[RESELIX legal entity name], [registered address], is the controller of the personal data described here. Contact: workemail4977@gmail.com. [ICO registration number to be added.]
What we collect
- Account: your email address and password (stored only as a secure hash by our login provider), when you confirmed your age, and which version of these documents you accepted and when. If you sign in with Google, Google tells us your email address and name; we don't get your Google password.
- Security: to stop password guessing and spam, we count attempts per IP address and per account for a short time. We store these as one-way codes, not the IP address itself, and delete them within a day. When you choose a password, we check it against a public list of passwords leaked in other companies' data breaches: only the first 5 characters of a one-way code of the password are sent (to Have I Been Pwned), never the password.
- Corrections: when you approve an item, what the AI suggested for each detail (category, brand, size, condition, price) and what you confirmed, so Reselix can get more accurate for you. It's tied to your account and deleted with it.
- Photos and listings: the photos you upload (these can show you, other people or the inside of your home, so please take care what's in shot), and what the AI and you write about each item.
- Your marketplace shop (only when you press Refresh Vinted): your marketplace username and account number, and for your own items their title, brand, price, status, views and favourites, the date each was listed (from when its photos were uploaded), and a daily record of each item's views and favourites kept for 60 days (for the daily audit); for your own sales the item title, sale price, order status and date. We do not collect buyers' names, messages, addresses or photos.
- Your eBay connection (only if you press Connect eBay): your eBay user ID and username, and the permission eBay gives us to act for you through its official API, stored encrypted. You approve it on eBay's own page; we never see your eBay password. It is deleted when you disconnect, or when eBay tells us your eBay account was deleted.
- Your Depop shop (only when you press Refresh Depop): your Depop account number and username, and for your own items the first line of their description, price, status, likes and listing date; for your own Depop sales the item, item price, sale status and date, and how many orders are waiting to ship. It is read in your own logged-in Depop tab using Depop's sign-in there, which stays in your browser and is never sent to us. We do not collect buyers' names, addresses, messages or tracking details.
- Usage: which features you used and how much (for plan limits and our costs), and basic security logs.
- Payments: handled by Stripe. We never see or store your card number.
- In your browser: the extension keeps a short activity log, its queue and settings in Chrome's storage on your computer.
We never ask for or store your marketplace passwords.
Cookies and similar storage
The RESELIX website only stores what it needs to work or to remember a choice you made. We use no advertising or analytics cookies and load no tracking from other companies; if that ever changes, we'll ask you first.
- Login (sb-…): keeps you logged in and secures sign-in. Up to 400 days, or until you log out.
- ebay_oauth: a security check while you connect eBay. 10 minutes.
- reselix_checkout_pending: tells us a payment you started is still being confirmed. 30 minutes.
- reselix_autodraft_on: shows the "Automatic drafts are on" notice once after you log in. 12 hours.
- reselix_setup_later, reselix_autodraft_offer_dismissed: remember that you chose "Not now". 1 year.
- In your browser's local storage: whether you've seen the tour, the photo guide and the extension prompt, and your listing settings (listing mode, clean background, description style).
The reselix_ cookies and the tour record hold your account number, so they are linked to your account; they are only used to show or hide a prompt for you on this browser. The extension's own storage is described above. Stripe's payment pages, Google's sign-in screen and eBay's connect page set their own cookies under their own policies.
Why we use it (lawful basis)
- To provide RESELIX to you under our contract: identifying items, writing listings, filling marketplace forms, analytics, billing.
- Our legitimate interests: keeping RESELIX secure, preventing abuse, and understanding our costs.
- Legal obligations: keeping payment and tax records.
Keeping a record that you agreed
When you delete your account we keep a minimal coded (pseudonymised) record: a one-way code made from your account number (not your name or email), which versions of our documents you accepted and when, when you confirmed your age, and when the account was deleted. We keep it in case of a legal claim (our legitimate interest). [Retention period to be confirmed by the solicitor.]
Who we share it with
Only service providers that process data for us ("processors"), and only what each needs:
- Supabase: database, file storage and login (servers in London).
- Google: "Continue with Google" sign-in, if you choose it.
- Have I Been Pwned (via Cloudflare): the breached-password check (receives only part of a one-way code, never your password).
- Vercel: website hosting.
- Stripe: payments and subscriptions.
- Google (Gemini API): identifying items from your photos and some text tasks.
- Ollama: writing listing text, and a backup for identifying items.
- NVIDIA: a backup for writing listing text.
- Replicate: removing photo backgrounds when you ask for it.
- eBay: connecting your eBay account and, when you choose, listing through eBay's official API.
Some of these providers are based in, or process data in, the United States. Where data leaves the UK we rely on the safeguards UK law allows (such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum). [Each provider's safeguard and its terms on whether your data may be used to train AI models to be confirmed before launch.]
We don't sell your data, and we don't use it for advertising.
How long we keep it
- Your account, photos, listings and shop numbers: until you delete them or delete your account. [Automatic clean-up periods to be confirmed.]
- Payment records: kept by Stripe for as long as the law requires (usually 6 years).
- When you delete your account we delete your data straight away; copies in our providers' backups are removed on their normal backup cycle.
- Photos and text already sent to an AI or image provider (listed above) are kept or deleted under that provider's own rules. [Each provider's retention to be confirmed before launch.]
Your rights
You can ask to see, correct, delete or take a copy of your data, object to or restrict how we use it. You can delete your account yourself in Settings. For anything else, email workemail4977@gmail.com; we'll reply within one month. If you're unhappy, you can complain to the Information Commissioner's Office (ico.org.uk).
Age
RESELIX is for people aged 16 and over. If we learn that someone under 16 has an account, we'll delete it.
Changes
If we change this policy, we'll tell you in RESELIX the next time you use it, with a link to the new version.