Privacy Policy

1. Who we are

Vintify is a UK business operating from the United Kingdom, and is the trading name used throughout these pages. Our full registered business details are published here before any paid subscription opens, and are available on request at any time at hello@getvintify.com.

We are the data controller for the personal data described in this policy, except where we say otherwise in “Your buyers’ data”.

For anything about your data, email hello@getvintify.com. We answer data protection requests within one month, as the law requires.

2. What we collect

We collect only what the service needs to work:

• Your Discord roles: if you sign in with Discord, the roles you hold in the members’ server. There is no password.
• Billing details: your plan, its status and your invoices. These are handled by Stripe and our subscription service; card numbers never reach us.
• Your Vinted token: the token you paste to connect a Vinted account, stored encrypted.
• Your trading data: sales, parcel status, wallet figures, listings and purchases read from your own Vinted account; orders, fees, payouts and listings read from your own eBay account; and everything you type into the app, such as costs, notes, photos, expenses, goals and settings.
• Your Discord identity, or your email: the Discord id, username and avatar Discord gives us when you sign in with Discord, or the email address you bought with and sign in with if you started without Discord.
• Technical data: IP address, browser type, timestamps and error reports, recorded when you use the app so we can keep it secure and diagnose faults. When something goes wrong for you (a screen that fails, a request that errors, a Vinted or eBay sync that fails), the error message, the screen it happened on and when are kept against your account for 30 days so we can help you; never your passwords, tokens or what you typed.
• Support access, only if you turn it on: in Settings you can let our team into your account for 24 hours to fix a problem. While it is on they can see and change what you can; every visit and every change they make is listed for you in Settings, and you can stop it at any time.
• On this website: the email address you give to join the waitlist, and the name, email and message you send through the contact form.

3. What we never collect

We never ask for, receive or store a Vinted, eBay or Discord password. Vinted access is through a token you copy from your own browser; eBay access is through eBay’s own sign-in; Discord tells us who you are without sharing your credentials.

The app never reads your Vinted messages and keeps no buyer’s delivery address.

We never receive your card number, expiry date or security code. Payments go directly to Stripe.

We do not buy personal data from anyone, and we do not sell yours to anyone.

4. Why we are allowed to use it

Data protection law requires us to have a lawful basis for each purpose. Ours are:

• To provide the service you have paid for, syncing your marketplace data, calculating profit and producing reports: performance of our contract with you (UK GDPR Article 6(1)(b)).
• To take payment and prevent fraud: performance of our contract, and our legitimate interests in being paid and not being defrauded (Article 6(1)(b) and (f)).
• To keep the service secure and diagnose faults: our legitimate interests in running a secure, working product (Article 6(1)(f)).
• To send you service messages, such as a failed payment, a change to these terms or a security notice: performance of our contract, and our legal obligations (Article 6(1)(b) and (c)).
• To email you when Vintify opens, if you joined the waitlist: your consent, which you can withdraw at any time (Article 6(1)(a)). We do not add you to marketing without asking.
• To keep accounting and tax records: our legal obligations (Article 6(1)(c)).

5. Your buyers’ data

The app keeps no buyer addresses. Even so, data read from your marketplace accounts can contain personal data about other people, such as an order reference or a buyer’s username. For that data, you are the controller and we are your processor: it is your data about your customers, we only hold it to provide the service to you, and we act on your instructions.

As your processor we commit to the following, which together satisfy Article 28 of the UK GDPR and form part of our agreement with you:

• We process buyers’ data only to provide Vintify to you, and only on your documented instructions; using the service is that instruction.
• Everyone with access is bound by confidentiality.
• We keep appropriate security measures, described below.
• We engage only the sub-processors listed below, under written terms no weaker than these, and we will tell you before we add or replace one so you can object.
• We help you respond if a buyer exercises their rights, and we help you meet your own breach-notification and impact-assessment duties.
• On request we delete or return buyers’ data when your account ends, and we make available what you need to show we are meeting these obligations.
• We tell you without undue delay if we become aware of a personal data breach affecting it.

