Privacy Policy
How Live Watch Stock collects, stores and protects data — across the web app and the iOS and Android apps. Written for the UK GDPR and the Data Protection Act 2018, in plain English.
Who we are
Live Watch Stock ("we", "us", "our") is operated by Live Watch Stock Ltd, a company registered in England & Wales (Company No. 17205601), registered office 24a Queen Annes Place, Enfield, EN1 2PT. For any privacy question or to exercise your rights, contact our data team at support@livewatchstock.com.
This policy covers the Live Watch Stock service — the web app, the iOS and Android apps, and the dedicated server we run for you. It is the single source of truth for how we handle personal data.
Your data lives on your own dedicated server
Live Watch Stock is built around one promise that shapes everything below: each customer runs on a private server provisioned solely for them (your-name.livewatchstock.com). There is no shared, multi-tenant database. Your account, your captured listings, your photos and your backups are never pooled with, combined with, shared with, or shown to any other customer — they physically live on your box and nowhere else.
This is not a marketing line; it is the architecture. It means your deal flow can't leak sideways to a competitor, and it means that when you leave, decommissioning one server erases everything. The iOS and Android apps are a thin client that simply signs you in to that server and shows it to you.
Our role: we are your processor, you are the controller
The data Live Watch Stock handles falls into two categories, and our legal role differs for each:
- Your account data — we are the data controller. For the personal data that is about you, our customer (your name, email, login credentials, billing, device tokens, session/technical data), we decide why and how it is processed, so we act as the controller.
- The captured WhatsApp / seller data — you are the controller; we are the processor. The listings we capture from your WhatsApp groups contain third-party personal data (seller names, phone numbers, photos). You chose those groups and you decide what to do with that archive, so under the UK GDPR you are the data controller for it and we act only as your data processor — we process it on your dedicated server, on your instructions, solely to provide the search-and-alert service to you. We never use it for our own purposes, and your subscription agreement is our processing instruction.
As a controller of seller data, you are responsible for having a lawful basis to capture and search it (typically your own legitimate business interest as a dealer) and for handling any request you receive from a seller. We will support you in meeting those obligations.
What personal data we process, and why
- Email address — to resolve which dedicated server is yours at sign-in and to sign you in. At the first screen it is sent to our central directory only to return your server's address; no other account data is exposed there. We also use it for essential service emails (welcome, billing receipts, password reset, security and setup notices).
- Login credentials — your password is stored only as a salted hash on your server; a passkey / biometric credential's private key never leaves your device.
- Billing data — your subscription status and a customer reference. Card details are handled entirely by Stripe and never reach our servers.
- Push notification device token — if you enable notifications, your device's push token (Apple APNs / Google FCM) is registered with your server so it can alert you to matched listings. Revoke any time in your device settings.
- Usage / technical data — login timestamps, browser or app user-agent, and the IP address of your last active session, used only for security and to rate-limit abuse.
- Captured listing & seller data (you are the controller) — for the WhatsApp groups you choose to monitor, the messages and listings from those groups: watch reference, year, price, condition, plus the seller's name and number and any photos or videos as they appear in those messages. This is stored on your server to build your private, searchable archive, along with your saved searches, saved sellers, drafts and settings.
- We do not collect: the contents of groups you haven't selected, your direct messages, your contacts, or your location.
Lawful basis for processing
- Contract (UK GDPR Art. 6(1)(b)) — processing your account, billing and the running of your dedicated server is necessary to deliver the service you signed up for.
- Legitimate interests (Art. 6(1)(f)) — keeping the service secure, preventing abuse, and sending essential service messages. Where we act as your processor for captured seller data, the lawful basis for that data is yours as controller (a dealer's legitimate business interest); we process it strictly on your instructions.
- Consent (Art. 6(1)(a)) — only for push notifications, which you switch on and can withdraw at any time.
- Legal obligation (Art. 6(1)(c)) — where we must retain limited billing records for tax/accounting law.
Data minimisation & what we never do
- We keep nothing beyond what the service needs. We don't collect data "just in case", and we don't enrich, profile, or score you or the sellers in your archive.
- No selling, ever. We do not sell, rent, or broker personal data — yours or the sellers' — to anyone, for any price, under any circumstances.
- No pooling. We never combine, aggregate, or cross-reference one customer's data with another's. There is no central lake of deal flow.
