Privacy Policy

1. Who We Are

Vindo ("we", "us", "our") is a price intelligence platform helping European resellers on Vinted, Kleinanzeigen, and Wallapop price, list, and sell items profitably. Our website is vindo.pages.dev.

2. Data We Collect

We collect only the minimum data necessary to operate the service:

• Account data — email address and authentication tokens (via Supabase Auth).
• Usage data — price lookups, sell log entries, monitor filters, seller watchlist items you create.
• Device & analytics data — anonymised page views, device type, and performance metrics.
• Photos — item images you upload for camera scan or photo studio, stored temporarily in Cloudflare R2 and deleted within 24 hours of processing.

We do not collect financial data, payment card numbers, or marketplace login credentials. Payments are processed entirely by Stripe / RevenueCat.

3. Legal Basis (GDPR Art. 6)

• Performance of a contract (Art. 6(1)(b)) — processing your price lookups, sell log, and monitors to deliver the service.
• Legitimate interest (Art. 6(1)(f)) — improving the platform, preventing abuse, and ensuring security.
• Consent (Art. 6(1)(a)) — marketing emails, optional analytics cookies. You may withdraw consent at any time.

4. How We Use Your Data

• Operate and improve the Vindo platform.
• Generate AI-powered price estimates, deal scores, and listing suggestions.
• Send transactional emails (monitor alerts, daily digests, subscription receipts).
• Enforce our Terms of Service and prevent abuse.

5. Data Sharing

We share data only with the following categories of processors:

• Cloudflare — hosting, CDN, Workers (edge compute), R2 (object storage), D1 (database).
• Supabase — authentication services.
• Stripe / RevenueCat — payment processing and subscription management.
• Google / Groq AI — image recognition and text generation (no personal data sent; only item photos and anonymised context).

We do not sell your personal data to third parties.

6. Data Retention

• Account data — retained while your account is active; deleted within 30 days of account deletion.
• Sell log & monitors — retained while your account is active.
• Uploaded photos — deleted within 24 hours of processing.
• Aggregated analytics — retained indefinitely in anonymised form.

7. Your Rights (GDPR Articles 15–22)

You have the right to:

• Access — request a copy of all personal data we hold about you (via Profile → Export My Data).
• Rectification — correct inaccurate data.
• Erasure — delete your account and all associated data (via Profile → Delete Account).
• Data portability — receive your data in a structured, machine-readable format (JSON export).
• Restriction / Objection — restrict or object to certain processing activities.
• Withdraw consent — for any consent-based processing, at any time.

To exercise any right, use the in-app controls or email privacy@vindo.app. We respond within 30 days.

8. Cookies

Vindo uses only essential cookies (authentication session). We do not use tracking or advertising cookies. If this changes, we will request explicit consent via a cookie banner.

9. International Transfers

Your data is processed on Cloudflare's global edge network and Supabase (AWS EU region). All processors are either EU-based or operate under Standard Contractual Clauses (SCCs) or an EU adequacy decision.

10. Security

We employ encryption in transit (TLS 1.3), encryption at rest, secure authentication (Supabase + JWT), and rate limiting at the edge. Access to production systems is restricted to authorised personnel only.

11. Children

Vindo is not directed at children under 16. We do not knowingly collect personal data from minors. If we learn we have done so, we will delete the data immediately.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before taking effect.

13. Contact

For privacy-related questions, contact us at privacy@vindo.app.