Privacy Policy

ListRush is an online service for creating, managing and publishing marketplace listings. Harry Simmons, trading as ListRush, operates the service personally as an individual sole trader and decides how and why ListRush uses personal information (the controller). ListRush is a trading name, not a limited company or separate legal entity.

Contact ListRush about privacy, rights or complaints at admin@listrush.co.uk. No separate data protection officer has been appointed. External services may process information for ListRush, while some also act independently for their own activities.

Information you provide can include your email and sign-in details; confirmation that you are 18 or over and the Terms version and time accepted; a request to start a selected paid subscription immediately during the cancellation period, its fixed wording version and server-recorded time; profile name and avatar; item details, descriptions, measurements, photos and templates; seller, appearance and enhancement preferences; and support or privacy messages.

Information created as you use ListRush can include AI-generated or enhanced content; AI allowances and purchases; subscription status and Stripe references; contract-confirmation status, attempt and sent times and a provider message reference; eBay connection information and authorisation credentials; marketplace listing identifiers, status and history; relist records; Smart Postage and seller-policy selections; and analytics and campaign attribution described below.

ListRush and its hosting providers also process ordinary request, device, browser, approximate location, security and operational log information. We do not receive or store complete card details through the normal Stripe flow.

We use information to create and secure accounts; generate, edit and save listings; enhance photos when requested; remember templates and preferences; connect to eBay; publish, manage and relist listings; provide Smart Postage; administer subscriptions, purchases and AI allowances; provide support; prevent fraud and maintain reliability; operate limited product analytics; handle rights and deletion requests; and meet applicable legal duties.

Lawful bases

• Contract: processing needed for the account and functions you request, including AI, marketplace and paid features.
• Legitimate interests: a preliminary basis for limited analytics and proportionate security, fraud prevention and operational reliability, after balancing users’ rights. The analytics assessment still requires legal review.
• Legal obligation: where a specific law requires processing or retention. Exact billing and accounting periods still require professional verification.
• Consent: only where specifically requested for a particular activity. Creating an account or reading this policy is not consent to every use.

ListRush uses OpenAI’s API for AI functions you request. Listing generation or regeneration may send listing text, condition and style information, relevant measurements or context, and listing photos. Photo enhancement sends the selected photo and your instructions.

The identified AI routes do not deliberately send your ListRush account identifier, email, Stripe identifiers, eBay identifiers or OAuth tokens. OpenAI states that API data is not used to train its models by default, but provider-controlled abuse-monitoring or other retention may apply. ListRush has not verified every setting for its actual account and does not claim zero retention.

AI output can be wrong. You decide whether to edit, save or publish it. These features do not make solely automated decisions about you producing legal or similarly significant effects.

ListRush processes item photos to create listings, provide requested AI analysis or enhancement, save work and publish to eBay. Saved listing photos currently use publicly retrievable web addresses so eBay and the interface can fetch them. This is not private storage requiring sign-in: anyone who obtains a working address may retrieve the image. The address is not intended as proof of authorisation.

Listing and account deletion attempt to remove ListRush-hosted photo objects. Removal at the origin may not immediately remove copies cached by browsers, delivery systems, eBay or another recipient. Production storage configuration and alternatives to public delivery remain under review.

If you connect eBay, eBay asks you to authorise ListRush using OAuth. ListRush stores connection information and protected access credentials to retrieve seller policies, check readiness, publish and manage listings, use Smart Postage, and relist or refresh when requested. Listing content, photos, prices, policies, locations and marketplace information may be exchanged with eBay; ListRush keeps relevant IDs, status, history and operational records.

The optional ListRush browser extension uses your existing Vinted browser session to open a visible draft and insert only the title, description and price you request. It does not collect your Vinted password, store or transmit Vinted cookies, collect unrelated browsing history, or send arbitrary Vinted page contents to ListRush. ListRush stores a revocable extension connection plus limited job status and error records. Vinted receives the draft fields through its page only when you start the test; you must review and publish manually.

You can disconnect ListRush and may revoke access through eBay. Successful ListRush account deletion revokes ListRush’s eBay access and removes extension sessions and jobs, but does not end live eBay listings or other marketplace listings; manage those in the marketplace. Each marketplace independently processes information under its own terms.

Stripe handles checkout, subscriptions and payments. Card details are normally entered with Stripe, so ListRush does not need to receive or store your complete card number or security code. ListRush stores limited customer, subscription, checkout, invoice and transaction references, status and allowance information needed to operate and reconcile the service.

After a new paid subscription completes, ListRush sends a contract-confirmation email to the verified account address. It contains the plan, charged total, available tax information, recurring terms, allowances and cancellation information. ListRush stores limited delivery and retry evidence, not the complete email body.

