1. Who we are

Vinty is an online marketplace for second-hand fashion in Cyprus. Until a dedicated legal entity is established, Vinty is operated by an individual residing in the Republic of Cyprus under the registered trade name "Vinty" (the "Platform Operator"), who is the data controller for the personal data described in this policy.

You can contact us about anything in this policy at support@vintycy.info.

2. The data we collect

• Account data: your email address, username, password (stored only in hashed form, never readable), profile photo and bio.
• Google and Apple sign-in: if you sign in with Google, we receive your name, email address and profile picture from your Google account. If you sign in with Apple, we receive your name and email address, or the private relay address Apple provides. We never receive your Google or Apple password.
• Listings and reviews: the photos, descriptions, prices and location you choose to show on your listings, and the reviews you write or receive.
• Messages and offers: the messages, images and offers you exchange with other users.
• Orders and delivery: your name, email address and phone number for delivery, the BOX NOW locker you choose, and the history of your purchases and sales.
• Payments and payouts: card and bank details are entered directly with our payment provider, Stripe, and never reach Vinty's servers. We keep the amount and status of each payment and an identifier for your Stripe payout account.
• Activity in the feed: which listings are shown to you and which you view, open and save. It is linked to your account or, if you are not signed in, to a random identifier that lasts only for your browsing session.
• Notifications: if you allow notifications in the app, a device token issued by Apple or Google so that we can send them.
• Technical data: crash and error reports from the website and apps, with known personal details such as email addresses removed before they are sent.

3. How we use your data

We use your data only to run Vinty:

• to create and secure your account and let you sign in;
• to publish your listings and profile and let buyers and sellers talk to each other;
• to process orders, payments, refunds and payouts, and arrange delivery through BOX NOW;
• to send you emails and notifications about your account, orders, offers and messages;
• to order the listings in your feed and show popular listings;
• to prevent fraud and abuse, resolve disputes, enforce our Terms and keep the Platform working;
• to meet our legal obligations, such as keeping business and tax records.

We process your data to perform our agreement with you (the Terms), to comply with the law, and for our legitimate interest in running a safe marketplace. Where we rely on your consent, such as for notifications, you can withdraw it at any time.

We do not sell your personal data. Your data is not used for advertising, and data received from Google or Apple sign-in is used only to provide your Vinty account. We do not use your data to train artificial intelligence models.

4. Who we share it with

We share personal data only with the service providers that help us run Vinty, and only what each one needs:

• Supabase, which hosts our database, accounts, files and server functions. This data is stored in the European Union.
• Stripe, which processes payments, refunds and seller payouts and verifies sellers' identity. Stripe acts as an independent data controller for payment and identity-verification data.
• BOX NOW, which delivers parcels and receives the name, email address, phone number and locker needed for each delivery.
• Resend, which sends our emails.
• Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service), which deliver app notifications.
• Google and Apple, when you choose to sign in with them.
• Sentry, which receives crash and error reports. This data is stored in the European Union.
• Our website hosting provider, which delivers the website and apps to your device.

Other users see what you make public: your username, profile photo, bio, listings and reviews. The buyer and the seller in an order see the details needed to complete it.

We may also disclose data where the law requires it, or to protect the rights and safety of our users and of Vinty.

Some providers may process data outside the European Union. When they do, they rely on safeguards approved by the European Commission, such as Standard Contractual Clauses or the EU–US Data Privacy Framework.

5. How we protect it

Every connection to Vinty is encrypted (HTTPS). Passwords are stored only in hashed form. Database security rules ensure that each user can read only what they are allowed to, and administrative access is limited and protected by additional verification.

No system is completely secure. If a breach affects your personal data, we will notify you and the authorities where the law requires it.

6. How long we keep it, and how to delete it

• Account and profile data: until you delete your account. When you do, your sign-in details and email address are deleted and your profile is replaced by an anonymous placeholder.
• Listings: listings nobody has bought are deleted, with their photos, when you delete your account. Listings that were sold are hidden and kept with the order records.
• Order, payment and payout records: six years after the transaction, as required for business and tax records, and then deleted or anonymised.
• Messages and reviews: kept after you delete your account, so that the other person keeps their conversation and review history, but no longer linked to your name or profile.
• Feed activity: kept to improve how listings are ranked. After you delete your account, it is linked only to the anonymous placeholder.
• Device tokens for notifications: deleted when you delete your account.
• Crash and error reports: up to 90 days.

You can delete your account at any time from the account deletion page (/accounts), or by emailing support@vintycy.info.

7. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you have given. To exercise any of these rights, email support@vintycy.info. We reply within one month.

You also have the right to complain to the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy).

8. Children

Vinty is not directed at children. If you believe a child has given us personal data, contact us and we will delete it.

9. Changes to this policy

If we change this policy, we will publish the new version on this page and update the date at the top. If a change affects how we use your data in an important way, including data received from Google or Apple sign-in, we will tell you by email or in the app before it takes effect.

10. Contact

For any question about this policy or your personal data, email support@vintycy.info.