Privacy Policy

1. Who we are

Vintlyze is an independent tool for Vinted sellers, operated from Poland. We are not affiliated with, endorsed, sponsored, or officially connected to Vinted UAB in any way. „Vinted” is a trademark of Vinted UAB; we use it only to describe what our service is compatible with.

For anything you do directly on vinted.com or any local Vinted domain (browsing, messaging, listing, selling), Vinted UAB is a separate, independent data controller — its own privacy policy applies to that processing, not this one.

2. Legal basis for processing

Account, sales-sync, and billing data: processed to perform the contract with you (Art. 6(1)(b) GDPR) — i.e. to provide the dashboard, extension sync, and subscription you signed up for.

Security-related technical data (session cookie, abuse/rate-limit prevention): processed on the basis of our legitimate interest in keeping the service secure and available (Art. 6(1)(f) GDPR).

Optional cookies (Google Analytics — see the Cookies page for the full list): only processed based on your explicit consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

3. What data we collect

Account data: email address, name (if provided or received from Google sign-in), a hashed password (we never store your plain-text password), and a randomly generated sync key used to connect the extension to your dashboard.

Sales data synced from Vinted: item title, price, currency, sale/completion/wallet-credit dates, transaction status, the internal Vinted conversation/item identifiers, and the Vinted domain (e.g. vinted.pl, vinted.it) — only for items you sold, as returned by Vinted's own order history for your logged-in session.

Billing data: if you subscribe, Stripe processes your payment and shares with us only your subscription status and renewal date — we never see or store your card details.

Basic technical/cookie data: see the dedicated Cookies page for the full list, purpose, and retention period of every cookie we set.

4. What the Chrome extension does — and does not — access

The extension reuses your existing, already logged-in browser session on Vinted to call the same order-history endpoints your browser already has access to. It never asks for, sees, or stores your Vinted password.

It only reads your own sold-items list and the minimal per-order details needed to determine the transaction status (see the README section “Skąd biorą się daty i status transakcji” for full technical detail). It does not read your messages, buyer/personal data of other users, or any other part of your Vinted account.

The extension only sends data to our servers while you are logged in to our dashboard (via your sync key) and only while your subscription is active.

5. How we use your data

To generate your monthly sales statement, show it on the dashboard and in the extension popup, and let you choose which date counts (sale, completion, or wallet credit).

To operate your account (login, sync key, subscription status) and to communicate essential service notices.

We do not sell your data, and we do not use it for advertising or profiling.

6. Third-party processors

Stripe (payments): processes subscription payments and billing under a data-processing agreement. See Stripe's privacy policy at stripe.com/privacy.

Google (optional sign-in): if you choose „Continue with Google”, Google shares your email/name with us to create or log in to your account. See Google's privacy policy at policies.google.com/privacy.

We do not share your data with Vinted UAB, and Vinted does not share your data with us — the extension only reads data your own browser session already has access to, on your device.

7. Data retention and deletion

We keep your account and synced sales data for as long as your account exists. You can regenerate your sync key at any time on the dashboard, which immediately invalidates the old one.

You can permanently delete your account and all associated data yourself, at any time, from the Account page (Danger zone). If you'd rather email us instead, contact us at the address below — we will delete it within 30 days.

8. Security

Passwords are hashed (bcrypt) and never stored in plain text. Sessions are managed server-side. We recommend using a strong, unique password and enabling 2-factor authentication on your Google account if you sign in that way.

9. Your rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Contact us at the email below to exercise any of these rights — we will respond within one month.

If you are in the EU/EEA, you also have the right to lodge a complaint with your local data-protection supervisory authority. In Poland, that is the President of the Personal Data Protection Office (UODO), uodo.gov.pl.

10. Cookies

For the full list of cookies we set, their purpose, and how long each is kept, see our dedicated Cookies page. You can change your cookie choice at any time from the “Cookie settings” link in the footer.

11. Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected on this page with an updated date at the top.

12. Contact

Questions about this policy or your data? Email us at kontakt@vintlyze.com.