A small platform holding other people’s customers and other people’s money. This is what we hold, what we deliberately do not, and what we will tell you when something goes wrong.
What we hold
| Data | Held | Why |
|---|---|---|
| Buyer name, email, addresses | Yes | To ship and to contact |
| Order history | Yes | Support, accounting, tax |
| Seller business details | Yes | Listings and payout routing |
| Passwords | Hashed | Never recoverable, which is why reset issues a new one |
| Card numbers | No | Hosted fields. They never reach us |
| A partner brand’s customer list | No | Their checkout, their customers. We are not sent them |
Co-listing does not hand us your list.A partner brand’s buyers complete on the partner’s own checkout. The order webhook reports that a sale happened and its value, for attribution. It is not a customer feed and we do not want one.
Secrets
- Environment variables only. No key, token or password in source, ever. Nothing is committed with a credential in it.
- Validated at boot. Required configuration is schema-checked at startup, so a missing key fails loudly rather than producing a subtly broken deploy.
- Scoped narrowly. Integration tokens carry the smallest permission set that works.
- Anything exposed gets rotated, not assessed for whether it probably mattered.
Boundaries
- All external input is untrusted. Form bodies, API responses, webhook payloads, uploaded files. Validated at the edge before anything downstream sees it.
- Webhook signatures verified first, before the body is parsed as data.
- Parameterised queries only. No string-concatenated SQL.
- No unsanitised HTML rendered. Seller-supplied copy is escaped or passed through a sanitiser, never injected raw.
- Errors do not leak internals. A user sees a useful message; the detail goes to the server log.
Two things worth knowing
- The public asset directory is public. Preview and kit files served from it are reachable by anyone with the URL, even when they carry a no-index tag. No-index keeps a page out of search results. It does not make it private, and nothing sensitive belongs there.
- Vers Capital is not ring-fenced by law. It is an internal account and an accounting practice inside one operating company, not a trust. Saying otherwise would be the easiest untrue thing on this whole site to say. See Vers Capital.
Reporting something
Found a vulnerability, email diva@paythedolls.com with enough detail to reproduce it. We answer within three business days.
- Report it before you publish it. Give us a reasonable window to fix it.
- Do not access other people’s data to prove a point. Describe the path instead.
- No bounty programme and no formal SLA. We will not pretend otherwise. We will credit you if you want the credit.
If we get it wrong
If customer or seller data is exposed, we say so: what happened, what was affected, what we did, and what you should do. Directly to anyone affected, not buried in a policy update. We would rather be the platform that tells you than the one that gets found out.
The binding text is the privacy policy. Account controls are in Your account.