Name, email address, password (hashed), account creation date, and account type (Buyer, Specialist, or both).

For Specialists: display name, profile description, portfolio items, service listings, and verification status. For all Users: any profile information voluntarily added.

Order details including order reference, service purchased, agreed price, Platform Service Fee charged, delivery date, and order status. We do not store card details; these are handled entirely by Stripe.

All messages exchanged through the Platform's messaging system, including pre-order briefs, Pre-Offer Disclosure Messages, Custom Offers, order communications, revision requests, and dispute submissions. These are retained as the Inbox Record and form part of every Order Record.

For Buyers: billing address and payment confirmation data from Stripe. For Specialists: Stripe Connect account identifiers, payout confirmation data, and bank country. We never hold or see full card numbers or bank account details.

IP address, browser type and version, device type, operating system, time zone, pages visited, session duration, and referral source. This data is collected automatically when you use the Platform.

For Specialists: portfolio submissions, skills evidence, and any additional material submitted during the verification process.

Communications submitted to support@celestialverity.com, dispute and complaint submissions, and any documentation submitted as part of the Platform's formal dispute or complaint process.

When a Specialist sends a Custom Offer and a Buyer accepts it at checkout, the Platform records the timestamp and account identifiers of both actions. These constitute electronic signatures under the Electronic Communications Act 2000 and are retained as part of the Order Record.

The majority of our processing is necessary to perform our contract with you — operating your account, processing orders, generating Order Records, facilitating payouts, resolving disputes, and operating the AI-assisted dispute review process. Without this processing we cannot provide the Platform services.

We retain certain transaction and communication data for a minimum of 7 years to comply with financial record-keeping requirements under UK law. We also process data as required by the Proceeds of Crime Act 2002, the Money Laundering Regulations 2017, and in response to lawful requests from regulatory authorities including the National Crime Agency, the ICO, and the CMA.

We process technical data for fraud detection and platform security, and use automated pattern scanning of messages to detect contact information sharing in breach of our Terms. Our legitimate interest in maintaining a secure, compliant, and functional marketplace for all Users is balanced against your rights. We do not rely on legitimate interest for any processing that has a material adverse impact on your rights or freedoms.

We rely on consent only for non-essential cookies. Consent is obtained through our cookie consent banner, which allows granular control over each cookie category. You may withdraw consent at any time — this does not affect the lawfulness of processing carried out before withdrawal and does not affect your use of the Platform.

Payment and payout processing. Stripe processes payment data as an independent data controller for its own services and as our data processor for payout-related functions. Payment events processed include payment authorisation, payment confirmation (payment_intent.succeeded), payment failure (payment_intent.payment_failed), and refund processing (charge.refunded). Transactions appear on statements as "CELESTIAL VERITY". Stripe's privacy policy applies to data it processes as controller: stripe.com/privacy.

The Platform's messaging inbox is operated by a third-party messaging provider. All inbox messages, Custom Offers, Pre-Offer Disclosure Messages, and order communications are stored on that provider's servers. The Platform only uses messaging providers who have entered into a Data Processing Agreement (DPA) under UK GDPR Article 28, confirming that message content will not be used for the provider's own purposes beyond delivering the messaging service and will not be used to train AI models. Details of the current messaging provider and their DPA are available on request at support@celestialverity.com.

When a dispute or complaint is raised, the Platform copies the relevant inbox thread into a third-party AI system for analysis as part of the dispute review process described in Section 10. The Platform only uses AI providers for this purpose who have entered into a Data Processing Agreement under UK GDPR Article 28, confirming that data submitted for dispute review will not be used to train, fine-tune, or improve the provider's AI models and will not be retained beyond the immediate analysis. The Platform does not commit to using any specific AI provider — it commits to ensuring any provider used meets these DPA requirements.

E-commerce platform infrastructure used to operate the Platform's ordering system. Personal data is processed in accordance with WooCommerce's data processing agreement.

The Platform's WordPress installation and database are hosted by a third-party hosting provider under a data processing agreement. Server-level personal data (including account data and order data stored in the WordPress database) is processed within the terms of that agreement. Details of the current hosting provider are available on request.

