The controller of your personal data is Trynityflow, Polish tax ID (NIP) 6292516830 (“Vintly”, “we”). Contact for data protection matters: contact@vintly.pl.

This policy covers the Vintly Chrome extension (the “Extension”), the vintly.pl website including the user panel (the “Panel”) and our communication with you (together, the “Service”). We process data in line with the GDPR (Regulation (EU) 2016/679), the Polish Personal Data Protection Act and Polish electronic communications law as regards cookies.

Vintly is an independent tool and is in no way affiliated with, endorsed, sponsored or certified by Vinted. “Vinted” is a trademark of Vinted, UAB. Vinted is a separate controller of the data it processes on its own platform.

Below are all categories of data that reach our servers. The list reflects what the Service actually does.

• Account (Google sign-in): the email address, name and profile picture from your Google account, your Google account ID, account creation date and interface language. We never have access to your Google password.
• Subscription and payments: your Stripe customer and subscription identifiers, plan status and billing period, activation, renewal and cancellation history, invoice amounts and numbers. Card details are entered only with Stripe and never reach or are stored by us.
• Extension data synced to the Panel: your Vinted listings (title, description, price, brand, size, category, condition, status, photo URLs, favourite and view counts, Vinted identifiers), your bump and price-change history and your orders (transaction ID, title, price, fulfilment status, date, thumbnail). This data comes from your own seller account and powers the statistics, history and CSV export in the Panel.
• Extension technical data: a random installation identifier (not tied to your hardware), the Extension version and usage events - the name of the feature used, number of actions, duration and any error code. Events never contain listing or message content.
• Sign-in log: date and time of sign-in, provider (Google), IP address and browser identifier (user agent). You can see it in your account Settings; it exists to detect unauthorised access.
• Website usage data: visit statistics (Google Analytics 4) and product analytics (PostHog): pages visited, approximate location derived from IP, device and browser type, interactions with the interface. See section 7.
• Error reports: if the Extension or the website hits an error, we may receive a technical report (error message, version, browser). It does not contain your listings or messages.
• Correspondence: the content of messages you send us by email or on Discord, and your email address or Discord username.

What we do NOT collect: your Vinted password (the Extension works inside the session you open in your browser and never reads or transmits it), the content of conversations with buyers (reply templates and messages are processed only locally in your browser), buyers’ personal data, browsing history outside Vinted domains, full payment card details.

Every processing activity has a specific purpose and a legal basis under Article 6(1) GDPR:

• Providing the Service - creating and running your account, the Extension licence, syncing listings and orders, Panel statistics, CSV export, subscription handling: performance of a contract (Art. 6(1)(b)).
• Billing and accounting - issuing invoices, keeping accounting records: legal obligation (Art. 6(1)(c)) under tax and accounting law.
• Security - sign-in log, abuse detection, protecting the licence from sharing, defending legal claims: our legitimate interest (Art. 6(1)(f)).
• Product development and reliability - feature usage events and error reports in aggregated form: our legitimate interest (Art. 6(1)(f)). You may object (section 6).
• Website analytics (GA4 and PostHog cookies and similar technologies): your consent (Art. 6(1)(a)), which you can withdraw at any time without affecting earlier processing.
• Replying to your messages: our legitimate interest in supporting users (Art. 6(1)(f)) or performance of a contract when the matter concerns your account.

We do not sell your data, do not use it for advertising and do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects.

We use processors acting on our instructions under data processing agreements (Art. 28 GDPR). No one else has access to your data unless the law requires it.

Some of these providers are established or host servers in the USA. Transfers rely on the European Commission’s EU-U.S. Data Privacy Framework adequacy decision (for DPF-certified providers) or the Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). A copy of the safeguards is available on request.

The Vintly Discord server is a voluntary community - by joining you accept the terms and privacy policy of Discord Inc., which is a separate controller.

