their name, type and size, and we may ask you to send the information another way, for example with the Report button.

So that your message is seen quickly, we also email a short notice of it (who it's from, the subject and its first lines, never attachments) to the people who run TreeBay. If our support system is briefly unavailable, they get the text of your email instead, still without attachments. These notices and copies are deleted after 30 days.

2.5 Tip-site registrations

• The site's name, address or what3words, postcode, what it accepts, whether it's free to tip, charges, or pays for loads, and any price you give, and any access notes, plus the contact name and phone number you choose to give. Who sees the address, notes and phone number depends on the choices you make for your site (see section 4). We also keep those choices, and the requests to tip you receive and your answers.
• The site's position on the map and its council area, looked up from the postcode. The pin sits at the postcode's centre, not at the gate. If you're not signed in, it sits at the postcode district's centre.
• A record of the registration terms you were shown and agreed to, and when, and the emails we send you about your site.

2.6 Payments

• Card payments are taken by Stripe; your card details never reach our servers. We receive a payment reference, the amount and the date.
• When you pay a listing fee or for a Featured upgrade, we record that you asked us to start straight away, when, and the exact words you agreed to.

2.7 Technical data

• If you post a job advert: a code stored in your browser (tb_jobtoken), scrambled one-way codes made from your IP address and your email address, and the advert's company name and business email domain. We use these only to make sure each employer gets one free job advert.
• If you list something at £1,000 or more: a scrambled one-way code made from your email address, used only to make sure each person gets one free listing at that price.
• Your IP address and browser details, which our servers and Cloudflare process to deliver pages and protect the Site.
• When someone opens a listing, we count a view. To count each person once a day, we keep a scrambled code made from their IP address and browser, or from their account if they're signed in, and delete it after 2 days. Only the total is kept. Anyone can see it on the listing's card in search results and lists of listings; on the listing itself, only the seller sees it. The seller's own visits aren't counted.
• A security record of key actions on your account: when you sign up, sign in or out, create or edit a listing, send a message, upload a photo, send a report, register a tip site or start a payment. Each one has the time, your IP address (and the connection's port, when we have it) and a short description of your browser. It never includes what you wrote, your photos or your searches.
• If someone types a wrong sign-in code for your email address, we keep a scrambled one-way code made from the address, with the time, so we can pause sign-in codes for that address after 10 wrong ones in 24 hours. We delete it after 24 hours.
• Your approximate location, only if you tap “Use my location” on listings or the tip-sites page, and your browser asks you and you agree. The page rounds it to about 1 kilometre before sending it. Our server finds your postcode district (like CH7) and then forgets the position: we don't store it or log it. The district goes in the search, so it appears in that page's web address. We use it to search near you and, for tip sites, to show how far they are by road. A cookie remembers the district on this device, so listings show how far away they are and the tip-sites search starts from it, until you tap “Forget my location”.
• Visit statistics: the pages you visit (without any personal details in the address), the website that sent you, your browser, operating system, device type, screen size and language, and your country, region and town, worked out from your IP address. We also count a few actions without any details, such as a listing being created (its category only), a seller being contacted, or a search being made (its category only, never the words). We count these on our own server using a code that changes every day, and we don't keep your IP address. We never use them to look at what a particular member does. You can turn this off on our Cookies page.

2.8 Notifications

If you turn on notifications in your browser, we store the push address your browser creates for this device (an endpoint URL and encryption keys) and which kinds of notification you want. We use it only to tell you about things you use on TreeBay, such as new messages — never for marketing. It is deleted when you turn notifications off, when your browser tells us the address has expired, or when you ask us to delete it. The legal basis is your consent (UK GDPR Art. 6(1)(a)), which you can withdraw at any time in your browser settings.

If you start a forum thread, or someone asks a public question about your listing, we email you when someone replies, at most once an hour per thread. You can turn this off from the link in any of these emails, or in your dashboard.

2.9 Pre-launch waitlist

If you joined our waitlist before TreeBay launched, we hold your email address, where you found us (if the link you followed told us), and a scrambled one-way code made from your IP address, which we used to stop abuse. The waitlist is closed to new sign-ups. You can ask us to delete your details at any time.

2.10 Invites

If we invite you to join TreeBay, we keep the email address it's for and a short note of how it came about, so the invite is applied when you first sign in.

2.11 Data rights requests

If you make a request using your data rights, we keep the request and our reply.

