Sprzedawaj mądrzej
na Vinted.

This Privacy Policy describes how Vintly ("we", "our", or "us") collects, uses, stores, and protects information when you use the Vintly Chrome Extension (the "Extension") and the website at vintly.pl (collectively, the "Service").

By installing or using the Extension, you agree to the practices described in this policy. If you do not agree, do not install or use the Extension.

Vintly is not affiliated with, endorsed by, or sponsored by Vinted UAB. Vinted is a trademark of its respective owner.

We collect only the minimum data required to operate the Service:

• Account data: email address (when you create a Vintly account), hashed password, account tier (Free / Pro), and subscription status.
• Extension usage data: anonymous usage statistics such as feature usage counts, error logs, extension version, and browser language. We do not collect browsing history outside of Vinted.
• Vinted activity (local only): the Extension reads your active Vinted session in your browser in order to perform automation actions (auto-bump, bulk listing, replies). This data stays in your browser and is never transmitted to our servers, except aggregated statistics you explicitly enable.
• Payment data: handled exclusively by our payment processor (Stripe). We never see or store full card details - we only receive the last 4 digits and a transaction reference.
• Technical data: IP address (truncated and used only for fraud prevention), device type, and timestamp of requests.

We do not collect: real names, addresses, phone numbers, photos, message content from buyers, or any data unrelated to the Service.

We use the data we collect strictly to:

• Operate, maintain, and improve the Extension and the Service.
• Authenticate users and manage subscriptions.
• Detect and prevent fraud, abuse, and security incidents.
• Send transactional emails (account verification, password resets, subscription receipts).
• Provide customer support when you contact us at contact@vintly.pl.
• Comply with legal obligations under EU and Polish law.

We never sell your data to third parties. We never use your data for advertising or profiling.

All personal data is stored on encrypted servers located in the European Union (Frankfurt, Germany). Data in transit is protected by TLS 1.3. Data at rest is encrypted with AES-256.

Passwords are hashed using Argon2id and are never stored or transmitted in plaintext. Access to production systems is restricted to authorized personnel through multi-factor authentication and is logged.

We retain account data for as long as your account is active. Once you delete your account, your data is permanently erased within 30 days, except where we are legally required to retain it (e.g. invoicing data - kept for 5 years under Polish accounting law).

We share data only with carefully selected processors strictly necessary to run the Service:

• Stripe (payments) - processes subscription payments. See Stripe's privacy policy.
• Hetzner (EU hosting) - provides server infrastructure within the EU.
• Postmark (transactional email) - delivers account-related emails.

Each processor is bound by a Data Processing Agreement (DPA) and is GDPR-compliant. We do not transfer personal data outside the European Economic Area.

We may disclose data if required by a valid legal request from a competent authority, but we will challenge overly broad requests whenever possible.

Under the EU General Data Protection Regulation (GDPR) and Polish data protection law, you have the right to:

• Access - request a copy of the personal data we hold about you.
• Rectification - request correction of inaccurate or incomplete data.
• Erasure - request deletion of your data ("right to be forgotten").
• Portability - receive your data in a machine-readable format (JSON export).
• Restriction - request that we limit processing of your data.
• Objection - object to processing based on legitimate interests.
• Withdraw consent - at any time, where processing is based on consent.
• Lodge a complaint - with the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).

To exercise any of these rights, email contact@vintly.pl. We will respond within 30 days.

The Vintly website uses a minimal set of cookies:

• Essential cookies - required for login sessions and security (e.g. CSRF tokens). These cannot be disabled.
• Preference cookies - remember your settings (language, theme).

We do not use advertising cookies, tracking pixels, or third-party analytics that profile users. The Vintly Extension itself does not set cookies on websites you visit; it only reads your active Vinted session, locally, to perform the automation you requested.

You can clear or block cookies at any time through your browser settings. Doing so may impact login functionality.

The Service is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email and update the "Last updated" date at the top of the policy.

Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy or how we handle your data, contact our Data Protection Officer:

Email: contact@vintly.pl
Subject line: "Privacy request"

We aim to respond to all privacy-related inquiries within 5 business days.