Privacy Policy

Last updated: April 2026

1. Who We Are

Break it Down (“BID”) is operated by Bargain Bill, a sole trader registered in England. For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), we are the data controller. Contact us at support@breakidown.co.uk.

2. What Data We Collect

We collect the following personal data:

  • Account information: name, email address, hashed password
  • Billing information: processed and stored by Stripe — we do not store card numbers
  • Usage data: features used, AI requests made, pallets created, items scanned
  • Business data you upload: manifests, product photos, listing content, inventory records
  • Technical data: IP address, browser type, device information (collected automatically via server logs)
  • Third-party tokens: eBay and WooCommerce API credentials you connect (stored encrypted)

3. How We Use Your Data

We use your data to:

  • Provide and maintain the Service (account management, inventory features, AI listing generation)
  • Process payments via Stripe
  • Send transactional emails (verification, password reset, billing receipts)
  • Push listings to eBay and WooCommerce on your behalf
  • Monitor usage against your plan limits
  • Improve the Service (aggregated, anonymised analytics)

We do not use your data for advertising. We do not sell your data to third parties.

4. Legal Basis for Processing

Under UK GDPR, we process your data on the following legal bases:

  • Contract: processing necessary to provide the Service you signed up for (Art. 6(1)(b))
  • Legitimate interest: security monitoring, fraud prevention, service improvement (Art. 6(1)(f))
  • Legal obligation: tax and financial record-keeping (Art. 6(1)(c))
  • Consent: marketing emails, if you opt in (Art. 6(1)(a)) — you can withdraw at any time

5. Data Sharing

We share data only with the following third parties, all of which are necessary to provide the Service:

  • Stripe (payments) — Privacy Policy
  • Resend (transactional email) — Privacy Policy
  • Anthropic (AI features — your product data is sent for listing generation) — Privacy Policy
  • eBay / WooCommerce — only when you explicitly push listings

We do not share data with any other third parties. All processors listed above are GDPR-compliant.

6. Data Storage & Security

Your data is stored on servers located in the United Kingdom. We use the following security measures:

  • HTTPS/TLS encryption for all data in transit
  • Passwords hashed with bcrypt (never stored in plain text)
  • Database access restricted to authenticated application servers only
  • Team-level data isolation (you cannot access another team's data)
  • API tokens stored encrypted at rest

7. Data Retention

  • Active accounts: data retained for the duration of your subscription
  • Cancelled accounts: data deleted within 30 days of account closure
  • Billing records: retained for 7 years as required by UK tax law (HMRC)
  • Server logs: retained for 90 days, then automatically purged

8. Your Rights

Under UK GDPR, you have the right to:

  • Access — request a copy of the personal data we hold about you
  • Rectification — ask us to correct inaccurate data
  • Erasure — ask us to delete your data (“right to be forgotten”)
  • Portability — request your data in a machine-readable format
  • Object — object to processing based on legitimate interest
  • Restrict — ask us to limit how we use your data
  • Withdraw consent — where processing is based on consent

To exercise any of these rights, email support@breakidown.co.uk. We will respond within 30 days.

9. Cookies

BID uses only essential cookies required for the Service to function:

  • Authentication token — stored in localStorage to keep you signed in
  • Stripe session cookies — set during checkout (managed by Stripe)

We do not use tracking cookies, analytics cookies, or advertising cookies.

10. Children

BID is not intended for use by anyone under the age of 18. We do not knowingly collect data from children.

11. International Transfers

Some of our processors (Stripe, Anthropic, Resend) may process data outside the UK. Where this occurs, transfers are protected by Standard Contractual Clauses (SCCs) or equivalent safeguards as required by UK GDPR.

12. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days in advance. The “last updated” date at the top will reflect the latest version.

13. Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

14. Contact

For any privacy-related questions, contact us at support@breakidown.co.uk.