2.12 Organisation profiles (job adverts)

If you post job adverts: your organisation's name, type, company number (for a limited company or LLP), website, town or postcode district, and any logo and description you add. These are shown publicly on your job adverts and in the job details that search engines read. For a limited company or LLP, we check the company number with Companies House and keep what it tells us (the registered name and status, and when we checked).

2.13 Businesses we contact about job adverts

If your business advertises a tree-work, forestry or related vacancy on its own website, or a council or public body advertises one on its vacancy pages, we may note it so we can offer you a job advert on TreeBay. We keep your organisation's name, the vacancy's details (job title, place, pay and closing date), the address of the page we found it on, and the contact route the page gives, usually an email or postal address. We don't look at anyone's personal social media, and we never publish what we note: nothing appears on TreeBay unless you post it yourself. We email only limited companies, LLPs and public bodies. We write to sole traders and partnerships by post. If you're a sole trader or in a partnership, some of these details are about you personally, which is why we explain this here.

2.14 Tip-site owners we contact

If your farm, yard or business takes woodchip or logs, or might, we may contact you to tell you about listing your site on TreeBay: by email at most twice, at least 6 months apart, or once by post or phone. We use the contact details your business publishes itself, such as on its website, and we may find businesses through public sources such as the Environment Agency's register of waste exemptions. We keep your business's name, the contact details we used, where we found them, when we contacted you (including emails our team sent by hand), your answer and whether you went on to list your site. We email only limited companies, LLPs, public bodies, Scottish partnerships, registered societies and charitable incorporated organisations. We contact sole traders and other partnerships by post or by phone instead. If you're a sole trader or in a partnership, some of these details are about you personally, which is why we explain this here.

2.15 Our pages on social media

We have pages and accounts on social media, such as the TreeBay Facebook Page, the TreeBay Facebook group and our LinkedIn page. If you follow or join one, or comment on it or message us there, we see what that service shows us: your name and profile on the service, what you post or send, and, for the group, your request to join. We use it to answer you, to run the pages and the group under their rules, and to act on anything you ask us for or report to us. The services also give us statistics about how our posts did and who they reached. For the statistics about our Facebook Page, Meta and we are jointly responsible, and Meta has agreed to deal with requests about them: Information about Page Insights. Each service uses your information itself as well, under its own privacy policy, not ours: Meta's privacy policy (Facebook and Instagram) and LinkedIn's privacy policy.

2.16 Referrals

If you join through a member's referral link or name the member who told you about TreeBay, we record who referred you, how, and when your first listing went live. The member who referred you sees that you joined and when, and once your first listing is live, your TreeBay name, but nothing else about you. If you refer people, we keep your referral code, the people you referred, your credits and how you used them, and we email you when you earn a credit and before one expires (you can turn these emails off on your Referrals page). To stop the scheme being misused, we compare the email address you use with other accounts' (ignoring dots and plus-signs), and use scrambled one-way codes made from email addresses, the business email domain and, if you joined through a referral, named a member, or open your Referrals page, a code stored in your browser (tb_jobtoken). If you type a member's code or email address in “Did a member tell you about TreeBay?” and it doesn't match a member, we don't keep it.

2.17 Websites we ask to mention TreeBay

If your organisation's website lists places to find tree work, sell arb kit or tip woodchip, we may email you to ask whether you'd add TreeBay: once, and one follow-up at most. We use an address your organisation publishes itself, and we email only companies and public bodies. We keep your organisation's name, the address we used, where we found it, when we wrote and your answer.

3. How we use it

We may use automated tools, including AI, to moderate TreeBay, prevent fraud and sort messages to us. They look for content and behaviour that break our Terms or the law, and they may remove content or restrict or close an account without a person being involved. If a decision like this affects you, you can ask for a person to review it, give your view and challenge it: reply to our email, or email hello@treebay.uk with “Appeal” in the subject. This includes our check that each employer gets only one free job advert: if it says your first job advert isn't free, you can ask a person to look again. This includes our check that each person gets only one free listing at £1,000 or more: if it says your listing isn't free, you can ask a person to look again. This includes our checks on referrals: if one says a referral can't be counted, you can ask a person to look again.

