Chainr holds sensitive identity data, so we hold it to the highest standard. Here's exactly what we collect, how it's protected, and the control you keep over it.
To register a sale, your identity is checked by Stripe Identity using your government ID document and a selfie. Stripe returns your verified legal name to us. Chainr does not receive or hold the ID image or the selfie itself. We collect: your verified legal name, the billing name and residential address linked to your payment card (via Stripe AVS), the item details you enter, and the timestamp and IP address recorded at the point of handover.
We do not collect anything we don’t need to verify identity and create your certificate. The ID document and selfie stay with Stripe, our verification provider, which processes them to confirm your identity and purges biometric data within around a year. We never see or store your full card number. That stays with Stripe too.
All data is encrypted at rest with 256-bit encryption. Your verified name, address, and sale record are held securely and kept separate from the buyer-facing certificate, which carries names only. The ID document and selfie themselves are never held by Chainr. They are processed by Stripe, our verification provider, which purges biometric data within around a year.
Payments are processed entirely by Stripe, a PCI-DSS Level 1 certified provider. Chainr’s systems never touch your raw card details.
The point of Chainr is to identify both parties, not to reveal where they live. The verified legal names on the certificate identify the buyer and seller for legal and civil purposes. That is what makes the record useful in a small-claims or insurance context.
Residential addresses are held securely and never appear on the certificate. An address is disclosed only to law enforcement, on their direct request: when the police make direct, verified contact with us about a genuine investigation, or where a court orders disclosure. It is never shown to the other party to your sale. The safeguard is who receives it (police only), not anything a party provides, so there is nothing a party can submit to obtain it.
In normal use, nobody. The other party to your sale sees only your full name on the certificate, never your address or contact details.
Your full personal data, including your residential address, is disclosed only to law enforcement, on their direct request: when the police contact us directly about a real investigation through an official channel, or where a court orders disclosure. It is never released to another party: the safeguard is who receives it (police only), not anything a party provides, so there is nothing for anyone to submit. When a genuine disclosure is made to the police, we notify you; we never release data silently. Chainr does not adjudicate disputes between parties, and there is no facility for anyone to request another person’s details. Law enforcement can reach us at evidence@chainr.app.
Chainr does not sell, share, rent, or monetise your personal data in any way. We are not an advertising business. Our only revenue is the £2.50 registration fee paid by each party. Your data exists solely to support your verified record.
Sale records are retained for 7 years from the date of registration, mirroring standard legal document retention periods, so your certificate remains valid evidence if a dispute arises years later.
If you delete your account, your personal profile is removed immediately. Sale records are anonymised rather than deleted, as they form part of the verified chain of ownership for those items.
Under UK GDPR you have the right to access a copy of your data, correct anything inaccurate, request erasure of your account, restrict or object to processing, and request your data in a portable format.
You can exercise any of these from your account Settings page, or by emailing privacy@chainr.app. We never charge for a data request.
Chainr is available worldwide, wherever our identity-verification and payment providers operate. It isn't available where prohibited by sanctions or where identity verification isn't supported. Our compliance is built on UK GDPR (one of the strongest data-protection frameworks in the world), which satisfies the legal requirements in nearly every jurisdiction we serve. Data is stored on servers within the UK and EU.