Legal

Privacy Notice

Effective and last updated: 19 August 2026.

Controller and contact

The data controller is REVIVE SPORTS LTD:

REVIVE SPORTS LTD

Company number: 17387588

Private company limited by shares, registered in England and Wales

Registered office:

Unit 30 Space Business Centre

Smeaton Close

Aylesbury, England

HP19 8FJ

United Kingdom

Email: hello@revivesports.co.uk

Privacy requests: hello@revivesports.co.uk.

Information and why we use it

Activity and information	Purpose	Lawful basis
Accounts: name, email, login/session data, profile, address and preferences	Create, secure and support your account	Contract; legitimate interests in account security
Selling: contact details, postcode, item details/photos, offers, messages, bank details or PayPal email	Value items, form and perform a purchase contract, pay you, prevent fraud and handle disputes	Steps at your request and contract; legal obligation for records; legitimate interests for fraud and claims
Shopping and paid reviews: basket, account ID, delivery/contact details, order history, Stripe payment references, Google Play or Apple App Store product and purchase/transaction identifier, purchase status and review-credit history	Checkout, verify payment, issue review credits, delivery, returns, refunds, restore unfinished app purchases and provide customer service	Contract; legal obligation; legitimate interests for fraud, reconciliation and claims
Authenticity: item metadata, product codes, photos, AI result and human-review notes	Provide the requested check, improve reliability and prevent counterfeit/fraud risk	Contract; legitimate interests for quality and fraud; consent only for optional private-reference reuse
Messages and transactional email	Respond, send confirmations and service updates	Contract and legitimate interests in customer service
Trustpilot invitation after a completed paid authenticity review or confirmed delivery of a shop order: email address and unique review or order reference	Ask for fair feedback about the completed service or purchase; the invitation is sent by Trustpilot and the reference is not displayed publicly	Legitimate interests in measuring and improving the service; you may object by emailing us
Optional abandoned-basket email consent and checkout contents	Send the single reminder you request if checkout is not completed	Consent; you can leave the box unticked without affecting checkout
Anonymous daily page-view and broad device/referrer totals; product codes entered into the public lookup and whether the catalogue returned a match or copied-code warning; a rotating one-day visitor code	Measure and improve the website, free AI checker and shirt catalogue without advertising or individual profiling	Legitimate interests in service improvement; you can object on the Storage & Cookie page
IP address, request/device data, security challenge and logs	Operate, diagnose and secure the service	Legitimate interests in reliable and secure systems

You must provide information marked as required where it is needed to provide a check, make or accept an offer, pay you, take an order or deliver goods. Without it, that part of the service cannot be completed.

AI and authenticity decisions

Item photos and item metadata (such as team, brand, season and visible product code) are sent to OpenAI to identify visible features and produce an authenticity assessment. The website does not send the email field to OpenAI as part of the analysis prompt. The result is probabilistic guidance, not a guarantee.

The checker does not make a solely automated decision with legal or similarly significant effect. Its AI result does not by itself transfer ownership, set a final price or reject a seller's legal rights. Revive Sports can review the evidence and you may request human review or challenge a result by email.

Recipients and platforms

Supabase — accounts, database and photo/object storage.
Vercel — website hosting, delivery, operational logs and execution of Revive Sports' own anonymous aggregate counter. Vercel Analytics is not installed.
OpenAI — authenticity image/text analysis and reference embeddings.
Resend — confirmation, offer, review and order-related email when configured.
Trustpilot — customer email address and unique service or order reference are included in a blind copy of the completed paid-authenticity-review email or confirmed-delivery email so Trustpilot can send a neutral review invitation and its configured reminder. The Trustpilot address is not visible to the customer. Revive Sports does not share authenticity photos or the verdict, order contents, delivery address or payment details for this purpose.
Stripe — buyer checkout, card payment, fraud checks and refunds. Revive Sports receives payment references and status, not full card details.
Google Play — Android in-app payment, product pricing, purchase status, refunds and purchase recovery. Revive Sports receives the Google Play product, purchase token and transaction status, not full card details.
Apple App Store — iOS in-app payment, product pricing, signed transaction status, refunds and purchase recovery. Revive Sports receives the App Store product and transaction identifiers needed to verify the purchase, not full card details.
eBay — seller-stock import, listing reconciliation and stock availability where enabled.
Royal Mail or Evri — labels, delivery, tracking, returns and claims when that carrier is used.
PayPal or the banking system — paying sellers using the details they choose to provide.
WhatsApp/Meta — messages you choose to start using the WhatsApp Business link; WhatsApp also handles those messages under its own notice.