4. Who we share it with

• Other users: your display name, location, listings and community posts are visible to others. A listing shows its town or the first half of its postcode (like CH7), never the full postcode. Listings show how many members have them on their watchlist, but never who. Anyone can see a tip site's name, its town, what it accepts and its tipping terms. What else members see depends on the owner's choices: the full address, notes and phone number may be shown to signed-in members, or shared only with members whose request to tip the owner accepts, and the owner may choose not to share a phone number at all. Requests to tip, and the answers, go through TreeBay messages. Your email address is not shown; messages go through TreeBay. Public pages, including listings, tip-site pages and forum posts, can be read and copied by anyone, including search engines and companies that collect web content to train AI. Once something is public, we can't control copies others have already made.
• Stripe takes card payments. Stripe's privacy policy.
• Microsoft (Microsoft 365) holds our team’s email accounts, including the emails we send to tip-site businesses and their replies. Our email account is held in the UK. Microsoft's privacy statement.
• Resend delivers our emails: sign-in links, notifications and tip-site emails. Resend's privacy policy.
• Cloudflare provides our network, DNS and the secure connection to our server, routes emails sent to our addresses to us, and checks that some forms are filled in by a person rather than a bot (Cloudflare Turnstile). Cloudflare's privacy policy.
• Cloudinary stores and resizes the photos you upload to listings. Cloudinary's privacy policy.
• Cloudflare also stores and resizes the photos you upload, including photos you send in messages.
• Microsoft Azure checks uploaded photos for illegal or harmful content, in the UK. That includes photos sent in messages, which the other member sees only once they've passed. It never includes the text of your messages.
• OpenFreeMap (Hyperknot Software Kft., Hungary) supplies the map on the tip-sites page, drawn from OpenStreetMap data. Your browser fetches the map from OpenFreeMap through Cloudflare's network, so they see your IP address and browser details, as any website you visit does. We send them nothing else. OpenFreeMap.
• Meta (Facebook). We may share a listing's title, price, town, main photo and a link to it in the TreeBay Facebook group, unless the seller has ticked the box to leave it out. Job adverts on a plan that includes our Facebook posts are posted as the plan describes. Once something is posted on Facebook, Facebook's own privacy policy applies to it. Meta's privacy policy.
• postcodes.io (run by Ideal Postcodes) turns a postcode or town you search for, a listing's location, a tip site's postcode or your home postcode into a rough position, and a rounded position from “Use my location” into a postcode district. If you sell as a business, it also gives us the place names for your business postcode, so we can check that your address has a building or street. If a search of the listings finds nothing, it also tells us whether your search words name a place, so we can show listings near it. We don't send words that include a number or an @ sign, unless they're a postcode. Our server sends it only that postcode, place name, search words or rounded position, never who you are.
• Your browser's push service (run by your browser maker, such as Google, Apple or Mozilla) delivers notifications, if you turn them on.
• Google, only if you sign in with Google. Google's privacy policy.
• Police, courts and regulators, including the National Crime Agency and the Home Office, where the law requires it, when the police ask us in writing for help preventing or detecting crime, or to protect people from harm or fraud.

We do not sell your personal data, and we do not use advertising trackers.

5. How long we keep it

We automatically delete reports, the records of what we decided on them, messages removed after a report, contact-form messages, support conversations, backups, records of restrictions and bans, unfinished listing drafts, deal records, and photos you uploaded but never used, when the periods below end. We don't yet delete other old records automatically, including our records of listings and community posts we hid, so where there is no fixed period below, we keep data for as long as the reason for having it lasts.

