Privacy Policy

UniformLoop ("we", "us") runs a marketplace where parents and guardians list, buy, exchange and donate pre-owned school uniforms, with handovers at participating schools, churches and approved community collection points. This policy explains how we handle personal information when you use our website and services.

• Account details: full name, email, phone number, and physical address with town/city and ZIP/postal code.
• Verification and security: one-time codes, two-step verification (authenticator app) status, sign-in times and device/security events.
• Marketplace activity: listings, photos, reservations, requests, messages, saved items and ratings.
• Payments: amounts and status. Card details are handled by our payment provider; we keep only the card brand, last 4 digits and a provider reference.
• Preferences and consents: marketing, new-arrival and alert choices, and cookie choices.
• Usage data: pages viewed, searches, ad views and clicks, approximate location from your town.

Accounts are for parents and guardians aged 18 or over. We never ask for a child's name or date of birth, and listings must not include them. School and size are the only details about a uniform's wearer we use.

• Create and secure your account, including mandatory two-step verification.
• Show uniforms near you; your home address sets your town search area and is never shown to other users.
• Arrange reservations, payments and handovers at approved public collection points.
• Send alerts and messages you asked for, and promotions only if you opted in.
• Suggest prices and matches with AI tools. AI never suspends accounts; people make final moderation decisions.
• Prevent fraud, keep the platform safe, and meet legal obligations.

We rely on contract (running your account and transactions), legitimate interests (safety, fraud prevention, improving the service), consent (marketing, optional cookies, alerts by text or call) and legal obligation (tax and record keeping). You can withdraw consent at any time.

We do not sell personal information. We share only what is needed with:

• The other party to a transaction (first name, chosen collection point and reference — never your address).
• Schools and collection-point coordinators that handle your handover.
• Service providers: hosting, email/SMS, payments, analytics and AI processing, under contract.
• Authorities where the law requires it, or to protect someone's safety.

Sponsored ads appear on the platform. We count ad views and clicks in aggregate. Optional analytics and advertising cookies are off until you accept them, and "Reject all" is always as easy as "Accept all". Change your choices any time in Your Privacy Choices.

We do not intentionally collect consumer health data. If you share health-related information (for example, a note about an adaptive uniform need) in a listing or message, we use it only to provide the service you asked for, never for advertising, and we never sell it. Residents of Washington, Nevada and other states with consumer health data laws may request access to or deletion of such data through Your Privacy Choices.

We keep account data while your account is active, transaction records for as long as tax law requires (typically up to 7 years), messages for 2 years, and security logs for 1 year. Deleted accounts are removed or anonymised within 30 days, except where the law requires us to keep records.

We use encryption in transit, two-step verification for every account, role-based access for staff and school admins, audit logs of administrative actions, and regular security reviews. No system is perfectly secure; tell us right away if you suspect misuse of your account.

Depending on where you live (including under GDPR, UK GDPR, CCPA/CPRA in California, PIPEDA, POPIA and other state laws) you may:

• Access or get a copy of your data, and correct it.
• Delete your account and data.
• Opt out of the "sale" or "sharing" of personal information and of targeted advertising.
• Object to or restrict certain processing, and withdraw consent.
• Appeal a decision on your request, and complain to your local data protection authority.

Make a request in Your Privacy Choices. We respond within 30 days (45 days in California) and will not treat you differently for using your rights. We honour Global Privacy Control browser signals.

Your data may be processed in countries other than your own. Where required, we use safeguards such as Standard Contractual Clauses.

We will post updates here and notify you of significant changes by email or in the app before they take effect.

Questions or requests: info@iq360.co.zw.