We will disclose personal data to law enforcement, regulatory bodies, or other authorities where required by law or where we have a reasonable belief that disclosure is necessary to protect legal rights, prevent fraud, or respond to a lawful court order or regulatory request.

The Platform is subject to the Proceeds of Crime Act 2002 (POCA) and the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017). Where we are required to submit a Suspicious Activity Report (SAR) to the National Crime Agency (NCA), we are legally prohibited from informing the person concerned that a report has been made (the "tipping-off" restriction under POCA 2002 s333A). In these circumstances the Platform may restrict, suspend, or close an account without being able to provide reasons at the time. This processing is carried out under our legal obligation lawful basis. Where an account is suspended for AML compliance reasons, the Platform will review the suspension as soon as it is legally permitted to do so following the lifting of any applicable legal restriction, and will notify the User of the outcome within a reasonable time. We cannot provide further information about specific AML reports or the legal restrictions in force.

Platform display names are visible to other Users. For Order fulfilment, the Specialist sees the Buyer's display name and order details. The Buyer sees the Specialist's profile and listing details. Email addresses and personal contact information are never shared between Buyers and Specialists through the Platform. Sharing contact information through the Platform's messaging system is prohibited under the Terms of Use.

Business Buyers who act as data controllers in respect of personal data contained in their briefs or Order materials — for example, where a brief contains personal data relating to the Buyer's own customers, employees, or service users — should request a formal Data Processing Agreement (DPA) under UK GDPR Article 28 before submitting any such brief through the Platform's messaging inbox. Under UK GDPR Article 28, the DPA must be in place before processing of that personal data begins. The Platform will provide a DPA within 10 Business Days of a written request to support@celestialverity.com. Business Buyers who are uncertain whether their brief contains personal data within the meaning of the UK GDPR are advised to seek independent legal advice before submitting the brief.

In the event of a merger, acquisition, or sale of all or part of Celestial AI Agents Ltd's business, personal data may be transferred to the acquiring entity as part of that transaction. Users will be notified of any such transfer and their rights will be preserved. The commitment in Section 3 not to use inbox content for AI training survives any change in ownership.

If you wish to report suspected unlawful conduct by Celestial Verity to a regulatory authority — including the ICO (data protection), the CMA (consumer protection and competition), the FCA (financial services), or the NCA (financial crime) — you may do so without any adverse consequence to your account. The Platform will not restrict, suspend, or penalise your account because you have made, or indicated an intention to make, a complaint or report about the Platform to any regulatory authority. This protection applies regardless of whether the authority upholds your complaint.

When a dispute or complaint is raised, a member of the Celestial Verity team manually locates and reads the relevant inbox thread in full. The team member then copies the thread into the best available AI system for analysis. The AI produces a finding. The team member reviews that finding and issues the Platform's final determination by email to all parties. The AI's finding informs but does not substitute for the human determination.

The lawful basis for this processing is contract performance — resolving disputes is a core part of the Platform's service obligations to all Users. The Platform only uses AI providers for dispute review who have entered into a Data Processing Agreement under UK GDPR Article 28, confirming the data will not be used for model training or retained beyond the immediate analysis.

The Platform operates an automated system that scans outgoing messages in the inbox for patterns consistent with contact information — including email addresses, telephone numbers, social media handles, and similar. Messages flagged by this system are reviewed by a human administrator before any action is taken. No message is blocked automatically without human review. The lawful basis is legitimate interest — maintaining the integrity, safety, and commercial structure of the Platform's closed messaging environment.

The Platform will never use the content of User inbox threads, Pre-Offer Disclosure Messages, Custom Offers, briefs, Order materials, Deliverables, or dispute submissions to train, fine-tune, or improve any AI model — whether operated by Celestial Verity or by any third party. This commitment is stated in the Platform's Terms of Use (Section 34.5) and applies without exception. It survives any change in Platform ownership or management.

Platform administrators may access User inbox threads only for the following four purposes: dispute resolution, safeguarding investigations, investigation of suspected Terms of Use breaches, and legal compliance. Every access is logged with the timestamp, administrator account identifier, and the stated purpose. This log is retained for 7 years. Access is not granted for any commercial, marketing, product development, or AI training purpose.