Privacy Notice

Last updated 9 October 2026

Interim version pending solicitor review. This is a plain-English interim notice while our full legal documents are reviewed by a solicitor. It describes how Inventra works today. We will replace it with the reviewed version and update the date above.

1. Who we are

Inventra (https://inventrainterface.com) is run by Inventra Interface Limited (company number 17339336) ("we", "us"), whose registered address is 2-4 Packhorse Road, Gerrards Cross, Buckinghamshire, SL9 7QE.

We are the "controller" of the personal data described here under the UK GDPR and the Data Protection Act 2018.

• Privacy contact: admin@inventrainterface.com
• Anything else: admin@inventrainterface.com

2. What we collect

Account details. Your name, email address and password, and your preferred language. Passwords are handled by our sign-in provider and stored in hashed form, never in plain text. We also record when your account was created and when you last signed in.

How you found us. If you arrive through a link with campaign tags (such as utm_source), your browser remembers the first set of tags, the page you landed on and the website that sent you, for up to 30 days. When you create an account, we save these to your profile. If you sign up with a promotion code (such as LAUNCH30) or through a referral link, we record the code.

Your inventory and business records. Everything you put into Inventra: item titles, descriptions, brands, sizes, conditions, prices and costs, SKUs, storage locations and QR codes, sales, expenses and notes. This is mostly business data, but it counts as personal data if you trade as an individual.

Photos. The item photos you upload or take with your camera.

Team members. If you invite teammates or viewers, we store their email address and role.

Marketplace connections. When you connect eBay or Shopify, we store the access tokens those platforms give us, your shop or account identifier, and the listing IDs we create or import. We read back listing details and the sales information the platform makes available to us, such as item, SKU, price, date, fees and the marketplace's transaction or order reference. We do not store buyer names, addresses or contact details from those orders.

Chrome extension (Vinted). If you use the Inventra Listing Helper for Vinted, we create an extension token linked to your account. We record when it was created, when it was last used and whether you have revoked it. The extension uses the token to:

• fetch the items you have queued for Vinted (listing details and temporary links to the item's photos);
• report back whether each job worked, which we keep as a log.

It runs in your own browser and uses the Vinted login already there. It does not send us your Vinted password, messages or buyers' details, and it does not import your Vinted sales.

Billing. Your plan, subscription status, renewal and free-period end dates, extra seats and Inventra Vision credit purchases. Card and payment details are collected and held by Stripe (see section 5). We never see or store your full card number.

Deal alerts. The eBay searches you save and the matching listings we find for you.

Help chat. The questions you type into the help chat on our website. See section 4.

Support. Emails you send us.

Website usage.

• Our hosting provider's analytics script counts page views and collects basic details such as the referring site, browser type and language.
• On our free profit calculator and our LAUNCH30 offer pop-up, we count views, calculations, clicks and dismissals against a random ID stored in your browser. For a calculation, we store only a scrambled fingerprint of the inputs, not the prices you entered. We don't store your IP address or any text you type there. If you are signed in, the count is linked to your account.
• Our hosting and security providers process your IP address in their normal server logs.

We do not ask for special category data (such as health or ethnicity), and please don't upload it.

3. How we use it and our lawful bases

We do not sell your data and we do not use it for advertising. We do not make decisions about you based only on automated processing that have legal or similarly significant effects.

4. AI features and photo lookup

Inventra Vision. When you press auto-fill, up to four photos of your item, downscaled in your browser, are sent through the Lovable AI Gateway to a Google Gemini model. It suggests listing details such as title, brand, category, condition and price, and you decide what to keep. Please photograph only the item, not people, addresses or documents. These providers process images under their own terms. We do not ask them to use your images to train models, and we use only the paid API services.

Help chat. Your question and the recent conversation are sent through the Lovable AI Gateway to a Google Gemini model to write a reply. Answers can be wrong, so check anything important with us. We store each question, with email addresses and access tokens removed automatically, along with the page you asked from, any campaign tags, and whether the assistant could answer. Please don't type personal details into the chat. We use your IP address briefly, in memory only, to limit how many questions can be sent, and we don't store it.

eBay photo lookup. If your eBay account is connected and you use the photo lookup on the Add Item form, we send one item photo to eBay's image search to find similar listings. eBay handles that photo under its own terms.

