Privacy Policy

Effective 11 October 2026

Plain version: we hold what an order needs and nothing else, we never see your card number, we do not sell anything about you, and you can have it all deleted.

This page says what WEARIT keeps about you, why, who else handles it, and how to get it deleted. It covers the WEARIT, WEARIT Courier and WEARIT Business apps, the shop dashboard and this website.

Who is responsible for your data (the “data controller”): Iam The Protagonist Ltd, trading as WEARIT and The It Group, a private limited company registered in England and Wales, company number 16842280, registered office 60 Hay Lane, London, NW9 0NB. Registered with the Information Commissioner’s Office, registration number ZC272634. Email: theitgroupapps@gmail.com.

1. What we collect, and why

Everyone

• Your email address, or the identifier Apple gives us when you sign in with Apple. It is how you sign in — there is no password for you to lose. Why: to create your account and sign you in. Basis: contract.
• Your name, if you give one. Why: so the shop and the rider know who the order is for. Basis: contract.
• A sign-in check from Cloudflare that tells people from bots. Cloudflare sees your device and network details for that moment; we see only a pass or fail. Basis: legitimate interests (stopping abuse of sign-in).
• Support emails you send us. Why: to answer them. Basis: legitimate interests.

If you order clothes

• Your delivery addresses, and a note about where to leave things if you are out. Basis: contract.
• Where you are, while the app is open, to show shops near you and your rider on the way. Not in the background, and never when the app is closed. You can refuse and type a postcode instead. Basis: consent.
• Your orders — what you ordered, what you kept, what went back, what you paid, any credit on your account, and the ratings you leave. Basis: contract.
• Your sizes, if you save them, so the app can show what fits. Basis: consent.
• Whether you asked for longer at the door. If you tell us you need more time, we hold that so every rider gives it to you without you asking again. You never have to say why, and we treat it as sensitive. Basis: your explicit consent, and the Equality Act 2010 duty to make reasonable adjustments.
• Payment: a Stripe customer id and the last four digits of your card — never the full card number, which goes to Stripe directly. Basis: contract.

If you ride

• Your identity documents — photo ID, proof you can work in the UK, a photo of your vehicle, and for a scooter or car your licence and insurance. A person checks them. They are kept privately and are never public. Basis: contract, and our legal duty to check the right to work.
• An identity check run by Stripe — a document and a matching selfie, captured live. Stripe does the matching and tells us only whether it passed. Basis: contract and legitimate interests (knowing who we send to people’s doors).
• Where you are while you are on shift, so we can offer you the nearest job and show a customer their rider approaching. Not when you are off shift, and not in the background. Basis: contract.
• Your jobs, your pay, your ratings, and the doorstep photos you take. Basis: contract.
• Payout details: bank account via Stripe Connect; we see the account name and last digits only. Basis: contract, and our legal duty to keep financial records.

If you run a shop

• The shop’s details, its address and opening hours, and who works there. Basis: contract.
• Your products, prices and stock, including anything you import from a spreadsheet, your website, Shopify or Square. Basis: contract.
• Your orders, what you are owed, and your plan. Basis: contract.
• Payout details via Stripe Connect, as for riders. Basis: contract and legal duty.

From your device

• Device model, OS version and app version, in the ordinary logs our hosting keeps when the app talks to it. Why: to fix bugs. Basis: legitimate interests (running a working app). There is no analytics or crash-reporting company in WEARIT today.

We do not sell your data, and we don’t use it for advertising. There is no advertising in WEARIT.

2. Who else handles it

We use other companies to run the app. They only get what they need for their job, under a contract that stops them using it for anything else.

• Supabase — hosts the database, the files and sign-in. London, United Kingdom.
• Stripe — takes payments, pays riders and shops out, runs rider identity checks and bills shop plans. US and EU; Stripe is the controller for card data under its own policy.
• Apple — Sign in with Apple and app distribution. Google — app distribution. US.
• Cloudflare — the sign-in bot check. US and EU.
• Resend — sends our emails, including your sign-in code. Ireland, EU.
• Vercel — hosts this website and the shop dashboard. US and EU.
• Shopify and Square — only if a shop connects one to import its catalogue. US.

Where a provider is outside the UK, the transfer is covered by the UK International Data Transfer Addendum or the UK’s adequacy regulations for that country.

The people on your order see what they need to do it. The shop sees the items and your first name. The rider sees your name, your address, your note about where to leave things, and whether you have longer at the door — never why. You see the rider’s first name, their rating and where they are on the way. A doorstep photo is seen only by the customer, the rider and the shop on that order, and by us if there is a dispute.

We’ll share data if the law requires it — a court order, a lawful request from the police or a regulator — and to protect someone’s safety.

3. How long we keep it

• Your account and what’s in it — while your account exists, then deleted within 30 days of you deleting it.
• Orders and payments — six years after the transaction, because tax law requires it. After you delete your account these keep the amounts, the dates and the shop, and nothing that says who you were.
• Rider documents — while you ride with us, and one year after, so we can answer a right-to-work enquiry.
• Where you were — the live position is kept only while it is live; a job’s positions are deleted after 30 days.
• Doorstep photos, ratings and dispute notes — up to 12 months after the order, so we can deal with disputes.
• Hosting logs — 90 days.
• Backups — up to 30 days, after which deleted data is gone from them too.

4. Your rights

Under UK data-protection law you can ask us to:

• show you what we hold about you (a copy, usually within a month);
• correct it;
• delete it — which you can also do yourself in the app, from You in WEARIT, Shift in WEARIT Courier or Settings in WEARIT Business. What happens when you do is on its own page;
• give you a copy in a form you can take elsewhere;
• stop using it for a particular purpose, or object to our legitimate-interests uses;
• withdraw consent for anything that was based on it, like location — turn it off in your phone’s settings and type a postcode instead.

Email theitgroupapps@gmail.com and we’ll reply within one month. If you’re not happy with how we handle it you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you told us first.

5. Children

WEARIT is not for anyone under 18. We don’t knowingly collect data from them. If you think a child has given us data, email us and we’ll delete it.

6. Security

Data is encrypted in transit and at rest with our hosting providers. Every table has access rules so a customer, a rider and a shop each see only their own part of an order, and rider documents open only through short-lived links for the person checking them. No system is perfect; if we ever have a breach that puts you at risk we’ll tell you and the ICO as the law requires.

7. Cookies and tracking

The apps set no cookies. This website and the shop dashboard use only the cookie that keeps you signed in; there are no analytics cookies. We don’t use Apple’s App Tracking Transparency because we don’t track you across other companies’ apps.

8. Changes

If how we handle data changes, this page is updated first and the effective date above changes. For anything significant we’ll tell you in the app or by email before it takes effect.

9. Contact

Iam The Protagonist Ltd, trading as WEARIT and The It Group
Registered in England and Wales, company number 16842280
60 Hay Lane, London, NW9 0NB, United Kingdom
theitgroupapps@gmail.com