Your data & your rights

Go to Settings → Data & privacy and click Request export. We'll build a JSON file with your profile, listings, offers, orders, messages you've sent, reviews, reports, identity-check history, and tax info: everything we hold that's personally about you.

The file is ready immediately and stays available to download for 72 hours. You can request a fresh export any time.

JSON is “structured, commonly used and machine-readable,” which satisfies the portability requirement (Art. 20) too, so you can import the file into another tool or pass it to a privacy adviser.

From the same Data & privacy page, click Delete my account. You'll be asked to confirm by typing DELETE. We then:

• Hide your profile immediately. You're shown as "Deleted user" on listings, reviews, and messages.
• Start a 30-day grace window. You can sign back in any time during that window and click Cancel deletion to restore your account exactly as it was.
• After 30 days, permanently erase the “erase bucket”: drafts, saved listings, settings, push tokens, ID-check metadata, marketing data.

Erased

Removed entirely after the 30-day grace: drafts, saved listings, personal settings, push notification tokens, ID verification metadata, marketing consents and email send logs.

Anonymised but kept

Replaced with "Deleted user" while the underlying record stays so the other party retains their copy of the interaction:

• Completed orders (amounts, dates, items)
• Reviews left and received
• Messages you exchanged with other riders (their copy of the conversation)
• Public listing records on completed sales

Kept verbatim, legal hold

Some records can't be erased on request because UK law (or our defence of legal claims) requires we keep them:

• Tax info, kept for ~5 years from the end of the relevant reporting year (DAC7 / UK Platform Operator Reporting).
• Moderator action records, kept for 7 years for accountability and dispute defence.
• Reports filed against you, kept for 7 years so we can spot patterns if the same person re-registers.
• Active disputes or investigations, paused until they resolve. We'll show you the hold date in the deletion confirmation.

Even items on legal hold show up in your data export, since you have the right to see them under Art. 15, even when we can't delete them under Art. 17(3).

UK GDPR gives us up to a month to respond to access or erasure requests. In practice both happen the moment you click the button: the export is built right then, and the deletion flag is set immediately with the 30-day grace running from that moment.

Both actions are done from inside your signed-in account, which acts as your identity check. If you can't sign in (locked-out account, lost email), contact us at privacy@prerode.com and we'll work through identity verification by email.

Messages between buyers and sellers are private and stored only so the other party can read them. They are not used for marketing, training models, or anything other than the conversation itself.

We do run an automated safety scan on every message we receive. It looks for known marketplace-scam patterns (off-platform contact attempts, payment circumvention, scam phrases) and shows a warning to the recipientif anything trips. The sender doesn't see the warning. This protects buyers without letting scammers iterate against the detector.

Prerode moderators can only open a private conversation when there's a triggering event: a report on the conversation, an auto-flag, or an explicit "open for investigation" action that we log to the admin audit trail with a stated reason. There is no general "read any DM" button.

We try to keep the list short. Anything we do share is documented in your data export. When you delete your account we forward the deletion request to every processor that holds copies of your data, with the same retention caveats above.

Database backups are kept for a maximum of 35 days, which is the ICO's normal guidance for “reasonable” backup propagation. Erasure applied today is fully gone from backups within that window.