Privacy Policy
How Live Watch Stock collects, stores and protects data, across the web app and the iPhone, iPad, Mac and Android apps. Written for the UK GDPR and the Data Protection Act 2018, in plain English.
Who we are
Live Watch Stock ("we", "us", "our") is operated by Live Watch Stock Ltd, a company registered in England & Wales (Company No. 17205601), registered office 24a Queen Annes Place, Enfield, EN1 2PT. For any privacy question or to exercise your rights, contact our data team at support@livewatchstock.com.
This policy covers the Live Watch Stock service, the web app, the iPhone, iPad, Mac and Android apps, and the dedicated server we run for you. It is the single source of truth for how we handle personal data.
Your data lives on your own dedicated server
Live Watch Stock is built around one promise that shapes everything below: each customer runs on a private server provisioned solely for them (your-name.livewatchstock.com). There is no shared, multi-tenant database. Your account, your captured listings, your photos and your backups live on your own server and are never shown to any other customer; your photos and backups are kept with the storage providers named below. There is one deliberate exception, set out in full below: an anonymous price index. It holds a reference, a year, a price and a date, and it is what lets us tell you the going rate for a watch. It carries no names, no phone numbers, no group names and no message text.
This is not a marketing line; it is the architecture. It means your deal flow can't leak sideways to a competitor, and it means that when you leave, decommissioning one server erases everything. The iPhone, iPad, Mac and Android apps are a thin client that simply signs you in to that server and shows it to you.
Our role: we are your processor, you are the controller
The data Live Watch Stock handles falls into two categories, and our legal role differs for each:
- Your account data: we are the data controller. For the personal data that is about you, our customer (your name, email, login credentials, billing, device tokens, session/technical data), we decide why and how it is processed, so we act as the controller.
- The captured WhatsApp / seller data: you are the controller; we are the processor. The listings we capture from your WhatsApp groups contain third-party personal data (seller names, phone numbers, photos). You chose those groups and you decide what to do with that archive, so under the UK GDPR you are the data controller for it and we act only as your data processor: we process it on your dedicated server, on your instructions, solely to provide the search-and-alert service to you. We never use it for our own purposes, and your subscription agreement is our processing instruction.
As a controller of seller data, you are responsible for having a lawful basis to capture and search it (typically your own legitimate business interest as a dealer) and for handling any request you receive from a seller. We will support you in meeting those obligations.
What personal data we process, and why
- Email address: to resolve which dedicated server is yours at sign-in and to sign you in. At the first screen it is sent to our central directory only to return your server's address; no other account data is exposed there. We also use it for essential service emails (welcome, billing receipts, password reset, security and setup notices).
- Login credentials: your password is stored only as a salted hash on your server; a passkey / biometric credential's private key never leaves your device.
- Billing data: your subscription status and a customer reference. Card details are handled entirely by Stripe and never reach our servers.
- Push notification device token: if you enable notifications, your device's push token (Apple APNs / Google FCM) is registered with your server so it can alert you to matched listings. Revoke any time in your device settings.
- Usage / technical data: login timestamps, browser or app user-agent, and the IP address of your last active session, used only for security and to rate-limit abuse.
- Captured listing & seller data (you are the controller): for the WhatsApp groups you choose to monitor, the messages and listings from those groups: watch reference, year, price, condition, plus the seller's name and number and any photos or videos as they appear in those messages. This is stored on your server to build your private, searchable archive, along with your saved searches, saved sellers, drafts and settings.
- We do not collect: the contents of groups you haven't selected, your direct messages, your contacts, or your location.
Lawful basis for processing
- Contract (UK GDPR Art. 6(1)(b)), processing your account, billing and the running of your dedicated server is necessary to deliver the service you signed up for.
- Legitimate interests (Art. 6(1)(f)), keeping the service secure, preventing abuse, and sending essential service messages. Where we act as your processor for captured seller data, the lawful basis for that data is yours as controller (a dealer's legitimate business interest); we process it strictly on your instructions.
- Consent (Art. 6(1)(a)), only for push notifications, which you switch on and can withdraw at any time.
- Legal obligation (Art. 6(1)(c)), where we must retain limited billing records for tax/accounting law.
Data minimisation & what we never do
- We keep nothing beyond what the service needs. We don't collect data "just in case", and we don't enrich, profile, or score you or the sellers in your archive.
- No selling, ever. We do not sell, rent, or broker personal data (yours or the sellers') to anyone, for any price, under any circumstances.
- Your posts stay yours. Nobody else can see your groups, your captured posts, your searches, your sellers or your photos. Your account runs on its own server with its own database.
- One exception, and it is how trade prices work. To tell you what a reference is trading for, we keep an anonymous price index drawn from across our customers. It holds five things and nothing else: the reference, the year, the price, the date, and a code used only to spot the same advert twice. It holds no names, no phone numbers, no group names and no message text, and nothing in it can be traced back to you or to the person who posted. Every customer's trade prices are steadier because of it, including yours. If you would rather not take part, email us and we will leave your posts out of the index.
