Loading...
Q Bend Limited (trading as Downsizr)
Company Number: 16792208
Last Updated: 11 April 2026
Q Bend Limited (Company Number 16792208), trading as Downsizr, with its registered office at 71-75 Shelton Street, London WC2H 9JQ, United Kingdom ("we", "us", "our", or "Downsizr"), is the data controller responsible for your personal data.
This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the Downsizr platform, website, and related services (the "Service"). It applies to all users of the Service, including Owners, Giftees, and Partners.
We are registered with the Information Commissioner's Office (ICO). ICO Registration Number: [To be inserted upon registration].
Data Protection Contact: privacy@downsizr.com
This Privacy Policy should be read together with our Terms and Conditions (https://downsizr.com/terms).
Account information
When you create an account, we collect your email address and, optionally, your first and last name. Authentication is handled via secure magic link email — we do not collect or store passwords.
Profile information
Depending on your user type, you may provide: phone number and country code, postal address (street, city, county/state, postcode/ZIP), business name and registration details (Partners), insurance certificate and expiry date (Partners), and timezone preferences.
Item Content
When you use the Service, we collect photographs and videos of your items, audio narration from video tours, item descriptions, titles, and details you provide or edit, item categorisations and organisation decisions, condition assessments and provenance information, and location information if included in item metadata or manually entered (metadata is stripped on upload).
Marketplace connections
When you connect Marketplace accounts (eBay, Etsy), we store OAuth access tokens and refresh tokens (encrypted), Marketplace user identifiers, and listing synchronisation data.
Partner interactions
When you request quotes from Partners, we process your contact information (shared only upon quote acceptance), location information (city level during quoting; full address only if collection is arranged), and item details and photographs relevant to the quote.
Giftee information
When you invite Giftees, we collect their email address (provided by you), and, if the Giftee creates an account, their name, address, phone number, and delivery preferences.
Payment information
Payment card details and bank account information are collected and processed by Stripe, our payment processor, not by Downsizr. We receive only: Stripe customer identifiers, payment method references (not full card numbers), transaction amounts, dates, and statuses, and payout information.
Identity verification
If identity verification is required, this is handled by Stripe Identity. We receive only verification status (pass/fail) and a verification session identifier. We do not receive or store your identity documents, biometric data, or photographs submitted for verification.
Usage information
We automatically collect pages and features you access, time and date of access, browser type and version, device information (type, operating system, screen size), IP address, and referring URL and navigation paths.
Analytics
We use PostHog for product analytics, which may collect page views, feature usage events, session recordings (with sensitive inputs masked), and device and browser characteristics. PostHog analytics are loaded only with your consent (see Section 11).
We may receive information from Marketplaces when you connect your accounts (profile data, listing status), Stripe for transaction and payout information, and Google Maps/Places for address verification and geocoding.
Under the UK General Data Protection Regulation (UK GDPR), we process your personal data on the following legal bases:
Contract performance (Article 6(1)(b)): Processing necessary to provide the Service you have requested, including account management, item cataloguing, marketplace listing, partner matching, payment processing, and gift facilitation.
Consent (Article 6(1)(a)): Where you have given explicit consent, including for analytics cookies (PostHog) and optional marketing communications. You may withdraw consent at any time.
Legitimate interests (Article 6(1)(f)): Processing necessary for our legitimate interests, including service improvement, AI model training using anonymised or aggregated data, fraud prevention and platform security, and enforcing our Terms and Conditions. We conduct a balancing test to ensure our interests do not override your rights and freedoms.
Legal obligation (Article 6(1)(c)): Processing required to comply with UK or other applicable law, including tax record retention (HMRC, 6 years; IRS, 7 years), responding to lawful requests from authorities, and data breach notification obligations.
We do not sell your personal information. We share your information only as described below.
When you publish listings, we share item photographs, videos, descriptions, and pricing with the relevant Marketplace (eBay and/or Etsy). Data shared with Marketplaces is subject to their respective privacy policies and is outside our control once transmitted.
When you request quotes, we share item details (photographs, descriptions, condition, estimated value) and your general location (city level) with matched Partners. Your name, email, phone number, and address are shared only with a Partner whose quote you accept, and only when required to arrange collection or delivery. Partners are contractually prohibited from retaining or using your personal data beyond the specific transaction.
Giftees see only the items you specifically offer to them, along with your name (so they know who the offer is from). Giftees do not have access to your address, phone number, or broader item catalogue.
We share information with the following categories of trusted service providers, each of which is bound by data processing agreements:
| Provider | Purpose | Data shared |
|---|---|---|
| Vercel | Hosting, serverless | All data transiting the platform |
| Cloudinary | Image/video storage | Photographs, videos (metadata stripped) |
| OpenAI | AI content generation, transcription, moderation | Item photos, videos, text for AI processing |
| Anthropic | AI analysis | Partner business information (not user personal data) |
| Google Cloud Vision | Image analysis | Item photographs for object recognition |
| Google Maps/Places | Geocoding, address verification | Addresses, location coordinates |
| Stripe | Payments, identity verification | Payment details (held by Stripe), identity docs (held by Stripe), transaction data |
| Resend | Transactional email | Email addresses, email content |
| PostHog | Product analytics | Usage events, device info (with consent) |
| Inngest | Background job processing | Job payloads (may include item IDs, user IDs) |
| Neon | Database hosting | All structured application data (account details, item records, transaction records) |
We may disclose your information if required to comply with a legal obligation, court order, or lawful request from a regulatory authority; to protect our rights, property, or safety, or that of our users or the public; or to investigate or prevent fraud, security issues, or violations of our Terms.
