This is a translation provided for convenience. The French version is the only legally binding one. Version française

Privacy Policy

This policy describes how Vintapp (published by Ayoub Barkia) collects, uses and protects your personal data, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

1. Data controller

Controller

Ayoub Barkia, sole proprietor (auto-entrepreneur)

Address

Address provided upon request to the email address below

Contact

support@vintapp.online

2. Data collected

A. Account data

• Account identifier: generated automatically the first time you open the app, without any email address being requested. It is used to link your listings, your quota and your subscription to your account.
• Email and password, if your account has them: used for authentication. The password is never stored in plain text (our authentication provider keeps only a one-way hash of it). If you sign in with Google: the name and profile photo passed on during that sign-in.
• Billing information: we do not collect any. Subscriptions are sold and billed by Apple; we receive only a subscription confirmation, with no payment identifier or bank details.

B. Data generated by your activity

• Scanned photos: images you send for analysis. Transmitted to a third-party AI service for analysis, writing the listing and generating the pro photos, then stored on our server in France so that you can reopen your listings in the app.
• AI-generated listings: title, description, brand, size, condition, suggested price. Stored for reopening / deletion.
• Generated pro photos: images produced by a third-party AI service from your photo, stored on our server.
• Custom model (optional feature): if you create a model in your own likeness, the reference photo you provide is transmitted to a third-party AI service to produce figures that retain your features. These figures are stored on our server and reused on your subsequent listings. You can erase them at any time from the Model tab, without deleting your account; erasure is immediate and permanent.
• Scan quota and subscription history: to display the number of scans remaining in the current month and the status of your subscription.
• IP address: used temporarily for rate limiting (protection against abuse).

C. Cookies and local storage

• Sign-in token: authentication token stored on the client side (localStorage on the web, Keychain on iOS). Lifetime: 1 hour (automatic refresh). Strictly necessary for use of the service.
• Cookies: the app sets none, and the vintapp.online website uses no audience measurement cookies. The website counts its visits from our server's logs, as aggregated statistics (page views, referral source, device type, clicks to the App Store), with no cookie or measurement script.

D. Ad campaign measurement (iOS app)

• Campaign measurement: to learn which ads bring in users, the app sends our measurement tool the device identifier Apple assigns to our apps (IDFV), an identifier assigned by this tool, your account identifier (a pseudonym), your IP address (from which the country is derived), the device model and iOS version, and a few events: install, app opens, sign-up, display of the subscription page, listing generated, listing prefilled, start of a purchase, purchases (product, amount, currency and Apple transaction identifier, which the measurement tool may verify with Apple). Without your consent, this measurement is done without Apple's advertising identifier (IDFA).
• With your consent (IDFA): the app asks you in Apple's tracking prompt, preceded by a screen of the app that explains what this consent allows. If you allow tracking, it also sends your iPhone's advertising identifier (IDFA), which our measurement tool shares with TikTok to link your install and purchases to the TikTok ad that led to them. In the European Union, the EEA, the United Kingdom and Switzerland, your answer to this prompt is also what the app passes on to our measurement tool as your consent under the GDPR: allowing tracking counts as consent, declining it as refusal. You can withdraw this consent at any time: Settings → Privacy & Security → Tracking on the iPhone, or Account → Privacy in the app, which turns off all campaign measurement.
• Sharing with TikTok: to measure and optimise our campaigns on TikTok, our measurement tool passes installs and these events on to TikTok, with the IDFA only if you have given your consent. Versions of the app earlier than 1.2.0 include TikTok's kit (TikTok Business SDK), which sends this information directly to TikTok.
• Renewals and refunds: only Apple and our server know about them. To measure them too, our server sends them to our measurement tool with the identifier this tool assigned to your install, your account identifier, the IDFV, your answer to Apple's prompt and, only if you have accepted tracking, your last IP address.
• You can object to campaign measurement at any time in the app: Account → Privacy → Ad campaign measurement. Once switched off, the app sends nothing more to the measurement tool, and our server deletes the install linked to your account and no longer sends it anything either.

3. Purposes and legal bases

• Providing the service (account, AI scans, pro photos, quota): performance of the contract (Art. 6(1)(b) GDPR).
• Processing your payment: performance of the contract + legal accounting obligation (Art. 6(1)(b) and 6(1)(c) GDPR).
• Preventing fraud and abuse: legitimate interest (Art. 6(1)(f) GDPR).
• Measuring the effectiveness of our ad campaigns (our measurement tool, TikTok), without the IDFA: legitimate interest (Art. 6(1)(f) GDPR) in knowing which ads bring in users, with a right to object in the app (see 2.D).
• Linking your install to the TikTok ad that led to it with the IDFA: your consent (Art. 6(1)(a) GDPR), given in Apple's tracking prompt, which you can withdraw at any time (see 2.D).
• Counting website visits (aggregated statistics from the server logs): legitimate interest (Art. 6(1)(f) GDPR).

4. Retention periods

• Active account: for the entire period of use. Deletion upon a GDPR request or via Account → Delete my account in the app (immediate erasure).
• Generated photos and listings: until you delete them yourself from "My listings".
• Accounting records relating to subscriptions and top-ups: 10 years (French accounting obligation). They come from Apple payment statements, contain no banking data, and are retained even after the account is deleted — they are also used to process an Apple refund issued after the deletion and to prevent the same purchase from being counted twice. These entries retain your account ID, without which they could be linked neither to the purchase nor to the refund.
• Record of scans used from a top-up (scan ID, date, account ID): same duration and same legal basis. The balance of a top-up is not a stored counter; it is derived from purchases minus usage: keeping the former without the latter would make scans already spent reappear and would prevent a partial refund from being processed. These entries contain no photo, no listing and no content you have produced.
• Record of the free listing: deleting the account erases the link to your identity, but retains a technical device identifier — depending on the case, an identifier taken from the device's keychain or a push notification token — without which it would be enough to delete and then re-create an account to receive free listings indefinitely. Legal basis: legitimate interest in preventing abuse (Art. 6(1)(f) GDPR); retention permitted under Article 17(3)(e).
• Access logs: 6 months maximum.
• Campaign measurement data: kept by our measurement tool and by TikTok for the periods set out in their own policies. On our server, the install linked to your account is deleted when you object (see 2.D) or delete your account.

5. Data recipients

Your data is processed by the publisher. Some of it is transmitted to the following processors, which are strictly necessary for the service to operate:

• Our authentication provider (European Union): accounts and authentication.
• Third-party AI services (United States): photo analysis, writing listings and estimates, generating the pro photos and the custom model. Transfers governed by the European Union Standard Contractual Clauses.
• Apple (App Store, United States / Ireland): sale, billing and management of subscriptions. Apple is the seller; we receive no payment data.
• Our hosting providers: application servers, email and backups.

For ad campaign measurement, which is not necessary for the service to operate:

• Our campaign measurement tool (Israel, a country covered by an adequacy decision of the European Commission).
• TikTok (TikTok for Business): measuring and optimising our campaigns on TikTok.

No data is sold. Apart from the campaign measurement described in 2.D, no data is disclosed to third parties for commercial purposes. In particular, no data is transmitted to Vinted UAB.

6. Your rights

Under the GDPR, you have the following rights:

• Access: obtain a copy of your data.
• Rectification: correct inaccurate data.
• Erasure ("right to be forgotten"): delete your data.
• Portability: retrieve your data in a structured format.
• Objection: object to the processing — for campaign measurement, directly in the app (Account → Privacy).
• Withdrawal of consent at any time (ad tracking: Settings → Privacy & Security → Tracking on the iPhone; notifications: Settings → Notifications → Vintapp).

To exercise these rights, write to support@vintapp.online, describing your account (its email address, if it has one). Response within 30 days.

You may also lodge a complaint with the CNIL: cnil.fr/fr/plaintes.

7. Security

We implement appropriate technical and organizational measures: TLS encryption, rate limiting, daily backups, restricted access to databases.

8. Public data from Vinted

Our service aggregates data publicly accessible on Vinted (titles, prices, photos). This data may include seller identifiers (public username). It is used solely to provide market analysis to our subscribers, never for solicitation. If you are a Vinted seller and would like your listings to no longer be aggregated, write to support@vintapp.online.

9. Changes

This policy may change. The date of the last update is shown at the top of the page.