Privacy policy

Martin Dehlan, Am Breiten Luch 46, 13053 Berlin, Germany. Email: support@prooved.xyz

• Account data: email address, slug, optional name. Legal basis: Art. 6 (1) (b) GDPR (contract performance).
• Platform connections: platform user ID, profile URL, verification tokens (AES-256 encrypted), cached public rating stats (score, count).
• Wallet data (optional): Solana public key, cryptographic signature. Only if you use wallet features.
• Reports: IP address, timestamp, reason. For spam and abuse prevention (Art. 6 (1) (f) GDPR).
• Server logs: IP address, user agent, timestamp via our host (Vercel). Retention max. 30 days.

• Vercel Inc. (USA) — hosting, CDN, logs. Standard Contractual Clauses (SCC) and EU-US Data Privacy Framework.
• Supabase Inc. (USA, EU region available) — database, authentication, edge functions.
• Resend — delivery of magic-link and system emails.
• PostHog (EU Cloud, Frankfurt) — product analytics and session replay to improve the service. Cookieless mode (in-memory persistence only), no third-party cookies. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in product improvement and error analysis).
• Third-party platform APIs (eBay, PayPal, Vinted, Kleinanzeigen, Discogs): transmission only at your initiation as part of verification. The privacy terms of the respective platform apply.

For OAuth flows (eBay, PayPal), access tokens are stored AES-256 encrypted. We access only public rating endpoints — no transaction data, no purchases, no messages.

For bio-code flows (Vinted, Kleinanzeigen), our server checks your public profile text once and discards the code afterwards. No platform login data is stored.

We use technically necessary cookies for authentication (Supabase session) and a local theme setting (dark/light). No tracking or advertising cookies.

Our analytics service PostHog runs in cookieless mode (in-memory persistence during the current browser session only) and sets neither cookies nor local-storage entries. No recognition across sessions.

Privacy.s6Text

• Account data: until you delete your account
• Connections: until disconnected or account deleted
• Server logs: max. 30 days
• Reports: 12 months (for abuse prevention)

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Right to lodge a complaint with the competent supervisory authority: Berlin Commissioner for Data Protection.

You can delete your account anytime under Settings. For data export or other requests, write to support@prooved.xyz.

If you mint Soulbound Tokens (SBTs), they are stored irreversibly and publicly on the Solana blockchain. Deletion by us is technically not possible. This feature is optional and requires your explicit consent.

This policy may be updated. The current version is always available at this URL.