• Organisation profiles: while your account exists. We delete the profile and logo when you delete your account or ask us to erase your data.
• Free job advert checks: the scrambled code made from your IP address for 30 days; the rest of the record 2 years after the free advert went live, then deleted. We keep this record even if you delete your account or ask us to erase your data, so the free advert can't be claimed again.
• Free listing checks: 2 years after the free listing went live, then deleted. We keep this record even if you delete your account or ask us to erase your data, so the free listing can't be claimed again.
• Referral records: 2 years after the referral's last event (a credit earned, used, expired or taken back), then deleted. We keep them even if you delete your account or ask us to erase your data, so the same person can't be referred twice; after erasure, only the scrambled codes are kept. Device records for referral checks: 30 days.
• Visit statistics: per-visit records are deleted after 30 days. We keep monthly totals, such as visits to each section of the site, where visitors came from, and country and region, which can't identify anyone.
• Our pages on social media: what you post or send there stays on that service until you delete it, we remove it, or the service does. Anything we note from it is kept for as long as this section says for what it's about, such as an invite.
• Websites we ask to mention TreeBay: deleted 12 months after we last wrote, unless you ask us not to contact you: then we keep your organisation's name and address on a do-not-contact list.
• Businesses we contact about job adverts: deleted when the vacancy closes or after 3 months, whichever is sooner. If we haven't contacted you within a month of noting your details, we delete them then. If you ask us not to contact you, we keep your organisation's name and contact address on a do-not-contact list, so that we don't contact you again.
• Tip-site owners we contact: deleted 12 months after we last contacted you, unless you list your site. If we haven't contacted you within 3 months of noting your details, we delete them then. If you ask us not to contact you, we keep your business's name and contact details on a do-not-contact list, so that we don't contact you again. Once we’ve emailed a business, we keep a scrambled one-way code made from its email address and company number, so that we never email it more than twice.
• Account data: while your account is open. If you ask us to erase your data, we remove your name, email address, phone number, location, home postcode and photo from the account. Your username is removed from view at once. We keep a scrambled one-way code made from it for 90 days, so nobody else can take it, then delete that too.
• Your choice about news and offers, and the Terms you agreed to: while your account is open. If you turn the emails off, we keep a note that you did, so we don't email you by mistake.
• Sign-in device records: kept for 12 months after the device was last used to sign in, then deleted.
• Listings: until you delete them. Sold and expired listings stay on your dashboard until you do. When you mark a listing sold, its page stays up with a Sold banner for 30 days, without your contact details, and it can appear under “Recently sold” for the first 14, unless you hide it sooner from your dashboard. If you ask us to erase your data, we take your listings off the site and delete their words, location and category details, and remove their photos from TreeBay (we delete the photo files as soon as our image host allows it). We keep only a bare record of each one (its category, price, dates and any fee paid) in case of a dispute about a deal or a payment.
• Unfinished listing drafts: deleted, with their photos, 90 days after you last opened or changed them. We email you at least a week before. You can delete a draft yourself at any time from your dashboard. Photos you upload but never add to a listing or a draft are deleted after 2 days.
• Watchlist: until you take a listing off your watchlist, the listing is deleted, or you ask us to erase your data.
• Messages and requests to tip: kept, with any photos in them, so both people can see the conversation. If we remove a message or photo, neither person can see it any more, but we keep it as evidence for 2 years after we removed it, or longer while a report about it is still open. If you ask us to erase your data, we delete every message you sent or received, and their photos.
• Blocks: until you unblock the member, or either account is deleted or erased.
• Deal records: a confirmed deal for 2 years after the listing was marked sold, then deleted; one that was declined, cancelled or never confirmed for up to 90 days. If you ask us to erase your data, a confirmed deal stays on the other member's record as a deal with “a former member”, without your name or any note you wrote, and unconfirmed ones are deleted.
• View counts: the scrambled codes are deleted after 2 days. The total is kept with the listing.
• Wrong sign-in codes: the scrambled codes are deleted after 24 hours.
• Security records: 12 months, then deleted. We keep them longer only while a legal hold, an open report about the account, or a recorded request from the police or the National Crime Agency needs them. If you ask us to erase your data, we delete them too, except those.
• Community posts: stay on the board until a moderator removes them. If you ask us to erase your data, we replace the words of your threads and replies with “Removed at the author's request” and remove your name from them. Other people's replies stay.
• Votes on community posts: until you remove them or delete your account. Totals stay, but not who voted.
• When you voted (the time only, not which post): 1 day, to enforce the voting limit.
• Reports and moderation decisions: kept for 2 years after the report is closed, as a record of what was reported and what we did. Records of a restriction or ban are kept while it lasts and for 2 years after it ends. The scrambled connection address stored with a report is kept for as long as the report. If you ask us to erase your data, reports you made keep no note or email address. Reports about you lose your name, but what the person who reported you wrote stays as they wrote it, and it may name you. It is their account of what happened, and we need it to show what was reported and what we decided. It is deleted with the report, 2 years after the report is closed.
• Contact form messages: 2 years after our last reply. If a message becomes a complaint, it is kept with the complaint record (see “Data rights requests and complaints” below). If you ask us to erase your data, we remove your name, email address and message from them.
• Reports we must make to the National Crime Agency: the report reference for 5 years, and the reported content and the related account data the law requires for 1 year, even if you ask us to erase your data.
• Reports we make to the Home Office about a suspicious sale of chemicals: our record of the report, and the listing it was about (hidden), for 2 years after the report, even if you ask us to erase your data, in case the police need them.
• Support conversations: 2 years after the conversation is closed. If a conversation is a complaint, a data request or a report, it's kept with that record instead (see above). If you ask us to erase your data, we remove your name, email address and words from support conversations, except where we must keep them as a complaint or data-request record.
• Ban fingerprint (the scrambled email and username fingerprint of an erased, banned or restricted account): while the ban stands, or until the restriction ends.
• Old usernames: kept, hidden, for 12 months after a change. If you ask us to erase your data, we remove them with your account, unless a report or a ban needs them.
• Removed usernames: a username we remove for breaking our rules is kept only as a scrambled one-way code, linked to no account, so nobody can use it again.
• Our record of moderation actions (who decided what, and why): deleted on the same timetable as the record it describes: 2 years after a report is closed; 2 years after a message was removed, a tip site was hidden or restored, or a contact-form message was answered; 2 years after a restriction ends; and, for a ban, 2 years after it is lifted (kept while it stands). Our records of listings and community posts we hid, and of data rights requests, have no fixed period yet: we keep them for as long as we need them to show what we did.
• Tip-site registrations: the public listing is removed as soon as you remove your site. We keep the registration record, the terms you agreed to and whether your site is a founding site for 2 years after that, in case there's a dispute, then delete them. If you ask us to erase your data, we remove the site first, then its contact name, phone number and notes.
• Payment records: as long as tax and accounting law requires.
• Saved searches, and our record of the alerts we sent: until you delete them or delete your account. Stopping a search's emails keeps the search.
• Backups: copies of our database are kept for up to 35 days, then deleted. Data we erase or delete stays in backups until they're deleted, and we don't use it.
• Technical logs: only as long as we need them to fix faults and protect the Site.
• Push notification addresses: until you turn notifications off, your browser tells us the address has expired, or you ask us to delete it.
• Invites that are never used: until we delete them or you ask us to.
• Pre-launch waitlist: until you tell us to stop emailing you or ask us to delete your details.
• Data rights requests and complaints: kept as a record of what you asked and how we answered.