Successful account deletion attempts to cancel an active ListRush subscription. Stripe may independently retain payment, accounting, fraud or dispute records where required or permitted; ListRush cannot promise to erase Stripe-controlled records.

Necessary authentication storage keeps you signed in and secures the account. A short-lived eBay OAuth security cookie protects a connection attempt. A local appearance preference remembers light or dark mode and can be reset in Settings.

Vercel Web Analytics collects limited page views and selected aggregate product events. ListRush does not supply your name, email or account ID in these events. Vercel Web Analytics does not use cookies or browser storage for its request-based measurement. While enabled, ListRush keeps first- and latest-touch campaign source, medium, campaign, content, landing page and external referring host in this browser tab until the tab is closed. This supports product measurement, not advertising, targeting or decisions about you.

ListRush currently treats this limited use under PECR’s statistical-purposes exception and uses legitimate interests as its preliminary UK GDPR basis where personal data is involved. You can object without losing normal functionality. Turning analytics off stops future Vercel page views and custom events in this browser and clears ListRush attribution. A local preference remains to remember your choice; re-enabling removes it.

Information is shared where needed with Supabase for authentication, database and file storage; OpenAI for requested AI work; Stripe for payments; Vercel for hosting, logs and analytics; eBay for connections and requested marketplace actions; and Hostinger for support, privacy and transactional contract-confirmation email. Hostinger receives the email address and the minimum purchase and contract information needed for those messages.

Some providers act on ListRush’s instructions for certain services. A provider may be independently responsible for other purposes, such as eBay’s marketplace or Stripe’s payment, fraud and legal duties. These roles depend on activity and agreements and are not all finally classified. Disclosure may also occur where required by law, to protect rights, or in a legitimate business transfer with appropriate safeguards.

Some providers may process information outside the UK. Depending on the provider, account, destination and contract, protections may include UK adequacy regulations or approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum. Published safeguards have been recorded, but the mechanism and configuration applying to every actual ListRush account have not all been verified. Contract, entity, subprocessor and region checks remain open for operator and legal review.

Account, profile, listing, photo, template and preference data is generally kept while needed for an active account, then included in account deletion. Marketplace and relist records support safe operation and reconciliation; the period for minimised records kept after deletion awaits legal and operational approval. Billing and accounting periods also await professional verification, so we do not state invented fixed periods.

Provider logs, backups, payment records and support messages follow separate processes. Removal from active ListRush systems does not mean immediate disappearance from backups, caches or provider-controlled systems.

What account deletion does

A successful deletion cancels the active subscription where applicable, revokes ListRush’s eBay access, removes ListRush-hosted account, listing and photo data through the deletion process, and deletes the authentication identity. Minimised billing or marketplace-operation receipts may remain where justified. It does not end live eBay listings or instantly erase provider records, backups or caches.

Signed-in users can choose Download my ListRush data in Settings. The structured download generally contains profile and entitlement information, saved listings, marketplace connection and listing records, seller preferences, templates, AI usage and purchase information, contract-confirmation delivery evidence, and relist records held directly by ListRush.

Passwords, session credentials and eBay OAuth access and refresh tokens are deliberately excluded. Provider-held information, logs, support messages and information involving another person may need manual review or supplementation. Contact admin@listrush.co.uk for a broader access request.

Depending on the circumstances, UK data protection law may let you ask for a copy of your information; correct inaccurate or incomplete information; erase information; restrict its use; object to particular uses; or receive or transfer certain information in a portable format. You may withdraw consent where an activity relies on consent. Rights are not all absolute, and exemptions or other lawful reasons can limit a request.

Contact admin@listrush.co.uk to make a request or privacy complaint. We may ask for proportionate information to verify identity. If unhappy with our response, you can complain to the Information Commissioner’s Office (ICO), the UK regulator. See the ICO’s current complaint guidance (opens in a new tab).

ListRush does not intentionally ask for special-category information (such as health, ethnicity, religion or sexuality) or criminal-offence information during ordinary listing creation. Free text and photos can nevertheless include sensitive information or information about somebody else. Please avoid uploading information about you or another person that is not needed for the listing.

ListRush is intended only for people aged 18 or over. New users must confirm that they are 18 or over, and existing users are asked to confirm the same rule. This is self-declaration, not document or identity verification, so it cannot guarantee that no child accesses the service. If we learn that a user is under 18, we will restrict the account and review subscription cancellation, eBay access, deletion, retention and safeguarding steps. Contact admin@listrush.co.uk if you believe a child has provided information.

We update this page when processing or legal requirements change and show the version and dates above. For a material change, we assess whether prominent in-product or email notice is appropriate before it takes effect. A privacy notice usually gives information rather than asks for agreement; consent will be sought only if a particular new activity requires it. Source control retains repository history of published wording.