- No advertising, analytics, or tracking SDKs. We don't track you across other apps or websites, and share no data with advertisers or data brokers.
- No AI training. We do not use your data, or the captured seller data, to train AI models.
Your right to erasure — guaranteed within 30 days
You can delete your account and everything in it at any time. There are two ways, and either one triggers full erasure:
- In the app — Account & Billing → Delete account; or
- By email — message support@livewatchstock.com from your account's email address.
When you request deletion, we erase your entire dedicated server and all of its contents — your account record and credentials, every captured listing and message (references, prices, years, conditions, and the seller names and numbers within them), every photo and video in media storage, and your saved searches, sellers, drafts and settings.
The timeline, in plain terms: the live wipe is immediate — on request, your running server and its database are decommissioned and your data is no longer accessible to anyone, including us. The only thing that persists briefly is the rolling encrypted disaster-recovery backups, which are never restored or read for any other purpose and which expire automatically within 30 days. After that window, nothing about you remains anywhere — on our servers, in our media storage, or in backups. This is our guaranteed right-to-erasure SLA: complete erasure within 30 days, with the live data gone immediately. See how to delete your account & data for the step-by-step.
When the captured data is concerned, you act as controller, but we make erasure effortless: deleting your account removes the entire archive, and if a seller asks you to erase their details you can delete individual listings in-app at any time.
Your other rights under UK GDPR
- Access (Art. 15) — ask for a copy of the personal data we hold about you.
- Rectification (Art. 16) — correct inaccurate account details from Settings or by emailing us.
- Portability (Art. 20) — export your data; your captured archive is exportable from within the app.
- Object / restrict (Arts. 18, 21) — object to or pause processing; you can suspend your account at any time.
- Withdraw consent — turn off push notifications whenever you like.
To exercise any right, use the in-app controls or email support@livewatchstock.com. We respond to data-subject requests within 30 days, and there is no charge.
Where your data is hosted & international transfers
- Your dedicated server & database — Hetzner Cloud, within the UK/EU (Falkenstein, Germany), which is covered by UK adequacy.
- Photos and videos — Cloudflare R2 (Western Europe), served to your browser or app via short-lived signed URLs.
- Encrypted disaster-recovery backups — Backblaze B2, encrypted at rest, used only to restore your own service and auto-expiring as described above.
- Payments — Stripe. Where any provider processes data outside the UK/EEA, it is done under an adequacy decision or Standard Contractual Clauses / the UK International Data Transfer Addendum.
Who else processes data on our behalf (sub-processors)
We use a short list of infrastructure providers, each bound by a data-processing agreement and used strictly to run the service: Hetzner (hosting), Cloudflare (media storage / delivery), Backblaze (encrypted backups), Stripe (payments), and a transactional email provider (sign-up, billing and password-reset emails). We do not share data with anyone for marketing, profiling, or AI training, and we never expose your data to other customers.
Security
Traffic is encrypted in transit over HTTPS/TLS. Data at rest is encrypted, and backups are encrypted independently. The dedicated-server model is itself a security control: your data is isolated from every other customer by design, so a single tenancy is the entire blast radius. Access is restricted, credentials are stored only as salted hashes, and admin access is tightly controlled. No system is perfectly secure; if you discover a vulnerability, please tell us at support@livewatchstock.com.
Cookies
We use only strictly-necessary cookies to keep you signed in and to secure your session. We set no advertising, analytics, or third-party tracking cookies, so no cookie-consent banner is required.
Live Watch Stock is not affiliated with, endorsed, or sponsored by WhatsApp LLC or Meta Platforms, Inc. Using the service requires you to link your WhatsApp account as a companion device. We only read messages in the groups you explicitly select — never your direct messages or unselected groups.
How to complain
If you have a concern about how we handle your data, please contact us first at support@livewatchstock.com and we'll do our best to put it right. You also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint, helpline 0303 123 1113.
Changes to this policy
We'll post any changes on this page and update the "last updated" date above. Material changes will be notified by email.
Contact
Live Watch Stock Ltd (Company No. 17205601) · support@livewatchstock.com — we respond within 30 days to data-subject requests under UK GDPR.
Live Watch Stock Ltd · Company No. 17205601 · Registered in England & Wales · trading as "Live Watch Stock".