What we collect and why.

Who is responsible for your information

Marketfolk is operated by Marketfolk Ltd, a company registered in England and Wales (company number 17405811), registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, registered with the Information Commissioner’s Office. Contact hello@marketfolk.co.uk with any privacy question or request.

What we collect

An email address and chosen role (maker or organiser) to create an account. For makers: business name, contact name, categories, a short bio, website or shop links, and a postcode used privately to calculate distance to markets; your exact postcode and coordinates are never shown publicly. For organisers: organisation name and contact email. If you apply to a market or claim an existing one, the information that application or claim requires. If you register interest in a researched market that hasn’t been claimed by an organiser yet, your business name, email, postcode and categories, and whether you’ve consented to being contacted about it. If you use the contact form, your name, email address and message, which we use only to reply to you. If you upload an insurance certificate, it’s stored as a document with restricted access; we don’t verify or endorse it.

Why we use it, and our lawful basis

To create and run your account, match makers with relevant markets, let organisers review applications, and send service messages such as sign-in links, status changes and receipts, and occasionally a personal note from the Marketfolk team, including when you join through another member’s referral: lawful basis is performance of a contract with you. Where we ask for consent, such as sharing an insurance certificate with a specific organiser, that consent is specific to that purpose and can be withdrawn. We don’t use your information for third-party advertising.

Who we share it with

Cloudflare hosts the application, database and file storage. Once connected, Resend (or an equivalent provider) sends transactional email such as sign-in links and notifications, and Stripe processes payments as a separate data controller for card and payout details, which Marketfolk never stores directly. An organiser reviewing your application can see the maker profile information relevant to that decision; makers don’t see other makers’ private details. We don’t sell personal information. Cloudflare, Resend and Stripe may process data outside the UK as part of providing their service to us; where that happens, we rely on the safeguards each of them has in place for international transfers (such as an adequacy decision or standard contractual clauses). We haven’t yet completed a full review of exactly which safeguard applies to each processor, and will update this section once that review is done.

Cookies

The site sets exactly one cookie: a session identifier, strictly necessary to keep you signed in. It isn’t used for advertising, analytics or tracking, and no other cookies are currently set. Our measurement doesn’t use cookies, local storage or any other identifier stored on your device, so there’s no consent banner to click through.

How we measure whether the site works

We count how the site is used so we can improve it. This is anonymous and aggregate: we keep daily totals such as “42 people searched by postcode on the markets directory yesterday”, never a record of what any one person did. Each count records the date, which action happened (for example opening a town, searching a postcode, using browser location, opening a market, registering interest or creating an account), which type of page it happened on, and whether the person was signed out or signed in as a maker or organiser. Where it’s useful we also store the town, region or market involved, or the postcode district only, such as BS3.

We deliberately don’t store full postcodes, the coordinates your browser reports when you use “Use my location”, IP addresses, device fingerprints, advertising identifiers or any per-person history. If you enter a full postcode to search, only the district is kept for measurement; the rest is used to run that one search and then discarded. There’s no session replay, no cross-site tracking and no third-party advertising or analytics network. We also honour Global Privacy Control and Do Not Track signals, and skip measurement entirely when your browser sends one.

We use Cloudflare Web Analytics for the same purpose, which gives us aggregate visit, referrer and country totals without cookies or individual tracking. Because none of this stores or reads anything on your device, and none of it identifies you, we rely on it being outside both the storage and access rules in PECR and the personal data rules in UK data protection law. Only Marketfolk administrators can see these totals.

How long we keep it

While your account remains active, and for a limited period afterwards where needed for accounting, fraud prevention or legal reasons. See our data retention schedule for the exact period for each data type.

Your rights

Under UK data protection law you can ask to access, correct, delete or export your information, object to or restrict certain processing, and complain to the Information Commissioner’s Office if you believe we’ve handled your information incorrectly. Contact hello@marketfolk.co.uk to exercise any of these.

Security

Sign-in uses single-use, short-lived, hashed tokens; we never store a plain-text password or sign-in link. Documents are held in a private file store with time-limited, logged access. No system is perfect; if we become aware of a data breach affecting you, we’ll tell you and the ICO where required by law.