Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

This Privacy Policy covers the SnapSell mobile application (iOS and Android) as well as its web version at app.snap-sell.app. We process personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address – for account access and communications
• First and last name – to personalise your experience
• Profile photo (optional) – displayed on your seller profile
• Firebase UID – a unique user identifier generated automatically for authentication
• If you sign in with Google, Facebook or Apple: the email tied to that account and Firebase/Google/Apple ID + refresh/OAuth tokens necessary to verify your identity. We do not receive your password from these providers.

2.2 Content You Provide

When you use our services we process:

• Product photos you upload for AI enhancement and listing generation
• Listing content – titles, descriptions, prices, categories
• Messages you send us through in-app support or email
• Connected marketplace account names (OLX, Allegro, eBay) – only if you explicitly link your account

2.3 Payment Information

We process transaction metadata through our payment processors:

• Token purchase transactions (Stripe, Apple, Google)
• Seller payout metadata (stored at Stripe)
• Transaction history and receipts

We never store your full credit card number. Card details are handled directly by Stripe, Apple, or Google Play.

2.4 Device and Diagnostic Data

When you use the app and website we collect:

• Device information – device model, operating system and version, installation ID, app version, locale, region
• Log data – IP address (truncated where possible), access times, crash stack traces (via Sentry)
• Approximate location – country and city derived from IP address, for regional features only

2.5 Analytics, Marketing and Advertising Dataconsent required

With your consent expressed in our in-app consent sheet (shown on first launch for users in the European Economic Area and the UK) we collect:

• Advertising identifier – IDFA (iOS) or Android Advertising ID (Android); on iOS this requires an additional approval in the system-level App Tracking Transparency prompt
• Analytics session identifier generated by our analytics providers
• Session Replay recordings – visual recordings of your in-app interactions with sensitive fields (prices, emails, phone numbers, payment sheets, personal photos) automatically masked. Used only for usability analysis; retained for 30 days.
• Event data – screen views, taps on specific features, funnel step durations, purchase events, sign-up and listing submission events

2.6 Connected Platform Data

When you connect external marketplaces (OLX, Allegro, eBay) we receive the limited data you authorise: listing status, sales information, chat messages related to listings. We never receive your password for those platforms.

3. Legal Basis for Processing

4. Consent Categories and Controls

Our in-app consent flow asks for two separate, independent consents:

5. Apple App Tracking Transparency (iOS)

On iOS 14.5 and later, before any advertising-identifier-based measurement, the app shows a standard Apple tracking-permission prompt. Choosing "Ask App Not to Track" does not reduce any app functionality — the only consequence is that Meta and Google will not receive your iOS advertising identifier (IDFA) for cross-app attribution. You may change this choice at any time in iOS Settings → Privacy & Security → Tracking.

6. AI Processing of Your Photos

7. Session Replay

If you grant "Product analytics" consent, we record anonymised playbacks of your in-app sessions. Recordings capture cursor movement, clicks, screen transitions, and on-screen content — except the following fields which are automatically masked:

• Email addresses, phone numbers, passwords
• Payment sheets and card entry forms
• Personal photos in the enhance preview
• Token balance and purchase prices

Recordings are used solely for usability analysis and are automatically deleted after 30 days. Our session-replay provider (Amplitude) does not share these recordings with third parties and does not use them for advertising purposes.

8. Data Retention

We retain personal data only for as long as necessary:

9. Third-Party Data Processors

We share data with the following processors under Art. 28 GDPR data-processing agreements. The list reflects our current production stack:

We do not sell your personal data. We do not share your data for third-party personalised advertising outside the scope of the "Ad measurement" consent (Meta App Events and Google Ads), which you can withdraw at any time.

10. International Data Transfers

Where data is transferred outside the European Economic Area we rely on the following safeguards under GDPR:

• EU–US Data Privacy Framework for certified US providers (Amplitude, Stripe, Sentry, Cloudflare, Google LLC, Meta Platforms, Resend)
• Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) as a backstop
• Additional technical and organisational measures including encryption in transit and at rest, minimisation, pseudonymisation, access control

11. Your Rights Under GDPR

12. Data Security

• HTTPS (TLS 1.3) for all data in transit
• Encryption at rest for databases and object storage
• Least-privilege access controls on cloud infrastructure
• Regular security reviews, dependency scanning (Trivy), and vulnerability patching
• Two-factor authentication mandatory for Nova AI Ventures staff
• Audit logging and alerting on anomalous sign-in activity
• Secure data-deletion procedures
• Confidentiality agreements with all employees and contractors

If a security incident occurs that is likely to result in a high risk to your rights and freedoms, we will notify you within 72 hours of becoming aware of it, as required by Art. 34 GDPR.

13. Supervisory Authority

You have the right to lodge a complaint with a data-protection supervisory authority:

You may also contact the data-protection authority in your country of residence, place of work, or place of the alleged infringement.

14. Children's Privacy

SnapSell is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@novaai.ventures and we will delete it immediately.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes — for example the addition of a new processor or a new purpose of processing — will be communicated via an in-app banner or email at least 14 days before they take effect. The "Last updated" date at the top indicates when the policy was last revised. Please review this policy periodically.

16. Contact Us