Privacy Policy

Sliqd Limited ("Sliqd", "we", "us", "our") operates a peer-to-peer marketplace accessible at sliqd.com and via our mobile application (together, the "Platform"). The Platform enables registered users to buy and sell second-hand goods including clothing, accessories, and adult products from verified Creators.

This Privacy Policy explains how we collect, use, store, share, protect, and retain your personal data when you use the Platform. It applies to all users including Buyers, Sellers, Creators, and visitors regardless of how you access the Platform.

This Policy should be read alongside our Terms and Conditions and Cookie Policy, both of which are incorporated by reference.

Trading name

Sliqd

Registered company name

Sliqd Limited

Company registration number

17219406

Registered in

England and Wales

Registered office

71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

ICO Registration Number

ZC148045

Contact email

hello@sliqd.com

Regulator

Information Commissioner's Office (ICO), United Kingdom - ico.org.uk - 0303 123 1113

Sliqd does not currently have a designated Data Protection Officer. All data protection queries, subject access requests, and privacy concerns should be directed to legal@sliqd.com. We will appoint a DPO if and when our processing activities require one under applicable law.

This Privacy Policy applies when you:

• Create an account or complete identity and age verification on the Platform
• Browse, list, purchase, or sell physical items
• List or purchase second-hand items as a Creator or Buyer
• Communicate with other users via our in-Platform messaging system
• Process payments, receive payouts, or request withdrawals
• Contact us for support, to exercise your data rights, or to make a complaint

Account registration. When you create an account we collect: full legal name, email address, username, password (stored in encrypted hashed form only, never in plain text), date of birth (to verify you are 18 or older), gender (optional, used solely for personalised browsing experience), country of residence, and phone number (optional).

Age and identity verification. The Platform contains adult content and adult products. We are legally required under the UK Online Safety Act 2023 and applicable Ofcom guidance to verify that all users are aged 18 or over before accessing any adult content or completing any adult product purchase.

We use a third-party age and identity verification provider (currently Yoti or equivalent technically robust provider) to carry out these checks. During verification we process government-issued identification documents including passport or driving licence; biometric facial data including a live selfie and liveness check for identity matching against the identification document; and verification outcome (pass or fail result stored on our Platform).

We do not store raw passport scans or raw biometric data on our own servers. This data is processed and retained by our verification provider in accordance with their own privacy policy and data retention schedules, which we have reviewed and confirmed meet UK GDPR standards. We receive and retain only the verified status result linked to your account for the duration of your account and for 7 years following account closure. This data is processed under Article 9(2)(g) UK GDPR - substantial public interest, specifically age verification as required by UK law.

Sexual preference and adult content data. By the nature of the Platform, your use of adult content features, your content preferences, and your purchase history of adult products may reveal information about your sexual preferences and behaviours. This constitutes special category personal data under Article 9 UK GDPR.

We process this data under Article 9(2)(a) UK GDPR - your explicit consent, given when you create an account and accept these Terms and this Privacy Policy. You may withdraw consent at any time by closing your account, though this will not affect the lawfulness of processing prior to withdrawal.

We treat this category of data with the highest level of protection and apply enhanced technical and organisational security measures to it. We never sell, license, or share this category of data with third parties for advertising, marketing, or profiling purposes.

Creator-specific data. If you register as a Creator on the Platform, we additionally collect and process: full legal name and date of birth as confirmed through identity verification; government-issued identification documents as processed by our verification provider; consent records for all third parties appearing in your content; content metadata including upload dates, content categories, and publication status; earnings data, payout history, and payout account details; tax identification information where required by applicable law including under the DAC7 digital platform reporting regime; and social media handles if voluntarily provided.

Creator earnings records and payout records are retained for 7 years to comply with financial and tax record-keeping obligations.

Seller profile and listings. If you register as a Seller, we additionally collect: profile photographs and optional introduction video; social media handles (Instagram, TikTok, Twitter/X, YouTube) if voluntarily provided; item listings including photographs, descriptions, pricing, condition, and size; bank account details for withdrawal processing; and shipping records and carrier tracking information.

Transactions and payments. When you buy or sell through the Platform, we collect and process: full transaction records including item details, price, date, and Buyer and Seller identifiers; payment method information processed by our payment processor (we do not store full card numbers on our servers); wallet balance and full transaction history; shipping information and tracking numbers; and dispute records and resolution outcomes.

