Privacy Policy

1. Data we process

• Account data (sellers): email address and account details. Login is via magic link — we store no passwords.
• Buyer data: name (optional), the email address entered when placing an order, and the payment receipt the buyer forwards to a per-order address.
• Forwarded receipts: the email content, headers and authentication results (e.g. DKIM) needed to verify a payment.
• Payment data: none. We never process or store card numbers, bank credentials or wallet logins, and no buyer funds pass through us. Our own subscription fees are billed by Stripe — your payment details for the subscription go directly to Stripe and never reach our servers.
• Technical data: IP addresses, timestamps and logs required for security and abuse prevention.

2. Why we process it (legal bases)

• Contract performance (Art. 6(1)(b) GDPR): verifying payments and unlocking content.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, velocity limits, blocklists, service security.
• Legal obligations (Art. 6(1)(c)): records we must keep by law.

3. Automated analysis of forwarded emails

Forwarded payment receipts are analyzed automatically, including by AI models, to extract amount, currency and recipient. Account-security emails (password resets, verification codes) are detected and discarded before storage — their content is never kept and never sent to AI systems.

4. Processors and transfers

We use hosting, database, email, AI inference and subscription-billing providers (e.g. Stripe) as processors under Art. 28 GDPR. Where processing occurs outside the EEA, we rely on adequacy decisions or standard contractual clauses. A current list of processors is available on request.

5. Retention

Order and verification records are kept as long as the seller’s account exists or as required by law. Discarded sensitive emails are never stored. You can request deletion of buyer data associated with your orders once legal retention periods expire.

6. Your rights

You have the right to access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with a supervisory authority. Contact us via the address in the Imprint.

7. Cookies

We use only functional cookies: session authentication and your language preference. No tracking or advertising cookies.