VinKet ("we", "our", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect your information when you use www.vinket.eu and related services. We comply with the EU General Data Protection Regulation (GDPR, Regulation 2016/679).
1. Data Controller
Andrea Anastasi, founder of VinKet, based in Italy. Contact: privacy@www.vinket.eu.
2. Personal data we collect
- Account data: email, name, password (hashed), shop name, country, role (seller/wholesaler/buyer)
- Profile data: bio, profile image, shop description, language preferences
- Transactional data: orders, payments via Stripe, commissions, refunds
- Listing data: photos, descriptions, prices, AI-generated metadata
- Communications: messages between buyers and sellers, support requests
- Technical data: IP address, browser type, device, cookies (see Cookie Policy)
- Usage data: pages visited, features used, anonymized analytics (with consent)
3. Legal basis & purposes
- Contract performance (Art. 6(1)(b) GDPR): account management, order processing, payments
- Legal obligation (Art. 6(1)(c) GDPR): tax records, anti-fraud, accounting
- Legitimate interest (Art. 6(1)(f) GDPR): security, fraud prevention, service improvement
- Consent (Art. 6(1)(a) GDPR): marketing communications, analytics cookies
4. Data processors
We share data with third-party processors only as necessary to deliver the service:
- Supabase (EU region) — database, authentication
- Vercel (US, EU edge) — application hosting
- Stripe (Ireland) — payment processing
- Cloudinary (EU region) — image storage and delivery
- Resend — transactional email delivery
- PostHog (EU region) — analytics (with consent only)
- Google LLC (Google Analytics 4) — analytics data processor — privacy.google.com
- Anthropic (US, adequacy decision) — AI item analysis
- HuggingFace (US) — AI inference for visual search
- Replicate (US) — AI image enhancement
- Railway — workflow automation infrastructure
All processors are bound by Data Processing Agreements (DPAs) and process data on our behalf only.
5. International transfers
Some processors are based outside the EU. Transfers are protected by Standard Contractual Clauses (SCCs) and, where applicable, EU adequacy decisions.
6. Retention periods
- Account data: until account deletion + 30 days grace period
- Transaction records: 10 years (Italian tax law)
- Marketing consent: until withdrawn
- Anonymized analytics: 24 months
- Support communications: 24 months after resolution
7. Your rights (GDPR Articles 15–22)
- Access (Art. 15): request a copy of your personal data
- Rectification (Art. 16): correct inaccurate data
- Erasure (Art. 17): request deletion of your data ("right to be forgotten")
- Restriction (Art. 18): limit processing in certain cases
- Portability (Art. 20): receive your data in a structured machine-readable format
- Objection (Art. 21): object to processing based on legitimate interest
- Withdraw consent: at any time without affecting prior lawful processing
To exercise any right, contact privacy@www.vinket.eu. We respond within 30 days.
8. Complaints
You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) at garanteprivacy.it.
9. Security
We protect your data with HTTPS encryption, password hashing, row-level security on the database, rate limiting, and regular security audits. No system is 100% secure, but we follow industry best practices.
10. Changes to this policy
We may update this Privacy Policy. Material changes will be notified by email or in-app notice. The "Last updated" date at the top of this page indicates the most recent revision.