In the event of a merger, acquisition, reorganisation, or sale of all or substantially all of our assets, your personal data may be transferred to the acquiring or successor entity. We will provide notice of any such transfer and any choices you may have regarding your data.
The Service uses artificial intelligence extensively. Under GDPR Article 22, you have the right not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect you.
Our AI systems are used to assist with item identification and description generation, which you review and can edit before publication. AI-generated valuations are estimates provided for guidance only and do not produce legal or similarly significant effects. Item-to-Partner matching is automated but does not produce binding outcomes — you choose whether to accept any quote.
If you have concerns about automated processing, contact us at privacy@downsizr.com to request human review of any decision.
Your personal data may be transferred to and processed in countries outside the United Kingdom, primarily the United States, where several of our service providers are based (including OpenAI, Anthropic, Stripe, Cloudinary, Vercel, Resend, Neon, and Google).
Where transfers occur outside the UK, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs) with our service providers, UK adequacy decisions where applicable, and technical measures including encryption in transit and at rest.
You can request a copy of the relevant transfer safeguards by contacting privacy@downsizr.com.
We retain your personal data only for as long as necessary for the purposes described in this Privacy Policy. Our specific retention periods are:
| Data type | Retention period |
|---|---|
| Active account data | Until you delete it or close your account |
| Deleted account personal data | 30 days after account deletion request, then permanently deleted |
| Financial transaction records | 7 years after the transaction (anonymised; UK HMRC and US IRS requirements) |
| Usage/analytics logs | 90 days |
| Audit logs | 2 years |
| Marketplace-published content | Governed by each Marketplace's policies once published |
| Partner-shared item data | Revoked when quote rejected/expired or 30 days after transaction completion |
If you are located in the United Kingdom or the European Economic Area, you have the following rights under the UK GDPR:
To exercise any of these rights, contact us at privacy@downsizr.com. We will respond within 30 days (extendable by a further 60 days for complex requests, with notice to you).
You can download a copy of your personal data at any time from your account settings.
If you are a resident of California, Virginia, Colorado, Connecticut, or another US state with comprehensive privacy legislation, you may have additional rights including:
See Section 17 (Supplemental Notice for California Residents) for additional California-specific disclosures.
We implement technical and organisational measures to protect your personal data, including:
No method of electronic transmission or storage is completely secure. While we implement industry-standard measures, we cannot guarantee absolute security.
We use strictly necessary cookies for authentication and session management (NextAuth session cookies). These cookies are required for the Service to function and cannot be disabled.
We use PostHog for product analytics. PostHog cookies are loaded only after you provide consent through our cookie consent mechanism. PostHog may collect page views, feature usage, and session recordings (with sensitive inputs automatically masked). You can withdraw consent at any time through the cookie settings accessible from the footer of every page.
You can control cookies through your browser settings or through our cookie consent mechanism. Disabling essential cookies may prevent the Service from functioning correctly. For more information about cookies, visit https://www.allaboutcookies.org.
The Service is not intended for, and we do not knowingly collect personal data from, anyone under the age of 18. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us immediately at privacy@downsizr.com and we will take steps to delete that information.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by Article 34.
We maintain a documented data breach response plan, including incident detection, classification, containment, notification, and post-incident review procedures.
Some browsers transmit "Do Not Track" signals. Our Service does not currently respond to Do Not Track signals. However, you can manage your tracking preferences through our cookie consent mechanism.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service, updating the "Last Updated" date, and, for material changes, sending you an email notification. Your continued use of the Service after the effective date of any changes constitutes your acknowledgement of the updated policy.
Email: privacy@downsizr.com (privacy matters) / support@downsizr.com (general)
Company: Q Bend Limited (trading as Downsizr)
Company Number: 16792208
Registered Office: 71-75 Shelton Street, London WC2H 9JQ, United Kingdom
Website: https://downsizr.com
Supervisory authority
You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your personal data in accordance with applicable law.
ICO Website: https://ico.org.uk
Telephone: 0303 123 1113
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
This section applies to residents of California and supplements the information in the rest of this Privacy Policy, as required by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA: identifiers (name, email, IP address), commercial information (transaction records, item details), internet activity (browsing, usage data), geolocation data (general location, city level), and audio/visual information (photographs, videos, audio narration).
We do not sell your personal information as defined by the CCPA. We do not share your personal information for cross-context behavioural advertising.
We retain personal information as described in Section 8 of this Privacy Policy.
In addition to the rights described in Section 9, California residents have the right to request, up to twice per year, that we disclose the categories and specific pieces of personal information collected, the sources and purposes of collection, and the categories of third parties with whom we share personal information. You may exercise these rights by contacting privacy@downsizr.com. We will verify your identity before fulfilling any request.
You may designate an authorised agent to make a request on your behalf. We may require proof of authorisation and verification of your identity before fulfilling such a request.