1. Data controller
The controller of the data collected on this site is [RAZÓN SOCIAL], with tax ID [NIF] and registered address at [DOMICILIO].
For any question about your personal data you can write to support@visted.es. The dedicated privacy mailbox is [CORREO DE PRIVACIDAD].
2. Data we process
Account data
Email address and password. The password is stored as a bcrypt hash: it is never stored in plain text and the team cannot recover it. We also store your email verification status and your active subscription plan.
Your Vinted account data
Username, account country and session credentials (Vinted session cookies). These credentials are encrypted with AES-256-GCM before being stored, and you can revoke them at any time by disconnecting the account from the dashboard. Visted does not store your Vinted password: it works with the session the Chrome extension captures once you have signed in to Vinted.
Operational data
Listings, orders, messages, offers and statistics the application synchronises from your Vinted account in order to provide the service: managing inventory, scheduling relists, replying to messages and generating reports.
Billing data
Payments are processed by Stripe. Visted receives the customer identifier, the subscription status and the amounts billed, but does not store card numbers or security codes.
Technical data
IP address, user agent and error logs, to the extent the server needs them to serve requests, rate-limit abuse and diagnose failures. The public site carries no third-party analytics and no advertising pixels; the detail of our own cookies is in the cookie policy.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Creating your account, authenticating you and delivering the service you subscribed to | Performance of a contract — Art. 6(1)(b) |
| Syncing your Vinted account and running the actions you schedule | Performance of a contract — Art. 6(1)(b) |
| Managing the subscription, charges and invoicing | Performance of a contract and legal obligation — Art. 6(1)(b) and 6(1)(c) |
| Verifying your email and sending operational notices (for example a plan change) | Performance of a contract and legitimate interest in account security — Art. 6(1)(b) and 6(1)(f) |
| Preventing abuse, rate-limiting requests and diagnosing errors | Legitimate interest — Art. 6(1)(f) |
| Optional marketing communications, where offered | Consent — Art. 6(1)(a) |
We do not make automated decisions with legal effects on you and we do not build advertising profiles. The product's AI features generate text from data you supply; the result is shown to you and is not used to profile you.
4. Retention periods
- Active account: data is kept for as long as the account exists and the service is in use.
- Account deletion: when you request deletion from the dashboard, the account is deactivated and the subscription is cancelled. The deactivated account is no longer operational and its data is not used for any other purpose. For definitive erasure, write to the contact address stating that you have already deactivated the account.
- Automation tasks: completed or cancelled tasks are deleted automatically after 30 days.
- Email verification: the verification link expires after 24 hours.
- Billing: accounting and tax records are kept for the period Spanish tax law requires (generally four years, and six for relevant company records).
- Session: the website session token expires after 7 days.
5. Processors and recipients
We use the following providers to deliver the service. They act as processors and receive only the data their function requires:
- Stripe — payment processing and subscription management. Receives your email address and payment details.
- SendGrid (via SMTP) — transactional email: account verification, operational notices and, where applicable, invoices.
- Google — if you choose to sign in with Google, we receive your email address and account identifier from Google. Google Sheets is used only if you connect that integration voluntarily.
- OpenAI and Anthropic — text generation for the AI features you use (listing descriptions and suggested replies). They receive the data you enter into that feature.
- remove.bg — background removal, only when you use that feature. It receives the image you upload.
- Cloudflare Turnstile — bot protection on registration and sign-in. It receives the technical information the widget needs to issue the verification token; it is not used for advertising or to profile you.
- Infrastructure provider — hosting of the server, database and job queue (Redis), with restricted technical access.
We do not sell personal data or transfer it to third parties for advertising. We do not share your information with Vinted beyond the actions you run from the application: Vinted receives those actions because it is their destination.
6. International transfers
Some of the providers above are established outside the European Economic Area, mainly in the United States. Where an international transfer takes place, it relies on an adequacy decision of the European Commission or on the standard contractual clauses approved by the Commission, together with the supplementary measures each provider applies.
[DETALLE DE TRANSFERENCIAS Y GARANTÍAS]
7. Your rights
As a data subject you may exercise the following rights at any time:
- Access: know what data of yours we process and obtain a copy.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data when it is no longer necessary.
- Restriction: ask us to suspend processing while a complaint is resolved.
- Portability: receive your data in a structured, commonly used format and transmit it to another controller.
- Objection: object to processing based on legitimate interest.
- Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.
To exercise them, write to support@visted.es stating the right you wish to exercise. We will reply within one month, extendable to two where the request is complex. We may ask you to prove your identity before acting.
Some rights have limits: for example, we cannot delete billing records while the law requires us to keep them.
8. Complaint to the AEPD
If you believe we have not handled your rights correctly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), the competent supervisory authority in Spain:
- Electronic office: sedeagpd.gob.es
- Postal address: Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, Spain.
You may also contact the supervisory authority of your country of residence if it is another EU Member State.
9. Security
Passwords are stored as bcrypt hashes. Vinted session credentials are encrypted with AES-256-GCM before being stored. Traffic between the website, the API and your browser uses HTTPS. Database access is restricted to the server's internal network. No system is infallible: if a security breach occurred that posed a risk to your rights, we would notify the supervisory authority and the affected users in accordance with Article 34 GDPR.
10. Changes to this policy
We may update this policy to reflect changes in the service or in the law. Material changes will be communicated with reasonable notice by email or through a notice on the site. The last updated date appears at the top of the page.
11. Contact
For any question about this policy or about how your data is processed, write to support@visted.es.