Privacy
Last updated 13 September 2026. Short, because there is not much to tell: no tracking pixels, no advertising network, no analytics script, no profile of you sold to anybody.
Who holds your data
Business details are not configured. Set LEGAL_ENTITY, LEGAL_REG_NO, LEGAL_ADDRESS and SUPPORT_EMAIL before sending this site to Paddle for review.
That is the data controller. Write to that address for anything in this page.
What we keep
- Your email address. It is the login. Needed to run the account.
- A display name and, if you fill it in, a WhatsApp number. Optional, and shown to people you are dealing with, so only put in what you are happy to share.
- Your listings and photos. Public by design. Photos are stripped of EXIF on upload, so the GPS position of your kitchen does not come with them.
- Messages you send through the site. Kept so both sides have a copy if the email goes astray.
- Login codes, hashed, for fifteen minutes.
- Web server logs, which include IP addresses, kept briefly and used for keeping the thing running and stopping abuse.
No cookies except one signed session cookie that says you are logged in. Nothing for advertising, nothing for analytics.
What other people see
Your listing, its location, its photos, and whatever name you chose. When you message somebody, your email address goes to them as the reply-to, so they can answer you directly. You are told that before you press send.
Who else touches it
- Resend sends the email: login codes, and the messages between buyers and sellers. They see the addresses and the contents of those emails.
- Paddle handles payment for surf shop slots, as merchant of record. If you buy a slot they hold your billing details and your card. We do not. All we store is your email address, which slot you have, and the subscription id.
- Our hosting provider, on whose server the database and the photos sit.
Nobody else. We do not sell or rent any of it.
How long
Listings are deleted a while after they expire. Messages stay as long as your account does. Ask us to delete the account and the lot goes, apart from what we have to keep for accounting if you paid for a slot, which is the invoice records Paddle and the tax authorities require.
Your rights
If the GDPR covers you, you can ask for a copy of what we hold, ask for corrections, ask for deletion, object to how we use it, and take it elsewhere. Write to shops@jetsam.surf and you get an answer within a month.
We rely on performing our contract with you for the account and the listings, and on legitimate interest for keeping the site up and unabused. You can complain to your national data protection authority if you think we have this wrong.