Privacy policy

[DO WERYFIKACJI PRZEZ PRAWNIKA]

Privacy Policy

Version 1.0. The Polish version is binding.

1. Controller

The controller of personal data is Mighty Little Steps sp. z o.o. (registration details in the footer of the Service). Contact for data matters: the contact point e-mail address in the footer.

2. What data we process

• account data: e-mail address, password (as a hash), handle, display name, country, city, bio, social media links, language and currency;
• seller verification data: description, links, call notes (visible to the Operator only);
• content: listings, photos (with metadata, including location, removed), messages, ratings, reports, appeals;
• transaction data: declarations to buy, offers, statuses, dates;
• technical data: IP address and device identifier in hashed form (abuse prevention), error logs;
• consents: version and date of accepting the documents.

3. Purposes and legal bases

• running the account and the Service – performance of the contract;
• verifying sellers, preventing fraud, moderation and handling reports – the Operator's legitimate interest and legal obligations (including the Digital Services Act);
• transactional notifications – performance of the contract; other notifications – consent given in the settings;
• automatic translations and the listing assistant – performance of the contract; content passed to the AI provider is limited to listing descriptions and photos;
• establishing and defending claims – legitimate interest.

4. Recipients

Data is processed on our behalf by providers of: database and authentication, hosting, e-mail, error monitoring and AI models. Data is stored in the European Union (Frankfurt region); providers outside the EU act under standard contractual clauses. Data may be disclosed to authorities where the law requires it.

5. Retention

• account: until deletion; after deletion the profile is anonymised and data needed to settle transactions and defend claims is kept for 6 years;
• moderation logs and decisions: 6 years;
• reports and appeals: 3 years after closing;
• technical data: 12 months.

6. Your rights

You have the right of access, rectification, erasure, restriction, portability (a JSON export is available in the account settings), objection and to lodge a complaint with the Polish supervisory authority (UODO).

7. Automated decisions

Restricting an account after the strike threshold is exceeded is an automated decision. The user is informed and may appeal to a human.

8. Changes

Changes to this Policy are published in the Service with a version number and a date.

[DO WERYFIKACJI PRZEZ PRAWNIKA]