6. Who else processes it

We use a small number of providers to run Vintify. Each one only receives what it needs, and each is bound by contract to protect it:

• Railway: application hosting and the Postgres database, in the EU (Netherlands).
• Discord: sign-in, and the members’ server. Discord processes what you do inside Discord under its own policy.
• Stripe: payments. Stripe is the controller of its own payment data and processes it under its own policy.
• Anthropic (the Claude AI models): only when you use one of the two AI features. Writing a description sends the listing text involved, never your item photos. Reading a receipt sends the photo of that receipt, so the total, date and shop can be read from it. Neither is used to train their models.
• A sold-listings data provider: only when a price check needs figures the app does not already hold, and only the words that describe the item.
• Vercel: hosting for this website. Resend: the emails this website sends, such as a waitlist confirmation.

7. Where your data goes

Your database sits in the European Economic Area. Some of our providers, including Stripe, Discord and Anthropic, are based in the United States or process data there.

Where data leaves the UK or EEA we rely on the safeguards the law requires: the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or an adequacy decision covering that country. You can ask us for details of the safeguard used for any provider.

8. How long we keep it

We keep your account and trading data for as long as your account is open, because the whole point of the product is the history. After your plan ends you can still sign in to download or delete it.

When you delete your account we delete its data within 30 days, apart from anything we are legally required to keep: invoices and payment records, which we keep for six years to satisfy HMRC.

Technical logs and error reports are kept for up to 90 days. A waitlist email is kept until Vintify opens and you have been told, or until you unsubscribe, whichever is sooner.

9. Your rights

Under UK and EU data protection law you can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything that is wrong.
• Delete your data; we will, unless we are legally required to keep it.
• Restrict what we do with it, or object to processing based on legitimate interests.
• Send your data to you or another provider in a portable format. Much of this you can do yourself: the app exports everything as files.
• Withdraw consent at any time, without affecting anything done before.

10. If you are unhappy

Please tell us first at hello@getvintify.com; we would rather put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator: ico.org.uk, or 0303 123 1113. If you are in the EU, you may complain to your own country’s supervisory authority instead.

11. How we protect it

Everything travels over encrypted connections. There is no password to protect, because sign-in is through Discord. Your Vinted token is encrypted at rest with a key kept outside the database.

Every query in the application is scoped to the account that made it, so one member’s data cannot be returned to another. Public endpoints are rate-limited, and the server only fetches from an allowlist of hosts.

Access to production systems is limited to those who need it. If a breach ever affects your rights and freedoms, we will tell the ICO within 72 hours and tell you without undue delay, as the law requires.

No system is perfectly secure, and we will not pretend otherwise. What we can promise is that we will tell you quickly and honestly if something goes wrong.

12. Cookies

This website sets no cookies. It remembers your light or dark theme choice in your browser’s local storage, which never leaves your device. The app sets only the cookies it needs to keep you signed in. These are strictly necessary, so under the Privacy and Electronic Communications Regulations they do not require consent.

We do not use advertising cookies and we do not track you across other websites. If we ever add analytics that are not strictly necessary, we will ask for your consent first. The Cookie Policy lists everything.

13. Automated decisions

We do not make decisions with legal or similarly significant effects about you by automated means alone.

The app does flag things on your behalf, such as a listing that has gone stale or a price that could be dropped, within thresholds you set. Those are suggestions; the app never acts on a marketplace for you.

14. Children

Vintify is for people aged 18 and over. We do not knowingly collect data about children. If you believe a child has given us personal data, tell us at hello@getvintify.com and we will delete it.

15. Changes to this policy

If we make a change that materially affects how we use your data, we will email you at least 30 days beforehand.

Minor clarifications take effect when published. The date at the top always shows the current version.