Privacy policy
Version 1.1, 4 October 2026
1. Data controller
WEB INT LIMITED, 128 City Road, London EC1V 2NX, United Kingdom, company number 15099106, is the controller of the personal data collected through pyryx.com (the "Platform"). Contact: privacy@pyryx.com.
WEB INT LIMITED is established in the United Kingdom and offers its services to persons located in the European Union and the European Economic Area. It is therefore subject to the UK GDPR and the Data Protection Act 2018, and to Regulation (EU) 2016/679 (the "GDPR") for persons located in the Union.
Lead supervisory authority: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, SK9 5AF, United Kingdom. Persons located in the Union may lodge a complaint with the authority of their country of residence (for example the CNIL in France, 3 place de Fontenoy, 75007 Paris).
2. Data collected
| Category | Data | Source |
|---|---|---|
| Identification and account | Surname, first name, username, email address, password (hashed), date of birth, language, country | Provided by you |
| Delivery and billing | Postal addresses, telephone number | Provided by you |
| Verification (sellers, withdrawals) | Identity document, proof of address, bank details (IBAN), company information, tax identification number; these are collected on behalf of the Payment provider and, for the tax number, for reporting obligations | Provided by you |
| Transactions | Listings, Orders, amounts, Balance, withdrawal history, tracking numbers, disputes, ratings, invoices | Generated by your use |
| Payment | Card numbers are entered directly with the Payment provider; pyryx receives only a transaction identifier, the last four digits and the card type | Payment provider |
| Communications | Messages exchanged through the Platform messaging, exchanges with support, reports | Provided by you |
| Technical | IP address, device identifiers, browser, operating system, pages viewed, timestamps, connection logs, cookie data (see Cookie policy) | Collected automatically |
| Authorised TV screens | Name given to each authorised TV, authorisation date, date last seen; the TV receives a token of which only a fingerprint is stored; deleted 30 days after removal, or after 120 days unused | Provided by you and generated by your use |
| Published content | Product photographs, Listing texts, avatar | Provided by you |
We do not collect special category data within the meaning of Article 9 of the GDPR. Identity data provided for verification is not used to infer special category characteristics.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing the account, providing the Platform services (Listings, Orders, messaging, Balance, disputes) | Performance of the contract (Terms of use) |
| Processing payments, withdrawals and identity checks | Performance of the contract; legal obligation (anti-money-laundering, for the Payment provider) |
| Traceability of professional sellers, handling of reports, moderation | Legal obligation (DSA); legitimate interest (Platform security) |
| Tax reporting of sellers' income (UK platform reporting rules, DAC7) | Legal obligation |
| Preventing and detecting fraud, counterfeiting and abuse, account security | Legitimate interest (protection of users and of the Platform) |
| Invoicing, accounting, retention of transaction evidence | Legal obligation |
| Customer support and responding to requests | Performance of the contract; legitimate interest |
| Sending transactional notifications (order, shipping, dispute) | Performance of the contract |
| Sending marketing communications (news, promotions) | Consent; or legitimate interest for products similar to those already purchased, with the option to opt out at any time |
| Usage statistics, service improvement, aggregated market data | Legitimate interest (cookieless audience measurement, see the Cookie policy) |
| Managing litigation and defending rights | Legitimate interest |
4. Recipients
- Other users: your username, country, ratings and status are public. Your name and delivery address are disclosed to the Seller of an Order (and the Seller's details to the Buyer for returns). Each user is responsible for their use of this data, which is limited to fulfilling the Order.
- Payment provider: Stripe Payments Europe, Ltd. (Ireland) and Stripe Payments UK, Ltd., acting as independent controllers for payment services, identity verification and holding of funds. Their privacy policy is available at https://stripe.com/privacy.
- Processors: hosting and delivery of the site, email delivery (Cloudflare, Inc., United States); database and accounts (Supabase, infrastructure located in Ireland); card images and static catalogue data (UpCloud Ltd, infrastructure located in Stockholm, Sweden); audience and performance measurement (Cloudflare Web Analytics, cookieless; Grafana Labs, United Kingdom); address geocoding (LocationIQ); mobile notifications (Apple, Google). Crash reports from the app are kept at Cloudflare, in a storage space restricted to the European Union; they contain the device model and system version, never your IP address or e-mail. These providers process data on pyryx's instructions under contracts compliant with Article 28 of the GDPR.
- YouTube and Twitch (Pyryx TV app): the Pyryx TV app plays creators' videos and live streams using the YouTube API Services and Twitch's embedded player. By watching a YouTube video, you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms); Google then processes data under its privacy policy (https://policies.google.com/privacy), and Twitch under its own (https://www.twitch.tv/p/legal/privacy-notice/). pyryx does not pass any of your account data to these services.
- Carriers: the Seller itself passes your address to the carrier it has chosen.