Communications. Our Platform includes an in-app messaging system between Buyers, Sellers, and Creators. All messages, offers, and media shared within the Platform messaging system are stored to facilitate transactions, enable dispute investigation, enforce our Terms of Service, comply with legal obligations, and where required, respond to law enforcement requests. Message data is retained for 2 years.

Automated systems data. The Platform uses automated content scanning and moderation systems including PhotoDNA hash-matching technology and artificial intelligence content analysis tools to detect prohibited content including Child Sexual Abuse Material (CSAM), non-consensual intimate images, and other prohibited content categories. These automated systems process content you upload to the Platform.

Usage and technical data. We automatically collect: IP address and approximate geographic location derived from IP address; device type, operating system, and browser type and version; pages visited, features used, session duration, and interaction patterns; referral source; and cookie identifiers and session tokens. This data is collected via cookies and similar tracking technologies. See Section 10 for full cookie information.

Contract performance - Article 6(1)(b). Processing necessary to provide the Platform services including account creation, identity verification, listing management, transaction processing, payment processing, messaging, dispute resolution, and Creator payout processing.

Legal obligation - Article 6(1)(c). Age and identity verification as required by the UK Online Safety Act 2023 and Ofcom guidance. CSAM detection and mandatory reporting to the Internet Watch Foundation (IWF) and NCMEC CyberTipline. Financial record-keeping under HMRC requirements. DAC7 digital platform reporting obligations. Responses to lawful law enforcement requests.

Legitimate interests - Article 6(1)(f). Fraud prevention and detection, security monitoring, platform integrity, dispute resolution, abuse prevention, and improving Platform functionality. We have assessed that our legitimate interests are not overridden by your rights and freedoms. You have the right to object to processing on this basis.

Consent - Article 6(1)(a). Where we rely on consent for optional features including social media profile links and marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Explicit consent - Article 9(2)(a). Processing of special category data revealing sexual preferences and behaviours as described in Section 3.3.

Substantial public interest - Article 9(2)(g). Processing of biometric data and identity documents for age verification as required under the UK Online Safety Act 2023.

Operational purposes. We use your personal data to create, verify, manage, and maintain your account; verify your age and identity as required by law before granting access to adult content or adult products; enable you to list, buy, and sell items on the Platform; process payments, manage your wallet balance, and process payouts; facilitate communication between Buyers, Sellers, and Creators; investigate, mediate, and resolve disputes between users; detect, prevent, investigate, and respond to fraud, abuse, policy violations, or illegal activity; send transactional communications; comply with applicable legal and regulatory obligations; report Creator and Seller income to tax authorities where required; maintain, improve, and develop Platform features; and send marketing communications where you have explicitly opted in.

Safety and legal compliance. We use automated systems and human moderation to detect, hash-match, and report CSAM to the Internet Watch Foundation (IWF) and the NCMEC CyberTipline; detect non-consensual intimate images and other prohibited content; enforce our Content Standards and Terms of Service; and respond to law enforcement requests, court orders, and regulatory requirements from Ofcom, the ICO, HMRC, and other applicable authorities.

Automated decision-making and profiling. The Platform uses automated decision-making for content moderation, fraud detection, age verification, and certain account suspension workflows pending human review.

Where automated processing produces a decision that significantly affects you, you have the right to request human review of that decision by contacting trust@sliqd.com. Automated CSAM detection and mandatory reporting to law enforcement is a legal obligation and is not subject to human override or data subject objection rights.

We do not sell your personal data to any third party for any purpose whatsoever.

Third-party service providers. We share data with trusted third-party processors who process it solely on our behalf under written data processing agreements compliant with UK GDPR Article 28.

• Amazon Web Services (AWS) - cloud infrastructure, hosting, and storage; data stored in EU and UK data centres
• Cloudflare - network security, DDoS protection, Web Application Firewall, and content delivery
• Verotel/CardBilling - payment processing for card transactions
• Yoti - age and identity verification; processes biometric and identity document data under their own ICO-compliant privacy framework
• Hive - automated content moderation and analysis; processes content uploaded to the Platform to detect prohibited material
• Twilio - transactional communications; processes data under appropriate data protection safeguards

We review all third-party processors for UK GDPR compliance before engagement and maintain written data processing agreements with each.