• Google Ireland Ltd. - Google sign-in (OAuth) and Google Analytics 4.
• Stripe Payments Europe Ltd. / Stripe, Inc. - payments, invoices and subscriptions. Stripe is also an independent controller of payment data to the extent described in its own privacy policy.
• Supabase, Inc. (Amazon Web Services infrastructure, region eu-west-1, Ireland) - the Service database.
• Vercel, Inc. - hosting of the website and the Panel.
• PostHog, Inc. - product analytics and usage events.
• Functional Software, Inc. (Sentry) - error reporting, where enabled in a given version of the Extension or website.
• Our accountants and tax authorities - as regards accounting records.

• Account data, listings, orders, bump history and usage events: for as long as you have an account. Deleting your account in Settings removes them from our database immediately and irreversibly.
• Sign-in log: for as long as you have an account, and no longer than 12 months from the given sign-in.
• Accounting records and the data needed to issue them (with us and with Stripe): 5 years from the end of the tax year in which the tax obligation arose - as required by law.
• Database backups: deleted data disappears from backups within 30 days at most.
• Correspondence: up to 3 years after the matter is closed, for the purpose of potential claims.
• Analytics cookies: as described in section 7, 24 months at most.

Under the GDPR you have the right to:

• access your data and obtain a copy,
• have inaccurate data corrected,
• erasure (“right to be forgotten”) - you can delete your account yourself in Settings,
• restriction of processing,
• data portability - listings can be exported to CSV in the Panel; we will provide the rest on request in a machine-readable format,
• object to processing based on our legitimate interest, including product analytics,
• withdraw consent at any time (applies to analytics cookies),
• lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

Send requests to contact@vintly.pl from the email address linked to your account. We respond without undue delay and within 30 days at the latest. Providing data is voluntary, but without a Google account and billing data we cannot provide the Service.

vintly.pl uses the following cookies and similar technologies:

Analytics cookies run after your consent, which you can change or withdraw in the cookie settings on the website. You can also block cookies in your browser, use the Google Analytics Opt-out add-on or send a Global Privacy Control signal - we honour it.

The Extension sets no cookies. It keeps only your settings, reply templates, licence token and the state of running operations in browser storage (chrome.storage) - this data stays on your device unless synced as described in section 2.

• Essential: the sign-in session cookie (Auth.js) and the cookie remembering your language choice (vintly_language). The Panel does not work without them; they do not require consent.
• Analytics - Google Analytics 4: visit statistics, traffic sources, approximate location. GA4 does not log full IP addresses. _ga cookies up to 24 months.
• Analytics - PostHog: interactions with the website and Panel interface, linked to your account once signed in, so we understand which features are used and where problems occur.

The Extension runs only on Vinted domains (vinted.pl, .fr, .de, .co.uk, .es, .it, .nl, .be) and connects to vintly.pl. On Vinted it performs only the actions you request (bump, edit, send a reply, load your listings and orders), inside your own already signed-in session.

In line with the Chrome Web Store User Data Policy, data obtained through the Extension is used solely to provide and improve the features described in this policy. We do not sell it, transfer it for advertising or creditworthiness purposes, or use it beyond that scope.

Automation of actions on Vinted happens at your request and at your own responsibility. Vintly does not guarantee that such automation complies with Vinted’s current terms and is not liable for Vinted’s decisions concerning your account.

All communication is encrypted (TLS). Sign-in uses Google OAuth - we store no passwords. The Extension licence is a cryptographically signed token verified locally by the Extension. Only the people maintaining the Service can access the database, and production data is stored in the European Union.

In the event of a personal data breach likely to affect your rights or freedoms, we will notify you and the supervisory authority in accordance with Articles 33-34 GDPR.

The Service is intended for adults selling on Vinted. It is not directed at anyone under 16 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

We update this policy when the Service or the law changes. We will announce material changes in the Panel or by email at least 14 days before they take effect. The current version is always available at vintly.pl/privacy with the date of the last update.

Controller: Trynityflow, NIP 6292516830. For anything concerning personal data - including exercising the rights in section 6 - write to us:

contact@vintly.pl