Privacy Policy

1. What this policy covers

This Privacy Policy describes what information Find & Resell (the "Service") collects when you create an account and use it, why we collect it, and how it's handled. It applies to the website, dashboard, and Telegram bot together — there is no separate policy for each. See our Terms & Conditions for the rules of using the Service itself.

2. Account data

When you register, we store your email address and — unless you sign in with Google — a password. If you connect a Google account instead, we store the Google account identifier and email address Google provides; we never see or store your Google password. We also store your chosen plan, subscription status, and the scan settings you configure (budget, searches, scan interval, market/currency).

3. Passwords and credentials

Passwords are never stored in plain text. Each password is run through a one-way hashing algorithm before it's saved, so even we cannot read your actual password back out of the database. Login sessions use a signed browser cookie; changing your password invalidates any other session signed in under the old password.

4. Billing and subscription data

Subscription payments are processed entirely by Stripe, our payment processor — we never see or store your full card number, expiry date, or CVC. We store only what Stripe tells us about the result: your Stripe customer and subscription identifiers, your plan, and your subscription status (active, past-due, canceled). Managing your payment method, invoices, and cancellation happens on Stripe's own hosted Billing Portal, governed by Stripe's own privacy policy.

5. Telegram integration

If you link a Telegram account to receive deal alerts, we store your Telegram chat id — the identifier Telegram gives us to send you messages, not your phone number or Telegram username. Deal alerts, status replies, and any commands you send the bot are exchanged through Telegram's own platform, governed by Telegram's own privacy policy.

6. Marketplace data

To find and evaluate deals, the Service reads publicly visible Vinted listing data — the same information any visitor could see browsing Vinted directly. This does not include any private data about you as a Vinted user; the Service does not log into Vinted on your behalf or access your personal Vinted account.

7. Logging and operational data

Like most web services, our servers keep operational logs (request timestamps, error details, IP addresses) to keep the Service running reliably, diagnose problems, and protect against abuse — for example, the rate limiting that protects login and checkout from automated abuse. These logs are not used to build an advertising profile of you and are not sold or shared with advertisers.

8. Cookies and sessions

The Service uses a single, essential session cookie to keep you signed in and to protect forms against cross-site request forgery — nothing else. We do not use advertising or cross-site tracking cookies. The session cookie is HttpOnly (not readable by page scripts), marked Secure in production (sent only over HTTPS), and expires automatically after a period of inactivity.

9. Data retention

We keep your account, scan settings, and billing records for as long as your account is active, so the Service keeps working and so we can answer billing questions about past charges. If you'd like your account and associated data deleted, contact us at support@findresell.com and we will act on that request, subject to any billing/tax records we're legally required to keep.

10. Your rights

You can review and update most of your own account data (email, password, scan settings) directly from your dashboard and account page at any time. For anything you can't change yourself — including a request to access, correct, export, or delete your data — contact us at support@findresell.com.

11. Third-party services

The Service relies on three third parties to operate: Vinted (public marketplace data, Section 6), Stripe (payment processing, Section 4), and Telegram (alert delivery, Section 5). Each processes the specific data described above under its own privacy policy; we do not share your data with any other third party, and we do not sell your data to anyone.

12. Security practices

Passwords are hashed, not stored in plain text (Section 3); each tenant's own inventory and scan data lives in its own isolated database file, structurally separate from every other tenant's; administrative access to the operator surface requires a separate login with no hardcoded credential; and forms are protected against cross-site request forgery. No system is perfectly secure, but these are deliberate, structural choices, not an afterthought.

13. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect a new feature or a new third-party service. We will post the updated policy on this page with a new "Last updated" date; for a material change in how we handle your data, we will make reasonable efforts to notify active subscribers (by email or Telegram) before it takes effect.

14. Contact

Questions about this Privacy Policy or your data can be sent to support@findresell.com — or see our Contact page. This Service is operated by [legal entity name — to be added before legal launch], and this policy is governed by the laws of [governing law/jurisdiction — to be added before legal launch].