Privacy Policy

This policy covers Vintmate (the vintmate.app website and web app and the Vintmate browser extension, together the “Service”). The data controller is the operator of the Service (“we”, “us”):

Name

Rádi Software Solutions & Consulting Kft.

Registered address

1074 Budapest, Rákóczi út 82.

Tax number

32709186-2-42

Company reg. no.

01 09 438553

Phone

+36 30 846 2885

Email

hello@vintmate.app

Website

vintmate.app

This policy is provided under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Hungarian Act CXII of 2011.

• Account data: your email address and, if you sign in with Google, your name and Google account identifier. Passwords are handled by Firebase Authentication; we never see or store them.
• Content you upload: photos of your items (including embedded metadata such as the capture time), voice notes and typed notes.
• Generated content: listing texts written by AI (title, description, category, brand, size, condition, colour, material), AI-generated photos, and the price and parcel size you set.
• Upload data: the upload status of your listings and the ID of the draft created on Vinted, so we can show you what was done.
• Settings: photo style, number of AI photos, parcel size, draft or publish mode.
• Extension pairing: a random pairing token (we store only its hash) and the time the extension last connected.
• Usage milestones (product analytics): when you first took the Service’s main steps (sign-up, first photo upload, first grouping, first generation, first finished listing, pairing the extension, first Vinted draft, opening the plans, starting a checkout, subscribing, cancelling), a few counters (e.g. how many listings and drafts were made, how often you opened the plans), when you last used the Service, and your email address.
• Email delivery data: which of our informational emails we sent you and when, and whether you unsubscribed from them.
• Waitlist: if you sign up, your email address and the time of sign-up.
• Technical data: server logs needed to run the Service (e.g. IP address, time, error messages) for a short time; to prevent abuse (e.g. waitlist flooding) your IP address is kept in memory for a few minutes.

We never ask for, receive or store your Vinted password or any other Vinted login credentials. The extension runs on your own computer, in your own browser, and fills in the listing form inside the Vinted session you are already signed in to. It only enters the listing data you approved; it does not read your messages, purchases, payment details or any other Vinted data.

The extension sends Vinted’s public category list (not personal data) to our server so the AI can choose the right category. Vintmate is an independent service; it is not a product of, and is not affiliated with, Vinted UAB.

• Providing the Service (account, processing photos and voice notes, creating listings and AI photos, uploading via the extension): performance of a contract, GDPR Art. 6(1)(b).
• Security, abuse prevention and debugging (logs, rate limiting): legitimate interests, Art. 6(1)(f).
• Service messages (e.g. confirming your email address, notices about your account and subscription): performance of a contract, Art. 6(1)(b).
• Improving the Service (product analytics): we build aggregated reports from the usage milestones to see where people get stuck and what to fix: legitimate interests, Art. 6(1)(f). The milestones are recorded by our own system, without third-party analytics tools, and are never used for advertising profiles.
• Informational emails about using the Service: at most three emails per account, each sent at most once: (1) if you haven’t uploaded a photo 2 days after signing up, help to get started; (2) one day after your first finished listing, if you haven’t subscribed, an overview of the plans; (3) if you still haven’t subscribed 5 days later, a one-time 40% discount on your first monthly fee, valid for 7 days. We only send them to confirmed email addresses and never to subscribers. Legal basis: legitimate interests, Art. 6(1)(f) — we write to our existing users about our own Service they already use. Every email has an unsubscribe link at the bottom: you can unsubscribe at any time, without giving a reason, or write to hello@vintmate.app. Unsubscribing does not affect service messages.
• Waitlist and notifying you about access: consent, Art. 6(1)(a). You can withdraw consent at any time.
• Billing and legal obligations (once paid plans start): legal obligation, Art. 6(1)(c).

Your photos, voice notes and notes are processed by the Google Gemini API to write the listing and create AI photos. Processing is automated but makes no decisions with legal or similarly significant effects on you: you review and approve every listing. Under Google’s terms, content sent through the paid Gemini API is not used to train Google’s models. Please do not upload photos showing identifiable people or other personal data.

We do not sell or rent your data, and we do not share it with advertisers or data brokers. We only use the following providers, as needed to run the Service:

• Google (Firebase Authentication, Cloud Firestore, Gemini API) — sign-in, data storage, AI processing.
• Cloudinary — storing and delivering photos and voice notes.
• Vercel — hosting the website and server.
• Cloudflare — DNS and forwarding email sent to hello@vintmate.app.
• Stripe — payment processing once paid plans start. Card details are handled directly by Stripe; we never see or store them.
• Resend (Resend, Inc.) — sending service messages and informational emails, and keeping our mailing list (email address, first name, unsubscribe status). Emails are sent from servers in the European Union (Ireland). Our emails contain no open or click tracking.

These providers process data on our instructions under data processing agreements. Some may store or process data outside the European Economic Area (e.g. in the United States); such transfers rely on an adequacy decision of the European Commission (EU–US Data Privacy Framework) or standard contractual clauses. We may disclose data to authorities or courts where the law requires it.

• Account, photos, voice notes, listings and settings: while your account exists or until you delete them. On an account deletion request we delete them permanently within 30 days (backups roll off within a further 30 days).
• Usage milestones and email delivery data: while your account exists; they are deleted together with the account.
• Data on the Resend mailing list: while your account exists. If you unsubscribe, we keep your address marked as unsubscribed so that we don’t send you further informational emails.
• Waitlist: until you get access or ask us to remove you.
• Server logs: up to 30 days.
• Billing records: for the period required by accounting law (currently 8 years in Hungary).

We use no advertising or tracking cookies and no third-party analytics. The usage milestones (see above) are recorded by our server in our own database, without cookies. Your browser’s local storage only holds what the Service needs to work (e.g. your sign-in state and preferences). The extension stores its pairing token, its upload queue and temporarily downloaded photos in its own storage, and deletes the photos after uploading.

Data is sent over encrypted connections (HTTPS). Only you can access the data in your account (database-level access rules), server secrets never reach the browser or the extension, and we store only a hash of the extension’s pairing token. No internet service can guarantee absolute security.

You can ask for access to your data, rectification, erasure, restriction of processing and a machine-readable copy (portability); you can object to processing based on legitimate interests and withdraw consent at any time. You can unsubscribe from our informational emails at any time with the link in each email. Send requests to hello@vintmate.app; we reply within one month.

You can lodge a complaint with the Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH, 1055 Budapest, Falk Miksa utca 9–11., ugyfelszolgalat@naih.hu, www.naih.hu) or with the authority of your EU country of residence, or go to court.

When you sign in with Google we receive only your basic profile information (name and email address) and use it only to sign you in. Vintmate’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The Chrome extension uses user data only for its single purpose described above (uploading your listings to Vinted in your own account), in line with the Chrome Web Store User Data Policy, including its Limited Use requirements. We do not sell user data, use it to determine creditworthiness, use it for advertising, or use it for purposes unrelated to the Service.

The Service is only for people aged 18 or over (Vinted also requires users to be 18). We do not knowingly process data of anyone under 18.

We may update this policy from time to time. We will notify you in advance of material changes in the app or by email. The current version is always on this page.