Privacy Policy

1. Controller and contact

The controller under the EU General Data Protection Regulation (GDPR) is Fahd Barro, sole proprietor of Vintly, Große Str. 79, 49401 Damme, Germany. For any privacy or data-protection request, contact support@vintly.xyz. See our legal notice (Impressum).

2. Data and purposes

• Account and authentication: email address, account ID, login and authentication records. This is required to create and secure your account (Art. 6(1)(b) GDPR; security also Art. 6(1)(f)).
• Photos and listings: images you upload, generated titles, descriptions, prices, analysis results, processing history and saved content. We process these to provide the features you request (Art. 6(1)(b)). Only upload content you are permitted to process.
• Purchases and credits: store transaction references, subscription status, trial eligibility and credit balances. We use these to deliver purchases, prevent duplicate credit grants and meet accounting obligations (Art. 6(1)(b), (c) and (f)). We do not handle your full payment-card details.
• Connected accounts: where you choose to connect a marketplace account, we process the connection and the related listing information needed for the requested dashboard, autofill or other connection features (Art. 6(1)(b)).
• Support and communication: messages you send us and any information necessary to resolve your request (Art. 6(1)(b) or (f)). Promotional emails are based on your opt-in where required (Art. 6(1)(a)); you can unsubscribe.
• Reliability and abuse prevention: technical log records, errors, device/app version, security signals, rate limits and limited fraud-prevention information (Art. 6(1)(f); where required, Art. 6(1)(c)).
• Product analytics: usage events, navigation, interactions and session recordings used to understand failures and improve Vintly. Optional website analytics run with your consent (Art. 6(1)(a) GDPR); diagnostics or app analytics may rely on legitimate interests where lawful (Art. 6(1)(f)). Session recordings are configured to mask form inputs, but avoid entering sensitive information in fields not intended for it.

3. Service providers and disclosures

We use service providers to operate Vintly. Depending on the feature you use, data can be processed by Cloudflare (website/server infrastructure), Supabase (authentication, database and file storage), AI inference services including Google Gemini and Meta/Muse (image and listing processing), RevenueCat (purchase entitlements), Apple and Google (app-store purchases), PostHog (analytics and session replay), Sentry (error monitoring) and our email service provider (support and transactional messages). When you initiate actions involving Vinted or other connected marketplaces, relevant information is sent to that platform to fulfil your request.

Only data reasonably needed for each service is shared. External providers act under their own data-protection terms where relevant. We do not sell your personal data.

4. AI features

For photo analysis, enhancement and virtual try-on, selected photos, instructions and relevant listing attributes are sent to an AI processing provider to produce the requested result. Outputs may be imperfect. Do not upload images containing private information unrelated to the item. Retention and any further provider processing depend on the provider and our applicable processing agreements.

5. International transfers

Some processors and sub-processors operate outside the European Economic Area, including in the United States. Where personal data is transferred to a country without an applicable adequacy decision, transfers must rely on appropriate safeguards, such as EU Standard Contractual Clauses, where applicable. You may request information on the safeguards relevant to your data using the contact above.

6. Retention and account deletion

We generally retain account and feature data while your account is active and for as long as necessary for the stated purpose. You can request deletion from your account settings or via our account-deletion page. Some transaction, accounting, security or dispute records may need to be kept longer to comply with legal obligations or establish or defend claims. Backups may be deleted on a separate technical cycle.

7. Cookies and similar technologies

We use storage and authentication mechanisms needed to sign you in and run the service. On the website, optional PostHog analytics and session replay start only after you accept analytics; declining does not affect your access to Vintly. You may change or withdraw this website choice below. App analytics and diagnostics are handled separately, and device settings may offer further controls. Contact us if you wish to object to analytics processing associated with your account.

8. Your rights

Subject to the relevant legal conditions, you have the right to access, rectify, erase or restrict your personal data, receive a portable copy, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time with effect for the future. You can contact us at support@vintly.xyz. You also have the right to lodge a complaint with a data-protection supervisory authority, including the competent authority in Lower Saxony (Der Landesbeauftragte für den Datenschutz Niedersachsen).

9. Children and changes

Vintly is intended for users aged 16 and over. We may update this notice if providers or processing activities change. Material changes will be communicated as appropriate.