Indespoke · Vendor portal
Privacy notice
How we look after the details you give us when you apply to stock with Indespoke and use the vendor portal. Last updated 20 October 2026.
Who we are
Indespoke is run by The Black Pounds Project CIC, company number 12680084, with shops in Birmingham and Solihull. We are the controller of the personal data described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For anything about your data, email hello@indespoke.com.
What we collect
- When you apply or renew: your brand name, your name, email, phone, where you are based, website and Instagram, what you sell, your customers, stock and pricing, insurance, and the answers you give on the form.
- When you create an account: your brand and contact details as above, which shop you want, which certificates and insurance you have in place, and a password. We never see or store your password itself, only a scrambled version of it that can't be turned back.
- When you use the portal: the products, photos, prices and stock you add; your drop-off and collection bookings; your messages, support requests and chats with us; your shelf card, including your headshot; and your questions to Billy, the portal's assistant.
- Payments: your plan, what you owe and what you have paid. Bank and card details are entered with Stripe or Shopify, never on our portal, and we don't see them in full.
- Sales: what of yours has sold, read from our shop's till (Shopify). We do not hold details of the customers who bought from you.
- Signing in and being online: when you signed in, the kind of device and browser (for example "iPhone · Safari"), and the rough town your connection comes from, so the team can see who is online when helping you. We count wrong passwords to stop people guessing.
Why we use it
- To run your placement with us (the contract between us, or the steps before it): reviewing your application, setting up your account and product codes, listing your products, booking drop-offs and collections, showing your sales, taking payments and paying you, and answering your questions.
- To keep records the law requires (legal obligation): payments, statements and stock in and out are business records we must keep for tax and company law.
- To keep the portal safe and working (our legitimate interests): stopping password guessing and misuse, seeing who is online so we can help, a record of what our staff change, and fixing faults.
- To tell you about your placement: approval, bookings, payment reminders and replies to your messages. We don't send marketing from the portal, and we don't sell or share your data for advertising.
Who helps us run the portal
These companies process data for us, only on our instructions and under data processing agreements:
| Netlify | Hosts the portal and stores its data and form submissions. |
|---|---|
| Shopify | Our shop system: your products, stock, sales, and pay-all-at-once invoices. |
| Stripe | Monthly Direct Debit payments. |
| Resend | Sends the portal's emails. |
| Anthropic | Powers Billy, the assistant. Billy is sent your question and a short summary of your account (brand name, product code, shop, payment status, unread messages). Anthropic does not use it to train its models. |
Some of these companies are based in, or store data in, the United States. Where data leaves the UK, it is protected by the UK's approved safeguards, such as the UK–US data bridge or the International Data Transfer Agreement.
Indespoke staff can see your account to help you. When a member of staff opens your dashboard, it is recorded with their name.
How long we keep it
- Your account, products, messages, support requests and shelf card: while you have an account. They are deleted when you delete your account or ask us to.
- Sign-ups that are never approved: deleted automatically after 12 months.
- Applications that don't go ahead: deleted after 12 months.
- Sign-ins on your devices: end 180 days after your last visit, or when you sign out.
- Device and town on the "who's online" list: deleted after 30 days.
- Wrong-password counts and Billy's usage counts: deleted within a day.
- Payments, statements and records of stock in and out: six years after the end of the financial year they belong to, as the law requires. If you delete your account, we keep these without your contact details.
Cookies
The portal doesn't use cookies, analytics or tracking. Your browser stores a sign-in code on your device so you stay signed in. This is essential for the portal to work, so we don't need to ask first. Signing out removes it. Fonts and images come from our own site, or from Shopify for product photos.
Your rights
You have the right to:
- Get a copy of your data. Signed in, go to My account and choose Download my data, or email us.
- Correct anything that is wrong. Message the team from the portal or email us.
- Delete your data. Use Delete my account on My account, or email us. Records the law makes us keep stay for the period above.
- Object to or restrict how we use it, and move it to someone else.
We reply within one month. It's free.
If you are unhappy with how we have handled your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or call 0303 123 1113.
How we keep it safe
The portal only works over an encrypted connection. Passwords are scrambled so they can't be read, and sign-ins lock after repeated wrong passwords. Each member of staff has their own login. Brands can only see their own data. Payment card and bank details are handled by Stripe and Shopify, never stored by us.