Other users. Certain profile information is visible to other users as necessary to operate the marketplace, including your display name, username, profile photographs, seller ratings, and listings. Your full legal name, email address, date of birth, payment or banking details, identity verification documents or verification status details, IP address, and precise location are never made visible to other users.

Law enforcement, regulators, and mandatory reporting. We disclose personal data where required for CSAM mandatory reporting, lawful law enforcement requests, regulatory compliance, court orders, and protection of rights, safety, and property of Sliqd, our users, or third parties.

Business transfers. In the event that Sliqd is involved in a merger, acquisition, corporate restructuring, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity. We will notify you by email or prominent in-Platform notice before your data becomes subject to a different privacy policy and will provide you with an opportunity to close your account if you do not wish your data to be transferred.

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy, to provide Platform services, and to comply with our legal obligations. Specific retention periods:

• Account data: retained for the duration of your account plus 2 years following account deletion for dispute resolution and legal compliance purposes.
• Transaction records: retained for 7 years to comply with financial and tax record-keeping obligations under HMRC requirements.
• Age verification records: verification status result retained for the duration of your account and for 7 years following account closure.
• Creator identity verification and consent records: retained for a minimum of 7 years from the date of verification or the date of last content publication, whichever is later.
• Creator earnings and payout records: retained for 7 years to comply with financial and tax record-keeping obligations.
• Messages and chat: retained for 2 years to facilitate dispute resolution and comply with legal obligations.
• Content uploaded by Creators: retained for the duration of the Creator's account. Following account deletion, content is removed within 30 days subject to any legal hold requirements.
• CSAM reporting records: retained indefinitely in compliance with mandatory reporting obligations.
• Marketing preferences: retained until you opt out or request deletion.

Upon account deletion, we will anonymise or permanently delete your personal data within 30 days except where retention is required by law or by ongoing legal proceedings.

As a data subject under UK GDPR you have the following rights:

• Right of access: request a copy of the personal data we hold about you, provided in a commonly used, machine-readable format such as JSON or CSV.
• Right to rectification: request correction of inaccurate or incomplete personal data.
• Right to erasure: request deletion of your personal data, subject to our legal retention obligations.
• Right to restriction: request that we limit processing of your data in certain circumstances.
• Right to data portability: receive your personal data in a structured, commonly used, machine-readable format such as JSON or CSV, and transmit it to another controller.
• Right to object: object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making: request human review of any automated decision that significantly affects you.

To exercise any of these rights, contact us at legal@sliqd.com with subject line "Data Subject Request - [Your Name]" including your full name and username. We will verify your identity before processing your request and will respond within 30 calendar days. In complex cases we may extend this period by a further 60 days with notice.

If you are not satisfied with how we handle your request or your personal data generally, you have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.

Where we transfer personal data outside the United Kingdom or the European Economic Area (EEA), we ensure appropriate safeguards are in place in compliance with UK GDPR Chapter V.

• Standard Contractual Clauses (SCCs): approved by the UK ICO or European Commission, in place with all processors in non-adequate countries.
• Adequacy decisions: transfers to countries benefiting from a UK adequacy decision from the UK Secretary of State.
• Amazon Web Services (AWS) - data stored in EU and UK data centres; any transfers are protected by UK GDPR-compliant safeguards.
• Cloudflare - processes data under UK-approved Standard Contractual Clauses.
• Verotel/CardBilling - processes payment data under appropriate contractual and regulatory safeguards.
• Yoti - processes verification data under UK-compliant safeguards.
• Hive - processes uploaded content for moderation under appropriate UK GDPR transfer safeguards.
• Twilio - processes transactional communications under appropriate UK GDPR transfer safeguards.

We will update this Section promptly if our transfer mechanisms change.

We use cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device that help us operate, secure, and improve the Platform.

Essential cookies. Strictly necessary for the Platform to function including authentication tokens, session management, and security features. These cannot be disabled as the Platform cannot function without them.

Analytics cookies. Help us understand how users interact with the Platform including pages visited, features used, and session patterns. We use this data in aggregated, anonymised form to improve the Platform.

Preference cookies. Remember your settings and preferences including browsing category selections and display preferences.

