Privacy Policy
Draft — last updated 2 October 2026. This is a working draft written to UK GDPR / Data Protection Act 2018 principles; please have it reviewed before going live.
ShrimpBay (operated by Organics, “we”, “us”) is the data controller for personal data collected through shrimpbay.shop, and handles it in line with UK GDPR and the Data Protection Act 2018.
What we collect
Account data: name, email address, and a securely hashed password (we never store plain-text passwords).
Seller data: display name, bio, a rough location (town / postcode district only — never a full address) used for ShrimpMap, and your Stripe Connect account reference for payouts.
Order data: items purchased, delivery address, and order status. Card and bank details are collected and stored by Stripe, our payment processor — we never see or store full card numbers.
Cookies: strictly necessary cookies for sign-in and checkout. We don’t currently use analytics or advertising cookies; if that changes, we’ll ask for your consent first via the cookie banner, in line with PECR.
Why we use it (lawful basis)
Account, order, and payment data: to perform our contract with you (creating your account, processing an order). Rough seller location: your consent, given when you complete your seller profile. Basic site analytics we may add later: consent, collected only if you accept non-essential cookies. Fraud prevention and keeping the platform safe: our legitimate interest.
Who we share it with
Stripe — processes payments and seller payouts. Vercel — hosts the site and database infrastructure. Buyers and sellers see each other’s display name and messages relevant to their own order, and a seller’s rough location on ShrimpMap. We don’t sell personal data to anyone.
How long we keep it
We keep account and order data for as long as your account is active, and for a reasonable period after (typically up to 6 years) to meet UK tax and consumer-law record-keeping obligations. You can delete your account yourself, any time, from your account page — subject to those legal retention requirements, which is why deletion is held while you have an order or payout still in progress.
Your rights
Under UK GDPR you have the right to access the personal data we hold about you, ask us to correct or delete it, restrict or object to certain processing, and receive your data in a portable format. Your account page lets you download a copy of your data or delete your account yourself. For anything that page can’t do, contact us at shrimpbayshop@gmail.com. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO).
International transfers
Some processors we use (including Stripe and Vercel) may process data outside the UK. Where that happens, we rely on their standard contractual clauses / UK-approved transfer mechanisms to keep your data protected to UK standards.
Contact
Questions about this policy or your data: shrimpbayshop@gmail.com.