PRIVACY NOTICE.

Version 2026-09-14-v6 · effective 14 September 2026.

Controller and contact

UP FOR GRABS, Office 8241AV
182-184 High Street North
Area 1/1
East Ham
London
E6 2JA
United Kingdom, controls the personal information used by this service. Make privacy requests through the Support page or email support@upforgrabs.shop.

Information we use

We use account username, email, verification state, one-way password hash and security/session version; order items, prices, contract and consent wording/version, consent hash and time; Stripe payment, charge, refund and dispute identifiers and status; public display names, claim content, approved images, captions and links; referral attribution, Referral Jar entries, UP Credit balances, earnings, reversals, status progress and redemption history; Card Binder awards, quantities and current ownership; Trading Outpost listings, preferences, offers, reservations and transfer history; and support or complaint correspondence.

If community features are enabled, we also use structured reactions, daily check-in dates, streak totals, Chaos XP ledger entries, achievement awards, privacy choices, structured activity events and moderation state. Reports about eligible Registry content contain the reporter account, selected category, optional private detail and moderation outcome. A future Registry Citizen number or Today’s Bad Decision entry will not be assigned or published unless its separate feature gate and stated review requirements have been completed.

For Arcade fulfilment we use the recipient name, delivery address for physical rewards, country, size/style/platform or other fulfilment preference, reward description and cost snapshot, approval and delivery status, tracking reference and related consent evidence. A digital gift card is sent to the account’s verified email and does not require a postal address. Stripe handles card numbers; this site does not receive or store them.

What becomes public

A username or collection name, display name, claim or pack, approved image, caption and purchase date can be public. Job Centre squares can publish the advert title, description, approved image and submitted public links. Public collections and the Shameboard can show eligible purchase counts and aggregate net spend under the public username; Job Centre advertising purchases are excluded. Trading Outpost listings show the public collection name, listed item, preference, offer count and time remaining, but not email or delivery information. Reaction totals and achievement attribution can be public when those modules are enabled and the applicable privacy choices allow it.

Account email, password hash, payment identifiers, UP Credit balance, fulfilment details, tracking reference, private Binder ownership, security identifiers, report details and reporter identity, and the identities behind unsuccessful offers are not public.

Purposes and lawful bases

We use account, order, payment, fulfilment, Binder and trade data to take steps requested by you, perform contracts, deliver and maintain purchases and rewards, administer ownership and transfers, authenticate users, send necessary service messages, provide support and handle cancellations, refunds or Credit restoration. We retain accounting and transaction evidence to comply with legal obligations.

We use proportionate security, audit, fraud-prevention, referral-abuse, stock-control and moderation information for our legitimate interests in protecting customers, preventing manipulation and operating an accurate registry, loyalty programme and optional community features. Reactions, check-ins and status records are used to provide the free feature the user chose to use, prevent duplicate counting and abuse, calculate genuine totals, and keep the service safe. Optional achievement attribution follows the user’s privacy choices. Where consent is legally required, such as an express request for immediate digital supply, it is recorded separately. We do not use consent where processing is necessary for a contract or legal obligation.

Just-in-time Arcade information

The Arcade redemption form collects only the information needed for the selected reward. Postal fields are used for physical delivery; the verified account email and chosen platform are used for a digital gift card. Fulfilment details are encrypted at rest and restricted to authorised administrators and the suppliers or couriers needed to complete that redemption. Do not put payment-card details or unrelated sensitive information in a preference field.

Uploads and moderation

JPG, PNG and WebP uploads are checked, cleaned and resized before storage. Embedded device and location metadata is removed. New uploads stay private to the owner and authorised reviewer until approved. Uploads from abandoned checkouts are removed after expiry; rejected files remain private until deleted under the applicable retention process.

Recipients and international transfers

Stripe receives payment and fraud-prevention information under its own privacy information. Our web host and email provider process data to host the service and send transactional messages. Product suppliers, fulfilment providers and couriers receive only the recipient and delivery information reasonably needed to supply an approved reward. Professional advisers, insurers, payment providers, regulators or law enforcement may receive limited information where reasonably necessary or legally required.

Where a provider processes personal information outside the UK, we use the applicable UK adequacy regulation, International Data Transfer Agreement, UK Addendum or another lawful safeguard and make further information available on request.

Retention and deletion

Account, current ownership and active-claim information remains while the account or entitlement is in use. Payment, refund, dispute, contract, consent, fulfilment and trade evidence is normally retained for up to six years after the relevant transaction or completion so we can meet accounting obligations and establish, exercise or defend legal claims. Detailed delivery information is encrypted, access-restricted and deleted or minimised earlier where it is no longer reasonably needed for delivery, returns, warranty, fraud prevention or a dispute.

The former Noticeboard service has been discontinued. Any restricted historical messages, reports, moderation decisions or audit records that remain are no longer used to operate a public conversation and are retained only for as long as reasonably needed to handle complaints, prevent misuse or establish, exercise or defend legal claims, then deleted or minimised. Reporter identities remain restricted to authorised reviewers.

Reaction rows, streak/check-in records, status ledgers, achievements and structured activity records are retained while the account and feature remain in use so totals, anti-abuse controls and awards stay accurate. A confirmed account deletion pseudonymises the account and collection, removes login and recovery information, releases or hides active claims, removes associated uploads, closes pending orders and removes the account from the Shameboard. It does not erase records that must reasonably remain for tax, contracts, consent evidence, fraud prevention, moderation, disputes or immutable ownership and status history. Verification, reset and deletion tokens are stored as hashes and expire after 30 minutes; expired token and rate-limit records are periodically removed or minimised.

Cookies and visit counts

Strictly necessary cookies protect sign-in, account access, community submissions and checkout. A signed-in account cookie can last for up to 14 days; signing out clears it. Referral attribution is kept only long enough to complete account creation. There is no advertising tracker. Browser storage may retain harmless interface preferences. See Cookies & Storage for the current inventory.

The homepage Nosey Parker-o-Meter stores only total and daily counts. Repeat views may be grouped. It does not retain an IP address, browser description, account identifier or page-by-page history for that counter, and obvious automated visits are excluded where possible.

Automated decisions

Rate limits, moderation checks, stock locks and fraud indicators can pause or reject an action, but a customer can ask support for human review. We do not make solely automated decisions producing legal or similarly significant effects about Arcade fulfilment.

Your rights

Depending on the circumstances, UK data-protection law may provide rights of access, correction, erasure, restriction, objection and portability, and a right to withdraw consent where consent is the lawful basis. Some information must remain for accounting, legal claims, fraud prevention or ownership integrity. Contact us so the account can be verified safely. You may complain to the UK Information Commissioner at ico.org.uk.

Security and changes

We use password hashing, email verification, short-lived single-use links, owner checks, HTTPS, encrypted fulfilment details, restricted uploads, rate limits and security logging. No system can promise absolute security. We regularly review this notice and will publish material changes with a new version and effective date before using information for a materially new purpose.