Privacy Policy

1. Who is responsible

We are the controller of the personal information described here.

2. What we collect

Information you give us

• Account details — your name, email address, and optionally your phone number. Your password is stored only as a salted cryptographic hash; we never store or see the password itself.
• Order details — the items you buy, the amount paid, and the billing and shipping address you enter at checkout.
• Items you offer to sell us — the description and photographs you submit, along with your contact details.
• Problem reports — anything you type into the "Report a problem" form, plus any screenshot you attach.
• Correspondence — messages you send us.

Information collected automatically

• Usage events — pages viewed, items viewed, and search terms entered, recorded so we understand what people are looking for.
• Technical details — your browser user-agent string, screen size, and the page you were on. These are attached to problem reports so we can reproduce faults.
• Session cookies — described in section 6.

What we do not collect

We do not receive or store your full card number, expiry, or security code. Card details are entered on Stripe's own checkout page and handled entirely by Stripe. We do not knowingly collect information from anyone under 18, and we do not sell personal information.

3. Why we use it

• To create and operate your account, and to keep you signed in.
• To take payment, fulfil and ship your order, and handle returns.
• To record what you own so your collection page works.
• To review items you offer to sell us and respond with an offer.
• To investigate and fix faults you report.
• To detect and prevent fraud, chargeback abuse, and misuse of the site.
• To understand which items and searches are popular so we can stock better.
• To meet our legal, tax, and accounting obligations.

We rely on the performance of our contract with you for order handling, on your consent where you volunteer optional details, and on our legitimate interests in running a secure and functional store for the remainder.

4. Who we share it with

We do not sell your personal information and we do not share it for cross-context behavioural advertising. We share it only with the following, and only so far as they need it:

• Stripe — payment processing. Stripe receives your name, email, billing and shipping address, and card details, and handles them under its own privacy policy.
• Cloudflare — hosting, database, and image storage. Our site and its data run on Cloudflare infrastructure.
• Shipping carriers — the name and delivery address needed to deliver your order.
• Professional advisers and authorities — where we are legally required to disclose, or need to establish or defend a legal claim.
• A successor — if the business is sold or reorganised, subject to this policy.

5. How long we keep it

Account information is kept while your account is open. Order and transaction records are kept for as long as tax and accounting rules require, typically seven years, even after an account closes. Problem reports and usage events are kept while they remain useful and then deleted. Sessions expire automatically after 30 days, and sooner if you sign out or we end them.

6. Cookies

We use a small number of strictly necessary cookies. We do not use advertising or third-party tracking cookies.

• bloodline_customer — keeps you signed in to your account. Expires after 30 days.
• bloodline_admin — signs in store staff. Not set for customers.

Both are HTTP-only and are sent only over HTTPS. Blocking them will stop you signing in. Your browser settings let you clear or block cookies at any time.

7. Security

We take reasonable steps to protect your information: passwords are salted and hashed rather than stored, session tokens are stored hashed, cookies are HTTP-only and secure, and payment card data never reaches our systems.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your information, we will notify you and any regulator as required by law.

8. Your choices and rights

You can view and update your details, and see your orders and collection, from your account page at any time.

Depending on where you live — including under the California Consumer Privacy Act and comparable state laws, and the UK/EU GDPR — you may have the right to request access to your information, correction of it, deletion of it, a portable copy, or restriction of its processing, and to withdraw consent where we rely on it. We will not discriminate against you for exercising any of these rights.

To make a request, email support@bloodlinetrading.com from the address on your account. We will respond within the period the applicable law requires. We may need to verify your identity first, and we may keep records we are legally required to retain.

We do not sell or share personal information, so there is nothing to opt out of in that respect.

9. Children

The site is not directed at children and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

10. Where your information is held

We currently ship only within the United States, and our service providers process data primarily in the United States. If you access the site from elsewhere, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.

11. Changes

We will update this policy as the site changes. The effective date above shows the last revision, and material changes will be signposted on this page.

12. Contact

Questions or requests about your privacy: