Privacy notice

Controller and scope

The PADVORN operator is the controller for platform data; see Operator & contact. Its actual legal identity and contact details remain outstanding. This notice describes the deployed beta and does not cure that missing information. New registration is paused. You can still submit a privacy request without an account.

We receive data you submit, account/authentication events, messages and reports involving you, and technical requests sent by your device. Do not submit sensitive personal data, identity documents or full payment-card details through community content or forms.

Data, purpose and legal basis

Account email, password authentication, public handle/profile, listings/photos, saved items, discussions and private messages support the service you request (GDPR Article 6(1)(b), where necessary to the service agreement). Public profile fields, listings and discussions are visible to visitors and may be copied or indexed. Your email and private chats are not public. Chats are not end-to-end encrypted.

Access checks, abuse prevention, report investigation and limited security logs serve the legitimate interests of keeping the service safe and defending legal claims (Article 6(1)(f)); these interests must be balanced against your rights. Reports, reasoned moderation records and rights requests also support applicable statutory duties (Article 6(1)(c)). Not every moderation record is automatically a legal obligation; only retain what the relevant purpose requires.

Optional profile fields are not required. Essential account fields are needed for membership; without them the account service cannot operate. No advertising, marketing email, sale of personal data or solely automated decision with legal or similarly significant effects is implemented. Category suggestions are editable keywords, not an automated decision about you.

Recipients and international processing

Supabase provides authentication, database and private media storage; this project’s database is in Frankfurt. Cloudflare hosts this deployment, edge delivery, server functions and upload-image transformation. Netlify remains available as the previous deployment during migration. Hosting, support and subprocessors may process data outside the EEA, including the US; choosing an EU database does not mean all processing stays in Europe.

Authorised operators may access necessary records for support, security and lawful requests. Other members see public content and their own conversations. Reporters’ identity is not routinely shared with the reported person. Competent authorities may receive data where legally required.

The operator must verify its Article 28 processor arrangements, applicable transfer mechanisms (such as contractual safeguards or adequacy where applicable) and any supplementary measures before opening registration. Provider documents are linked below; we do not claim that an unsigned agreement or unverified transfer assessment is complete. Request information or a copy of applicable safeguards through Contact. Stripe, Omniva and Resend integration code is present but is not configured for live transactions or public email delivery.

Storage and retention

Account and member content are kept while needed to provide the account and discussions. Deletion requests require a necessity review: remove or anonymise identifying data no longer needed; retain only specifically necessary records for unresolved matters, legal duties or claims. A request is not automatically refused because you once traded. You must be told the reasons and applicable criteria for any retention.

Contact/report tickets and response history have a chosen maximum of one year after closure unless a specific legal hold is documented; pending requests remain only while necessary to resolve them. Hashed daily network rate-limit identifiers expire after 25 hours. A restricted cleanup function is implemented; daily operation and wider account/media/log/backup deletion procedures still require a staffed operator. These are retention rules, not a claim that a deletion worker is already running.

Device chat drafts persist until sent, cleared, sign-out/account change or you clear browser data. Essential authentication storage follows your session and the authentication provider’s expiry/refresh process. Provider security logs and backups have provider-controlled periods which the operator must confirm; no invented universal backup expiry is promised.

Your choices and rights

Edit public profile fields in Settings, take listings offline, export account records, or request deletion. The self-service export covers selected account records; it does not replace a full access request, including information about purposes, recipients, sources or retained operator records.

Use Contact → Privacy request for access, rectification, erasure, restriction, portability where applicable, objection to legitimate-interest processing, or a question about safeguards. You need not accept new terms or sign in to exercise rights. Requests are normally free. Identity evidence is requested only where reasonably necessary; do not send an identity document with your initial request.

GDPR requests require a response within one month; where legally justified, up to two additional months may be used with reasons and notice within the first month. This is a legal deadline, not a guarantee that an unstaffed queue will meet it. Save your ticket reference and key; public email acknowledgements are not connected. You can complain directly to Lithuania’s VDAI (vdai.lrv.lt) or your competent supervisory authority and seek a judicial remedy.