- No advertising, analytics, or tracking SDKs. We don't track you across other apps or websites, and share no data with advertisers or data brokers.
- No AI training. We do not use your data, or the captured seller data, to train AI models.
Your right to erasure
You can delete your account and everything in it at any time. There are two ways, and either one triggers full erasure:
- In the app: Account & Billing → Delete account; or
- By email: message support@livewatchstock.com from your account's email address.
When you request deletion, we erase your entire dedicated server and all of its contents: your account record and credentials, every captured listing and message (references, prices, years, conditions, and the seller names and numbers within them), every photo and video in media storage, and your saved searches, sellers, drafts and settings.
The timeline, in plain terms. Deletion is deliberately not instant: you keep the access you have already paid for, and a mistaken tap stays recoverable.
- When you ask: your subscription is set to cancel at the end of the billing period you have already paid for. Nothing is deleted yet and you keep full access until then.
- When that period ends: a 7-day safety window begins, so an accidental or regretted deletion can still be undone. Say the word in the app or by email and everything stays exactly as it was.
- After the safety window: your dedicated server, its database and disk, your subdomain and every photo in media storage are permanently deleted, and your storage keys are revoked. From that point your data is no longer accessible to anyone, including us.
- Disaster-recovery backups are the one thing we cannot delete on demand (they are written under a 14-day lock we cannot override) and they expire automatically within 30 days. They are never restored or read for any other purpose. After that, nothing about you remains anywhere: on our servers, in our media storage, or in backups.
Want it gone sooner? You do not have to wait for your billing period to end. Email support@livewatchstock.com from your account's email address and ask us to erase straight away, we will start the teardown and complete your erasure within 30 days of your request, as UK GDPR requires. See how to delete your account & data for the step-by-step.
When the captured data is concerned, you act as controller, but we make erasure effortless: deleting your account removes the entire archive, and if a seller asks you to erase their details you can delete individual listings in-app at any time.
Your other rights under UK GDPR
- Access (Art. 15), ask for a copy of the personal data we hold about you.
- Rectification (Art. 16), correct inaccurate account details from Settings or by emailing us.
- Portability (Art. 20), export your data; your captured archive is exportable from within the app.
- Object / restrict (Arts. 18, 21), object to or pause processing; you can suspend your account at any time.
- Withdraw consent: turn off push notifications whenever you like.
To exercise any right, use the in-app controls or email support@livewatchstock.com. We respond to data-subject requests within 30 days, and there is no charge.
Where your data is hosted & international transfers
- Your dedicated server & database: Hetzner Cloud, within the UK/EU (Falkenstein, Germany), which is covered by UK adequacy.
- Photos and videos: Cloudflare R2 (Western Europe), served to your browser or app via short-lived signed URLs.
- Disaster-recovery backups: Backblaze B2, held under a write-once object lock, used only to restore your own service and auto-expiring as described above.
- Payments: Stripe. Where any provider processes data outside the UK/EEA, it is done under an adequacy decision or Standard Contractual Clauses / the UK International Data Transfer Addendum.
Who else processes data on our behalf (sub-processors)
We use a short list of infrastructure providers, each bound by a data-processing agreement and used strictly to run the service: Hetzner (hosting), Cloudflare (media storage / delivery), Backblaze (off-site backups), Stripe (payments), and a transactional email provider (sign-up, billing and password-reset emails). We do not share data with anyone for marketing, profiling, or AI training, and we never expose your data to other customers.
Security
Traffic is encrypted in transit over HTTPS/TLS. Media storage is encrypted at rest, and backups are held in Backblaze B2 under a write-once object lock, so they cannot be altered or deleted before they expire. The dedicated-server model is itself a security control: your data is isolated from every other customer by design, so a single tenancy is the entire blast radius. Access is restricted, credentials are stored only as salted hashes, and admin access is tightly controlled. No system is perfectly secure; if you discover a vulnerability, please tell us at support@livewatchstock.com.
Cookies
We use only strictly-necessary cookies to keep you signed in and to secure your session. We set no advertising, analytics, or third-party tracking cookies, so no cookie-consent banner is required.
Live Watch Stock is not affiliated with, endorsed, or sponsored by WhatsApp LLC or Meta Platforms, Inc. Using the service requires you to link your WhatsApp account as a companion device. We only read messages in the groups you explicitly select, never your direct messages or unselected groups.
How to complain
If you have a concern about how we handle your data, please contact us first at support@livewatchstock.com and we'll do our best to put it right. You also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113.
Changes to this policy
We'll post any changes on this page and update the "last updated" date above. Material changes will be notified by email.
Contact
Live Watch Stock Ltd (Company No. 17205601) · support@livewatchstock.com: we respond within 30 days to data-subject requests under UK GDPR.
Live Watch Stock Ltd, company number 17205601, registered in England and Wales, trading as "Live Watch Stock".