Last updated August 2026
Lustryx is operated by C.Essentials Ltd, a company registered in England & Wales (Company No. 16001166). Our registered office address is 18 The Shortwoods, Dordon, West Midlands, B78 1TP, United Kingdom. We are the "data controller" for the personal data described in this policy — meaning we decide why and how it is processed. You can contact us about anything in this policy at info@lustryx.com.
What we collect depends on how you use Lustryx — browsing, buying, or selling. We only collect what we need for the purposes below.
When you register, we collect your email address, a password (stored only as a one-way bcrypt hash — we never store or can see your actual password), your chosen display name, and — for sellers — a public username. If you register or log in with Google or Facebook instead, we receive your name, email address, and profile photo from that provider, and store an access token so you can log back in; see "Signing in with Google or Facebook" below.
Because parts of Lustryx are restricted to adults, both buyers and sellers must confirm they are 18 or over before registering. We collect and store your date of birth, the method by which your age was confirmed (self-declared, or via Facebook's age-range data), and the date this happened. Sellers — and buyers, where required — who self-declare their age are also asked to complete a one-off £1 card-verification charge through Stripe as an additional check; see "Payment data" below for what that involves. We keep this information for as long as your account exists, and for a reasonable period afterwards, as evidence that we met our legal obligations around age-restricted content.
If you choose to register or log in using Google or Facebook, those providers give us your account identifier, name, and email address, so we can create or match your Lustryx account. Where you grant the relevant permission, Facebook may also share an age-range or birthday value, which we use solely to satisfy the 18+ check described above. We store the access and refresh tokens these providers issue us so that future logins work, but we never see or store your Google or Facebook password. Using Google's sign-in also means Google receives your interaction with their sign-in prompt directly, under Google's own privacy policy.
Lustryx never sees or stores your full card number, CVC, or expiry date. All card payments — the £1 age-verification charge, and payment for orders — are handled directly between your browser and our payment processor, Stripe, Inc., using Stripe's own secure card-entry form embedded on our pages. We only ever receive and store a Stripe reference ID for each payment, its amount, currency, and status (e.g. "succeeded"), which we need to confirm your payment went through and to keep accounting records.
If you sell on Lustryx, you must set up a payout account with Stripe (Stripe Connect) before your listings can go live. During that onboarding — which happens inside a Lustryx-branded panel, but is a direct connection between your browser and Stripe — Stripe itself collects and verifies information it needs to pay you and to meet its own "know your customer" obligations as a regulated payments company: your legal name, date of birth, home address, phone number, and a form of government ID. Lustryx does not receive, see, or store this identity information — we only store the resulting Stripe account ID and three status flags (whether Stripe has enough information to accept charges, pay you out, and whether onboarding is complete), so we know when your account is ready to sell.
When you buy or sell a product, we store the order details necessary to fulfil it and to meet our accounting obligations: the product, price, quantity, buyer and seller, payment status, and (for sellers) the platform fee deducted from the sale. Sellers additionally provide listing information — product photos, descriptions, condition grading, and category — which is shown publicly to other users as part of the marketplace listing itself.
Like most websites, our servers automatically log some technical information whenever you visit: your IP address, browser and device details (user agent), the pages you request, and timestamps. We use this to keep Lustryx secure (e.g. detecting abuse or account takeover attempts), to diagnose faults, and because our hosting infrastructure logs this by default. A record of each login session (IP address, browser, and time) is also kept against your account for the same reasons.
Our registration forms are protected by Google reCAPTCHA, which assesses whether a submission is likely to be automated. This sends some information about your device and interaction with our page to Google. See Google's own Privacy Policy and Terms of Service for how Google handles that data.
If you contact us — by email or through the contact form — we keep the message and your contact details for as long as needed to answer you and to keep a reasonable record afterwards.
We use a small number of cookies to run Lustryx and, only with your consent, to measure site performance or personalise marketing. Full details, including exactly what each cookie does and how to change your choices at any time, are in our separate Cookie Policy.
We don't sell your personal data. We share it only where necessary to run Lustryx, and only with the following categories of recipient:
Other sellers and buyers you transact with see the information necessary to complete that transaction — e.g. a buyer sees a seller's public display name/username and listing details; a seller sees a buyer's display name and delivery details needed to fulfil an order. We don't share your email address or payment details with the other party directly.
Stripe, Google, and Meta are based in the United States and operate globally, meaning some of your data may be processed outside the UK. Each of these providers maintains its own safeguards for international transfers (such as the UK/EU Standard Contractual Clauses), which you can read about in their respective privacy policies. We only work with providers who commit to an appropriate legal transfer mechanism.
We keep account data for as long as your account is active. If you close your account, we delete or anonymise personal data that we no longer have a legal reason to keep, except where we must retain it longer — most commonly: financial and order records for at least 6 years, to meet UK tax and accounting obligations; and age-verification records, kept for a reasonable period as evidence that we carried out the required checks, even after an account is closed. Technical/security logs are kept for a shorter period appropriate to their security purpose.
Under UK GDPR, you have the right to: request a copy of the personal data we hold about you; have inaccurate data corrected; ask us to delete your data (subject to the retention needs described above); restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time where we rely on consent (e.g. optional cookies). To exercise any of these rights, email info@lustryx.com. We'll respond within one month, as required by law.
If you're unhappy with how we've handled your data, you have the right to complain to the UK's independent regulator, the Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint, or by phone on 0303 123 1113. We'd appreciate the chance to resolve your concern directly first, but you're under no obligation to contact us before contacting the ICO.
Lustryx is not intended for anyone under 18, and registration is blocked for anyone who does not confirm they meet that age requirement. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.
We use industry-standard measures appropriate to the data involved: passwords are hashed (never stored in plain text), all traffic to Lustryx is encrypted (HTTPS/TLS), card details are handled entirely by Stripe's own PCI-DSS-compliant systems and never touch our servers, and we use session and request-forgery protections (CSRF tokens) throughout the site. No system is 100% secure, and we can't guarantee the security of data transmitted over the internet.
We may update this policy from time to time — for example, if we add a new payment method, analytics tool, or feature that changes what data we collect. We'll update the "Last updated" date at the top of this page when we do. Significant changes will be highlighted more prominently, such as by email or a notice on the site.
This Privacy Policy sits alongside our other site policies, which you may also want to read: Terms of Service, Cookie Policy, Seller Agreement, Returns & Refunds Policy, Acceptable Use Policy, and our Age Verification Policy.