Information may also be shared with professional advisers, insurers, courts, regulators, tax authorities or law enforcement where necessary and lawful. Revive Sports does not sell personal information.

International transfers

Some providers may make information accessible outside the UK, including in the EEA or United States. Before enabling a provider, Revive Sports must confirm its role and transfer terms. Restricted transfers are covered, as applicable, by UK adequacy regulations (including an eligible recipient under the UK Extension to the EU-US Data Privacy Framework) or contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with the required data-protection assessment. Email us for a copy or description of the safeguard relevant to your information.

Retention schedule

Unfinished sell draft on your device	30 days from the last save, then the browser draft is deleted; you can clear it sooner.
Basket and temporary hand-off data	Until checkout, removal or browser clearing; authenticity-to-sell photo hand-offs are removed when imported.
Account/profile	While active. After 24 months without account activity we review it and contact you where practical; an account closed on request is deleted within 30 days, apart from records we must retain.
Seller bank or PayPal payment details	Requested only after an offer is accepted, through a one-time secure form. The destination is encrypted outside the ordinary profile/submission record and deleted 14 days after it is submitted. If it expires before payment, Revive Sports requests it again through a fresh secure link. Raw link tokens are not stored.
Completed purchases, sales and core tax/accounting records	6 years after the end of the accounting period containing the transaction, then identifying details are deleted or anonymised unless a dispute or legal requirement needs longer.
Google Play and Apple App Store purchase and review-credit records	Store purchase tokens or signed transaction identifiers are used to verify and finish the purchase. Transaction, entitlement and refund records are retained with the related paid review for accounting, fraud prevention, support and dispute handling, normally for 6 years after the end of the relevant accounting period.
Uncompleted or rejected valuation submissions	24 months after the last action; ordinary submission photos are deleted after 12 months unless separately retained under private-reference consent.
Authenticity checks without private-reference consent	12 months after submission, then the check, photos and direct identifiers are deleted or anonymised.
Private authenticity references with consent	Up to 5 years, reviewed at least annually. Withdrawal stops new reference use and triggers removal from the reference set within 30 days, unless needed for a live legal claim.
Customer support and WhatsApp correspondence	24 months after the conversation closes, unless linked to a transaction or dispute kept under the longer period above.
Security and application logs	Normally 30 days; confirmed security incidents may be retained for up to 24 months.
Failed or expired checkout reservations	30 days after expiry; inventory and security event records are then deleted or aggregated.
Abandoned-basket reminder consent	Stored with the failed or expired checkout record for up to 30 days. Only one reminder is sent for that basket.
Anonymous website and product-code analytics	One-day visitor codes are deleted within 72 hours. Daily aggregate page-view, visitor, device, referrer and product-code lookup totals, including searched product codes, are kept for up to 5 years for year-on-year reporting and catalogue improvement.

A legal hold overrides normal deletion only for the information needed for a live dispute, tax enquiry, fraud investigation or legal claim. Backups are rotated out within 90 days after primary deletion.

Your rights

Depending on the processing, you may ask for access, correction, erasure, restriction or portability, and object to processing based on legitimate interests, including Trustpilot review invitations. You may withdraw optional private-photo reference consent or abandoned-basket reminder consent at any time without affecting earlier lawful use. Every basket reminder identifies Revive Sports and provides an email address for opting out. Email hello@revivesports.co.uk; identity checks may be required.

You may complain to the Information Commissioner's Office. Please contact Revive Sports first if you are comfortable doing so, so the issue can be investigated.

Data protection registration

REVIVE SPORTS LTD is registered with the Information Commissioner's Office under reference ZC222058. The registration began on 13 August 2026 and is currently recorded as expiring on 12 August 2027.

The registration reference can be checked using the ICO's public register of fee payers. Revive Sports keeps the registration under review and renews it as required.