5. Who we share data with

We use these service providers to run Inventra. They process data on our instructions, except where we say they act independently.

• Lovable (lovable.dev): hosting, the Lovable Cloud backend, email delivery, the AI gateway, website analytics and error reporting.
• Supabase (through Lovable Cloud): database, sign-in and photo storage. Our database is hosted by Supabase through Lovable Cloud and may be located in the UK, the EU or the United States.
• Google: runs the Gemini models behind Inventra Vision and the help chat. Our pages also load fonts from Google Fonts, so your browser sends your IP address to Google.
• Cloudflare: content delivery and security in front of our website.
• Stripe: payments. Our checkout uses Stripe's Managed Payments service. Under it, Stripe (which may appear to you as "Link") acts as the merchant of record for your payment. It processes your payment details, sends receipts and handles tax and payment support as an independent controller under its own privacy policy (https://stripe.com/privacy).
• eBay and Shopify: only when you connect them. We send them the listings and photos you choose to publish and read your listings and sales back. They handle that data under their own privacy policies.
• Vinted: we have no server connection to Vinted. Our Chrome extension runs in your own browser using your own Vinted login. Vinted handles anything you post under its own terms.

We may also share data when the law requires it, to protect our rights or users' safety, or with a buyer if the business is sold (we would tell you).

Photos you publish. So that marketplaces can fetch listing images, item photos can be reached at hard-to-guess web addresses without signing in. Anyone with one of those links can view the photo. Once you publish, the marketplace keeps its own copy.

6. International transfers

Some of our providers (including Lovable, Supabase, Google, Cloudflare, Stripe and eBay) are based in, or may process data in, the United States or other countries outside the UK. Where that happens, we rely on one of these, as offered in each provider's data processing terms:

• UK adequacy regulations, including the UK-US "data bridge" for certified companies; or
• the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

7. How long we keep it

• Your account and its records (stock, photos, sales, expenses, team members, marketplace and extension tokens, extension logs, deal alerts): for as long as you have an account. When you delete your account (Settings, then Danger zone, then Delete account), any active subscription is cancelled straight away and your account and linked records are deleted. This can't be undone. Deleting your account also deletes your stored item photos. Photos uploaded by teammates into a workspace belong to that workspace's owner account.
• Items you delete go to the Deleted tab, where you can restore them, until you permanently delete them or delete your account.
• Campaign tags in your browser: up to 30 days, or until you create an account.
• Help-chat questions, and profit calculator and offer pop-up counts: kept until they are deleted. There is no automatic cleanup. Anonymous usage counts for the profit calculator and the offer pop-up are unlinked from your account when it is deleted. The counts themselves are kept.
• Backups and logs: deleted data may stay in provider backups and server logs for a limited period.
• Payment records: Stripe keeps these under its own rules. Where we hold financial records ourselves, we keep them for up to 6 years to meet UK tax and company law requirements.
• Marketplaces: deleting your Inventra account doesn't delete listings already on eBay, Shopify or Vinted. Remove those on the marketplace.

8. Your rights

Under UK data protection law you can ask us to:

• give you a copy of your personal data;
• correct inaccurate data (you can edit most details yourself in Settings);
• delete your data (you can do this yourself with Delete account);
• restrict or object to some processing, including processing based on legitimate interests;
• give you data you provided in a portable format.

Email admin@inventrainterface.com. We will reply within one month, and we may need to confirm your identity first. Using your rights is free in most cases.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/ or 0303 123 1113.

9. Cookies and browser storage

The analytics script and its cookie are not strictly necessary, and today they load for every visitor without asking first. We do not use advertising or cross-site tracking cookies. You can block or delete cookies and browser storage in your browser settings, but signing in needs local storage.

10. Security

Data travels over HTTPS. Database access rules restrict your records to your account and your team. Marketplace and extension tokens are held on our servers, and you can disconnect marketplaces and revoke extension tokens at any time in Settings. Your extension token is also stored in your browser's extension storage, so revoke it if you lose that computer. Only a small number of authorised staff can access account data, and only for support, security or legal reasons. No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the ICO as the law requires.

11. Children

Inventra is for people aged 18 and over. We do not knowingly collect data from children.

12. Changes

We will post any changes here and update the date at the top. If a change is significant, we will email account holders.