Privacy Policy

FindPopups is a discovery platform operated by FindPopups Ltd, United Kingdom. We help customers discover street food vendors, food trucks, artisan traders, farmers markets, pop-up events, and local markets. We also provide tools for vendors and event hosts to manage their business presence. Data Controller: FindPopups Ltd, United Kingdom Privacy enquiries: privacy@findpopups.com

When you use FindPopups, we collect: Account data: name, email address, and authentication details when you register. Profile data: business name, description, logos, cover images, location names, and trading schedules (vendors and hosts). Location data: precise latitude/longitude of trading locations and vendor schedules. This is used to power the map and nearby discovery features. Payment data: your payment is processed by Stripe Inc. We receive confirmation of payment and subscription status but do not store your full card details. We store your Stripe customer ID and subscription status to manage your plan. Usage data: pages visited, features used, time spent, browser type, and approximate IP address (via Google Analytics, only with your consent). Reviews: if you leave a review, we store the review text, rating, and your display name. Communications: messages sent between vendors and hosts via the inbox feature. Saved items and follows: vendors and events you have saved or followed. Device data: approximate location from your device if you use the "Near Me" feature (browser geolocation only — not stored permanently).

We use your data to: • Operate and provide the FindPopups platform • Process your subscription and manage billing via Stripe • Display vendor profiles, schedules, and events publicly (approved vendors only) • Power the map, search, and nearby discovery features • Send you transactional emails (account approval, application updates, reminders) based on your notification preferences • Analyse how the platform is used to improve the service (analytics cookies, only with your consent) • Investigate abuse reports and enforce our Terms of Service • Comply with legal obligations We never sell your personal data to third parties. We do not use your data for automated decision-making or profiling that produces legal effects.

We process your personal data under the following lawful bases: Contract (Article 6(1)(b)): providing the service you signed up for, including displaying your vendor profile, processing your subscription, and sending essential notifications. Legitimate interests (Article 6(1)(f)): preventing fraud and abuse, improving the platform, security monitoring, and sending non-marketing service communications. Consent (Article 6(1)(a)): analytics and marketing cookies (you can withdraw at any time via our Cookie Preferences); marketing emails (you can unsubscribe at any time). Legal obligation (Article 6(1)(c)): retaining financial records and responding to lawful requests from authorities.

We share data with the following trusted third parties only as necessary: Firebase (Google LLC): database, authentication, and file storage. Your account data and uploads are stored in Firebase. Firebase is certified under the EU-U.S. Data Privacy Framework. See: https://firebase.google.com/support/privacy Google Analytics 4 (Google LLC): website analytics, loaded only with your consent. Data is processed in the US under Google's Standard Contractual Clauses. Stripe Inc: payment processing. We pass your email address and billing details to Stripe. Stripe is PCI-DSS compliant. See: https://stripe.com/gb/privacy Google Maps Platform (Google LLC): map display and location autocomplete. Your search queries may be sent to Google. See: https://policies.google.com/privacy Resend (Resend Inc): transactional email delivery. We pass your email address and first name to send you notifications. Vercel Inc: hosting and CDN infrastructure for the Next.js application.

Some of our third-party processors (Google, Stripe, Resend, Vercel) are based in the United States. Where we transfer data outside the UK, we rely on Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner or equivalent adequacy mechanisms to ensure your data receives the same level of protection as required under UK GDPR.

We use cookies and similar technologies. Essential cookies are always active. Analytics and marketing cookies are only set with your explicit consent. See our Cookie Policy for full details: /cookies You can update your cookie preferences at any time by clicking "Cookie Preferences" at the bottom of the page.

If you use the "Use My Location" or "Near Me" feature, we request your device's geolocation via the browser's Geolocation API. This location is used only for that specific search request and is not stored on our servers or in your profile. You can revoke location access at any time in your browser settings. Vendors set precise trading locations (lat/lng) when creating their schedules. These trading locations are publicly visible on the map and in vendor profiles, as this is the core purpose of the platform.

We retain your personal data for as long as your account is active or as required to provide the service. If you delete your account, we will within 30 days: • Delete your profile and personal data • Anonymise your reviews (text preserved for platform integrity, your name removed) • Remove your saved items, follows, and notifications • Suspend any vendor or host profiles you own We retain financial records (subscription history) for up to 7 years to meet UK legal obligations. Inactive accounts (no login for 3 years) may be subject to automatic deletion following notification.

You have the following rights regarding your personal data: Right to access: request a copy of your data (use the "Export my data" feature in Settings). Right to rectification: correct inaccurate data via your account settings or by contacting us. Right to erasure: delete your account and personal data via Settings > Privacy & Data > Delete account. Right to restriction: request we restrict processing of your data while we resolve a dispute. Right to portability: download your data in machine-readable JSON format via Settings. Right to object: object to processing based on legitimate interests. Right to withdraw consent: update or withdraw cookie consent at any time. To exercise any right, contact privacy@findpopups.com. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): https://ico.org.uk/concerns

We implement appropriate technical and organisational security measures including: • Firebase Authentication for secure login • Firestore Security Rules to restrict data access to authorised users • HTTPS encryption in transit (enforced via Vercel) • Stripe's PCI-DSS compliant infrastructure for payment data • Role-based access control (customer, vendor, host, admin) No method of internet transmission is 100% secure. If you discover a security issue, please report it responsibly to security@findpopups.com.

FindPopups is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@findpopups.com and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email (if you have an account) or by displaying a prominent notice on the platform. The "Last updated" date at the top of this page indicates when it was last revised. Continued use of the platform after changes constitutes acceptance of the updated policy.

For any questions, requests, or concerns about this policy: Email: privacy@findpopups.com Post: FindPopups Ltd, United Kingdom For data subject rights requests, please use the email above with "Data Rights Request" in the subject line.