6. Your rights

Under the UK GDPR you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have your data deleted.
• Restriction — limit how we use your data.
• Portability — get your data in a machine-readable format.
• Objection — object to uses based on legitimate interests.
• Withdraw consent — where we rely on consent, such as TreeBay news and offers by email, push notifications or the pre-launch waitlist, at any time. For the emails, use your settings or the link in any of them.

If we've contacted you about a job advert or about listing your tip site or about adding TreeBay to your website, you can tell us to stop at any time, by replying or by emailing hello@treebay.uk, and we will.

If you'd rather we didn't show how quickly you usually reply, email hello@treebay.uk and we'll stop.

You can also object to us showing other facts about you with your listings, such as when you joined or how many deals you've confirmed, by emailing hello@treebay.uk. We'll stop unless we have a compelling reason to carry on, such as a fraud case, and if so we'll tell you why.

To use any of these rights, fill in our data rights form or email hello@treebay.uk with the subject “Data Rights Request”. We will reply within one month, as UK GDPR Article 12 requires. You don't need a TreeBay account to use these rights. If you've reported something or contacted us without one, use the email address you gave us.

Complaining to us about how we use your data

If you're unhappy with how we've handled your personal data, including how we answered a data rights request, please complain to us first. You can:

• use our data rights form and choose “Make a complaint about how you use my data”;
• email hello@treebay.uk with “Data protection complaint” in the subject; or
• write to us at 20 Wenlock Road, London N1 7GU.

You can also complain to the Information Commission's Office at ico.org.uk/make-a-complaint.

7. Cookies

We only use cookies that are strictly necessary, such as keeping you signed in, protecting forms from forgery and preventing fraud, and one that remembers your postcode district if you tap “Use my location”. When you pay, Stripe's checkout page sets its own cookies to take the payment and prevent fraud. We don't use advertising or tracking cookies. The full list is on our Cookies page.

8. Data outside the UK

Your data is stored mainly in the United Kingdom. Some of the services in section 4 — Stripe, Microsoft, Resend, Cloudflare, Cloudinary and Meta — are based in the United States, and OpenFreeMap is based in the European Union. Where your data leaves the UK, it is protected by a transfer mechanism the UK GDPR allows, such as UK adequacy regulations, the UK–US data bridge, or the ICO's International Data Transfer Agreement or Addendum. If you sign in with Google, Google, which is based in the United States, handles that sign-in under its own privacy policy. We send Google nothing else about you. The social media services in §2.15 are run by companies outside the UK, which handle what you do there under their own privacy policies.

9. Security

We use encrypted connections (TLS), email sign-in links instead of passwords, and restricted access to personal data. No system is perfectly secure: if there is a breach, we will report it to the ICO and tell you where the law requires.

10. Children

TreeBay is for people aged 18 or over. We do not knowingly collect data from children. If you think a child has given us personal data, please contact us.

11. Changes to this policy

We may update this policy. The date at the top shows the latest version.

12. Contact

Privacy questions: hello@treebay.uk