Marketing and advertising cookies. Used to deliver relevant advertising and to measure the effectiveness of marketing campaigns. These are only set with your explicit consent. You may withdraw consent at any time where cookie preference controls are made available.

You can control and manage cookies through your browser settings. Disabling essential cookies will significantly impair or entirely prevent Platform functionality. See our Cookie Policy for current cookie and local storage details.

We implement appropriate and proportionate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, destruction, or accidental loss. These measures include:

• HTTPS encryption for all data in transit, enforced via Cloudflare SSL/TLS
• Cloudflare Web Application Firewall and DDoS protection
• Password hashing - passwords are never stored in plain text
• Encryption of sensitive data at rest
• Access controls and role-based permissions limiting staff access to personal data on a strict need-to-know basis
• Access logging and audit trails for sensitive data categories
• Regular security monitoring, vulnerability scanning, and penetration testing
• Secure, encrypted storage for identity verification records with restricted access

No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and will notify the ICO within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33.

The Platform is strictly restricted to users aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. Mandatory, robust age verification is a condition of Platform access for all users.

If we become aware that a user is under 18, we will immediately suspend their account, delete their personal data, and where required, report the matter to appropriate authorities. If you believe a minor has registered on or accessed the Platform, please contact us immediately at trust@sliqd.com.

The Platform hosts user-generated adult content and facilitates the sale of adult products. Sliqd operates in compliance with the UK Online Safety Act 2023, applicable Ofcom guidance, and all relevant legislation governing adult content platforms.

Where you voluntarily share sensitive personal data as part of your profile, listings, or content including personal photographs, you do so with your explicit consent. You may request removal of such data at any time by contacting hello@sliqd.com or by deleting your account.

Data revealing sexual preferences and behaviours is processed under Article 9(2)(a) UK GDPR - explicit consent. We apply enhanced security measures to this data category as described in Section 11. This data is never used for advertising profiling or sold or shared with third parties for any commercial purpose.

Biometric data and identity document data processed as part of age verification is processed under Article 9(2)(g) UK GDPR - substantial public interest, specifically mandatory age verification as required by the UK Online Safety Act 2023.

Creator consent records held pursuant to our Terms of Service are retained as described in Section 7 and may be disclosed to law enforcement upon lawful request.

Sliqd operates automated content moderation systems, including IWF Image Intercept hash-matching technology (incorporating PhotoDNA and VHASH) and Hive AI content-analysis tools. These systems automatically scan content uploaded to the Platform to detect prohibited content, including Child Sexual Abuse Material (CSAM), non-consensual intimate images, and other prohibited content categories.

Content matching known CSAM hashes is automatically detected, immediately removed, and mandatorily reported to the Internet Watch Foundation (IWF) and the NCMEC CyberTipline without prior notice to the user. This is a legal obligation under the UK Online Safety Act 2023 and there are no exceptions.

Users whose content triggers mandatory CSAM reporting will be immediately and permanently banned from the Platform and their details referred to the National Crime Agency and relevant law enforcement authorities.

These automated moderation processes are not subject to the right to object under UK GDPR Article 21 as they constitute processing under a legal obligation under Article 6(1)(c).

We may update this Privacy Policy from time to time to reflect changes to our data practices, legal obligations, or Platform functionality.

When we make material changes, we will update the effective date at the top of this Policy; notify you by email to your registered email address and by prominent in-Platform notice; and where required by law or where the change affects your rights, seek your renewed explicit consent.

Continued use of the Platform after the effective date of a revised Policy constitutes acceptance of the updated terms. If you do not agree with the revised Policy, you must stop using the Platform and delete your account before the revised Policy takes effect.

For any questions, concerns, data subject requests, or complaints relating to this Privacy Policy or our data practices:

Email

hello@sliqd.com

Subject line

Privacy Request - [Your Name]

Response time

Within 30 calendar days

To exercise your data subject rights, email legal@sliqd.com with your full legal name, username, and a clear description of your request. We will verify your identity before processing.

To contact the UK data protection regulator directly: Information Commissioner's Office (ICO), ico.org.uk - 0303 123 1113.

Sliqd Limited - Registered in England and Wales - Company No. 17219406 - hello@sliqd.com

This Privacy Policy is governed by the laws of England and Wales. Last updated: 22 May 2026.