Privacy Policy

Last updated: [DATE]

1. Controller

The data controller is [TITULAR — full legal name], NIF [NIF], [ADDRESS], contact [EMAIL].

2. What we collect

Account data (email, authentication); seller profile and trader identity; buyer shipping addresses; orders and their history; messages exchanged between buyers and sellers; and technical data necessary to run the service. Listing media (photos, audio, video) is provided by sellers.

3. Why, and on what legal basis

To provide the marketplace and process orders (performance of a contract); to keep the service secure and comply with legal duties (legitimate interest / legal obligation); and to communicate about orders. We do not use advertising trackers.

4. Who we share it with

We share data only as needed with processors who run parts of the service: Supabase (database, authentication, file storage); PayPal (payment processing); Google (Vision API for seller label scanning; YouTube for embedded previews). To fulfil an order, a buyer’s shipping address is shared with the seller, who becomes an independent controller for that data. Some processors may process data outside the EEA under appropriate safeguards (e.g. Standard Contractual Clauses). [Confirm each processor’s region.]

5. Retention

We keep data for as long as your account is active and as required to meet legal, accounting and dispute-resolution obligations, then delete or anonymise it. [Specify periods.]

6. Your rights

You may request access, rectification, erasure, restriction, portability, and object to processing, by contacting [EMAIL]. You may also complain to the Spanish data protection authority (AEPD, www.aepd.es).

7. Cookies

We use only essential cookies: a session cookie for sign-in and a preference cookie for language. We set no advertising or analytics cookies. Embedded YouTube previews load from youtube-nocookie.com and set no cookies until you press play.