Privacy Policy & GDPR
We respect your privacy. Here's exactly what data we collect, why we collect it, and what rights you have.
Last updated: July 2026
Who Controls Your Data
Your personal data is processed by Commit Software Solutions SRL (CUI 46257020), Str. Soporului 29 A, Bl. A, Sc. 2, Et. 2, Ap. 25, Cluj-Napoca, România. Email: commitsoftwaresolutionssrl@gmail.com · Phone: +40 749 450 066.
What Data We Collect
We collect account data (name, email, phone, hashed password), listing content (title, description, price, images, location), messages between users, payment records (order ID, amount, status — card details go directly to Netopia, not us), and technical data (IP, browser, cookies). If you use Google or Facebook login, we receive your name, email, and profile picture from them.
How We Use Your Data
We use your data to manage your account, publish your listings, process payments, send transactional emails (verification, password reset), enable messaging between buyers and sellers, and protect the platform from fraud and abuse.
Legal Basis (GDPR)
We process data on the basis of: contract performance (account, listings, messaging), legitimate interest (security and fraud prevention), consent (push notifications — you can withdraw any time), and legal obligation (payment records kept for 5 years as required by law).
Who We Share Data With
We never sell your data. We share it only with: Netopia Payments (payment processing), Amazon S3 (image storage), Turso (database hosting), Vercel (platform hosting), Cloudflare (CAPTCHA), and Google / Facebook (only if you use SSO login).
Cookies
We use a session cookie to keep you logged in (NextAuth), a CSRF token for security, and Cloudflare Turnstile cookies for CAPTCHA. We do not use advertising or tracking cookies.
How We Protect Your Data
All connections use HTTPS. Passwords are hashed with bcrypt. Card data is never stored on our servers — it is handled directly by Netopia Payments. We use industry-standard hosting with access controls.
How Long We Keep Your Data
Account data is kept while your account is active. Listings are retained for 60 days after expiry. Payment records are kept for 5 years as required by Romanian law. You may request deletion at any time.
Your GDPR Rights
Access
Request a copy of your personal data.
Rectification
Correct any inaccurate or incomplete data.
Erasure
Ask us to delete your data (right to be forgotten).
Portability
Receive your data in a structured, machine-readable format.
Restriction
Ask us to limit how we process your data.
Objection
Object to processing based on legitimate interests.
Withdraw Consent
Withdraw consent for push notifications at any time in your browser settings.
🙋 Want to exercise your rights?
Email us at commitsoftwaresolutionssrl@gmail.com and we'll respond within 30 days. You can also file a complaint with Romania's data protection authority at dataprotection.ro.