Who is responsible for your data
The controller is WAVYZZ, 41 rue Jacquemars Giélée, 59800 Lille, France, reachable at contact@vinds.app. This policy covers the vinds.app website, the Vinds app and the Vinds browser extension.
What we do not do
- We do not sell your data or use it for advertising.
- We never ask for your Vinted password and never store it.
- We process no bank card details: purchases use the payment method saved in your own Vinted account.
- The website sets no tracking cookies.
The data we process
On the vinds.app website
- Analytics: anonymous visit statistics (page views, referrer, device type, country) through Umami, a tool we host ourselves, without cookies. Your IP address is not stored.
- Contact: if you write to us, your email address and the content of your messages.
- Newsletter: if you subscribe, your email address, managed with a self-hosted mailing tool.
In the Vinds app
- Account: your email address, display name and language, held by our own sign-in service (Zitadel, which we host ourselves), and the identifier that links that sign-in to the app. The sign-in service sends account emails, such as address verification or password reset.
- Connected Vinted accounts: the Vinted session you send us (access and refresh tokens, session cookie), encrypted with AES-256-GCM before it is stored; your Vinted profile (username, city, description).
- Checkout details: the shipping addresses saved in your Vinted accounts, and the recipient phone numbers you give for delivery. Phone numbers are encrypted; shipping addresses are stored without field-level encryption, on our encrypted connections and access-restricted servers.
- Activity: your filters, matched listings, your purchases and their stages, your orders and related conversations, including links to the pictures exchanged in them and pictures you upload.
- Alerts: the destinations you set up (Discord, Telegram, ntfy, webhooks) and, for Discord, the credentials linking your account, encrypted.
- Technical logs: operating and error logs, and the access logs of our front proxy, which record each request to the website and the app (IP address, date, address requested, response, browser and referring page). Anything sent to our error tracking is stripped of request content and personal data first.
- Analytics: a few setup steps, such as connecting an account, counted anonymously through the same Umami tool we host ourselves, without cookies or personal data, as aggregated statistics only.
Your email address is needed to create an account. A connected Vinted account is needed to buy on your behalf and access that account’s orders. Vinds collects public listings and matches them to your filters independently of these account connections.
In the browser extension
The Vinds extension for Chrome and Firefox does one thing: connect a Vinted account to Vinds.
- When you open it, it checks whether you are signed in on vinted.fr, without sending anything.
- It reads your vinted.fr session (access and refresh tokens, session cookie) only when you click Send to Vinds, and sends it straight to your Vinds account over an encrypted connection, with your browser’s user agent and the account name you may type. The session is never kept in the extension.
- It stores only its pairing details on your device: the pairing key, the key’s name and hint, the address of your Vinds server, and the date and time this browser was paired. Unpair removes them.
- It does not read your browsing history, other sites or other Vinted data, and it sends nothing to anyone but Vinds.
Why, and on what basis
- To provide the service you asked for (performance of the contract): account, connecting your Vinted accounts, filters, feed, alerts, purchases and orders.
- To secure and improve the service (legitimate interest): technical and access logs, anonymous analytics.
- To answer your messages (legitimate interest) and to send the newsletter (consent, which you can withdraw at any time).
- To meet our legal obligations, such as accounting.
For how long
- Account and app data: as long as your account is open. To close your account and have your data deleted, use Delete account in the app settings (it takes effect after 7 days, and you can cancel until then) or write to us; we handle the request within one month, except for what the law requires us to keep. When a deletion is scheduled, we tell you through your notification destinations, again the day before it runs, and if it is cancelled. A request may wait for a manual review, for example while a purchase is still being settled, and still completes within one month. Removing a Vinted account from Vinds deletes its profile, address and phone records.
- Sign-in sessions: they expire after 7 days, and their records are deleted within 30 days.
- Listing details inside sent alerts: cleared after 30 days.
- Pictures you upload in order conversations: 24 hours. Pictures sent through Vinted are kept as links to Vinted.
- Contact messages: up to 3 years after our last exchange.
- Newsletter: until you unsubscribe.
- Visit statistics: aggregated, without cookies or personal identifiers, and kept for 25 months at most.
- Front proxy access logs: rotated by size on the server, and kept for 24 hours in our log search tool.
- Backups: encrypted. Our own backup server rotates them over six months; an offsite copy is kept in write-protected storage under our backup policy, with no fixed automatic expiry.
What we keep after your account is deleted
Your sign-in link, Vinted sessions, addresses, phone numbers, orders, conversations, support messages, alert destinations and keys are erased. What follows is kept without your name, email address or contact details:
- Bookkeeping records of your purchases, sales and stock (amounts, dates, item descriptions and the Vinted transaction identifiers needed to reconcile them with Vinted): 10 years, the period French commercial law sets for accounting records.
- Evidence of the purchases, payment checks and offers made on Vinted on your behalf: 5 years, the limitation period for legal claims.
- Our own billing records for your subscription: 10 years, for our accounting.
- Security logs of the actions taken on the account, with identifiers but no content: 5 years.
- Technical records of the extensions run for your account (versions, approvals and run results): 5 years.
- Records of the network routes used for your Vinted connections and of their incidents: 5 years.
- Records of the background tasks Vinds ran for your account (identifiers, states and technical details): 1 year, or as long as a record above that still refers to them.
These periods count from the deletion of your account. At the end of each one, the records are deleted automatically. If a record cannot be deleted then because another kept record still depends on it, we complete the deletion after a manual review.
The following is kept with no fixed end date:
- The record of your deletion request (its dates, identifiers and the number of records deleted) and the security log entries of the deletion and of the later automatic deletions: proof that we honoured your request.
- Public listings that matched your filters and your filter criteria: kept unlinked from you, as they contain no personal data.
- Placeholder records that stand in for your deleted account, workspace and Vinted connections, holding only random identifiers, so that the kept records stay consistent.
Who can access it
Your data is processed by WAVYZZ only. We rely on these providers:
- ServerNet Internet Limited hosts the app, its database and the website on servers in Amsterdam, Netherlands (European Union).
- OVH SAS hosts our front proxy, which every request to the website and the app passes through and which writes the access logs, as well as our sign-in service, error tracking, analytics, notification relay and backups, in France (European Union).
- Amazon Web Services keeps an encrypted, write-protected copy of our backups in Stockholm, Sweden (European Union).
- Porkbun LLC sends the emails of the sign-in service from its mail servers.
- Zoho hosts the mailbox that receives the messages you write to us, in its European data centres.
- Decodo (UAB Data troops, Švitrigailos g. 34, Vilnius, Lithuania (European Union)) runs the proxy network through which the requests the app makes to Vinted for you are routed, including your Vinted session.
- Discord, Telegram and, when you choose them, your own webhooks receive the alerts you set up, including their content. Our ntfy server is self-hosted; to wake iPhones up it passes a signal without the alert’s content through the public ntfy.sh service.
Porkbun LLC, Discord and Telegram may process data outside the European Union, notably in the United States. The app’s main host is established in the United Kingdom, which benefits from an adequacy decision of the European Commission; the app’s data is stored in the European Union.
When you use Vinds, requests are made to Vinted with your session, on your behalf. Vinted processes them under its own privacy policy.
Your rights
You can ask to access your data, correct it, erase it, restrict its processing, receive it in a portable format, object to processing based on legitimate interest, withdraw your consent at any time, and set instructions for what happens to your data after your death. Write to contact@vinds.app; we answer within one month.
You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).
Changes
We will update this policy if our processing changes. The date of the last update is shown at the top of the page.