- Grading companies: the certificate number of a graded card may be verified with the issuing company, without transmitting your personal data.
- Authorities: tax authorities (platform reporting), judicial, police or regulatory authorities, on lawful request or legal obligation; intellectual property rights holders in the context of a counterfeit report, to the extent permitted by law.
- pyryx's advisers and insurers, in the event of litigation or a claim.
pyryx does not sell personal data and does not disclose it to third parties for marketing purposes.
5. International transfers
Data is processed in the United Kingdom and in the European Union. Transfers between the Union and the United Kingdom rely on the European Commission's adequacy decision for the United Kingdom and on the UK adequacy regulations for the EEA. Where processors are located outside these areas (for example in the United States), transfers are governed by the European Commission's standard contractual clauses, the ICO's International Data Transfer Addendum, or an adequacy decision (including the EU-US Data Privacy Framework for certified companies). The list of processors and applicable safeguards is available on request.
6. Retention periods
| Data | Period |
|---|---|
| Account and profile | Life of the account, then 3 years after the last activity or closure, unless a dispute is pending |
| Transactions, invoices, Balance | 6 years after the end of the relevant financial year (UK accounting and tax obligations); 10 years where the law of the professional seller's country requires it |
| Identity verification documents | 5 years after the end of the relationship, in line with the Payment provider's obligations; pyryx keeps only a temporary copy until transmission, then 30 days |
| Platform tax reports | Period required by UK rules and DAC7 (at least 5 years after the reported period) |
| Messages and disputes | 3 years after the end of the relationship, or until the dispute and any appeals are exhausted |
| Reports and moderation decisions | 5 years (DSA) |
| Technical and connection logs | 12 months |
| Cookies | See Cookie policy (13 months maximum) |
| Marketing | 3 years after the last contact, or until consent is withdrawn |
Data may be kept longer in archived form where necessary for the establishment, exercise or defence of legal claims.
7. Your rights
You have the rights of access, rectification, erasure, restriction, portability, objection (in particular to marketing and to processing based on legitimate interest), withdrawal of consent at any time, and the right to give instructions on the fate of your data after your death where national law provides for it. You may exercise these rights from your account settings (data download, deletion) or by writing to privacy@pyryx.com, or to the EU representative. We reply within one month, extendable by two months for complex requests. We may request proof of identity where there is reasonable doubt.
Some data cannot be erased before the statutory retention periods expire (transactions, invoices, tax reports). Deleting the account results in the anonymisation of your ratings and of your messages visible to other users.
You may lodge a complaint with the ICO or with the supervisory authority of your country of residence.
8. Automated decisions
pyryx uses automated fraud and counterfeit detection tools (analysis of prices, volumes, account behaviour, images). These tools may result in the temporary blocking of a Listing, a withdrawal or an account. Any decision with significant effects (termination, prolonged blocking of funds) is reviewed by a person before being upheld, and you may contest it through the internal complaint system. No profiling is carried out for advertising purposes.
9. AI assistants
If you connect an AI assistant, such as Claude or ChatGPT, to your pyryx account through mcp.pyryx.com, you approve it yourself on the Platform, and it can only do what your account can do.
- What we process: your account identifier, the identifier of the assistant application, the name of each tool called, a fingerprint (SHA-256) of the call's arguments — never the arguments themselves —, the time, duration and result status of each call; for an action you are asked to confirm, the confirmation question and a single-use token valid ten minutes. We also keep anonymous technical counters (tool, assistant application, status, duration).
- Why: to run the tools you ask for, apply daily limits, refuse duplicate actions, show you your assistants' activity and protect your account (performance of the contract; legitimate interest).
- How long: the call log is kept 90 days; confirmation tokens are deleted once used or expired.
- Who receives what: the results of the tools your assistant calls are sent to that assistant's provider (for example Anthropic for Claude, OpenAI for ChatGPT), which processes them under its own privacy policy. pyryx receives the tool calls, not your conversation with the assistant.
- Pyryx Pro: when a store owner allows an assistant, the store's activity log also records that assistant's reads and actions.
- Your control: Account → My assistants shows each assistant's calls over 30 days and lets you cut it at any time; cutting it revokes its access and its sign-in sessions.
10. Security
pyryx implements appropriate technical and organisational measures: encryption of communications (TLS), password hashing, optional two-factor authentication, access segregation, logging, encrypted backups, regular access reviews. Bank card data is never stored by pyryx. In the event of a data breach likely to result in a high risk to your rights, you will be informed as required by law.
11. Minors
The Platform is reserved for adults. We do not knowingly collect data from minors. If you become aware of an account opened by a minor, contact us; the account will be closed and the data erased, subject to legal obligations.
12. Changes
Any substantial change to this policy is notified by email or on the Platform at least 15 days before it takes effect. Previous versions are available on request.