Buy2Sell
Privacy policy
What data we hold about you, why, for how long, and what you can ask us to do with it.
Version 2026-08-22 · Updated 2026-08-22
◆The operator's identification details are not filled in yet. Until then this document is incomplete and cannot be treated as in force.
1.Who is responsible for your data
The data controller is «de completat», tax ID «de completat», «de completat», registered office at «de completat».
For any question about your data, write to date@buy2sell.ro. We answer within 30 days at the latest — the deadline in article 12 GDPR — and usually much sooner.
2.What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Email, username, password (stored only as a hash) | So the account exists and you can sign in. | Performance of a contract (art. 6(1)(b)) |
| Phone number, if you confirm one | So we can reach you about an order, and so ten accounts cannot be made on one number. | Contract and legitimate interest (art. 6(1)(b), (f)) |
| Delivery address | So the parcel arrives. Only the seller of your order sees it, and only after you have paid. | Performance of a contract (art. 6(1)(b)) |
| Listings, messages, reviews, photos | This is the content you publish. | Performance of a contract (art. 6(1)(b)) |
| Order and payment history | So escrow, invoices and complaint handling can exist. | Contract and legal obligation (art. 6(1)(b), (c)) |
| IP fingerprint, browser used, sign-in attempts | To stop password guessing, spam and multiple accounts. The IP address is never kept in the clear — see section 4. | Legitimate interest (art. 6(1)(f)) |
| Identity document, if you verify your identity | So we can allow selling in categories that require it, and to prevent fraud. We do not keep it — the verification provider processes it. | Legal obligation and legitimate interest (art. 6(1)(c), (f)) |
| Your cookie choice | So we do not ask again, and so we can prove what you chose. | Legal obligation (art. 6(1)(c)) |
We sell no one's data. We do no profiling for advertising. We have no analytics or tracking tool on the site — you can check this in your browser's Network tab.
3.Who else sees the data
Data reaches the providers we need for the platform to work, and only them:
| Provider | What it receives | Where |
|---|---|---|
| Supabase | The database and uploaded files | European Union |
| Stripe | Payment data. Your card never passes through our servers. | EU / US, under standard contractual clauses |
| Resend | Your email address and the content of messages we send you | EU / US, under standard contractual clauses |
| The chosen courier | Recipient name, address and phone, for the waybill | Romania |
| Anthropic | Listing text and assistant questions, for moderation and answers | US, under standard contractual clauses |
| Cloudflare | Technical browser signals, for the anti-bot check | Global network |
4.How they are protected
- Your phone number and full delivery address are ENCRYPTED in the database. Anyone reaching a copy of the database can read neither the numbers nor the addresses.
- IP addresses are never written in the clear, anywhere. Only a fingerprint is kept, from which the address cannot be reconstructed.
- Passwords are kept only as hashes. Not even we can read them.
- Uploaded photos are re-encoded on the server, and metadata — including the GPS coordinates phones put in photos — is stripped before the photo becomes public.
- A listing's location is rounded to roughly one kilometre if you choose that; exact coordinates are never published.
5.How long we keep them
| What | How long |
|---|---|
| Your account and content | As long as you have an account |
| A deleted account | Hidden immediately, then permanently anonymised after 30 days. Until then you can change your mind. |
| Listing views | 12 months |
| Sign-in attempts | 90 days |
| IP fingerprint and browser in security logs | 90 days. After that only the fact remains — “the password was changed on date X” — without the trace of where from. |
| Account security history | 24 months |
| Phone number in the clear, while SMS confirmation runs | At most 24 hours. After confirmation it is deleted, and only the encrypted form remains in the profile. |
| Invoices and accounting records | 10 years, as accounting law requires. Here we cannot delete on request. |
6.What you can ask for
Every right below is implemented in the app, not merely written here. You will find them under Settings → My data.
- Access and portability — download an archive with everything we hold about you, in JSON, ready to move elsewhere.
- Rectification — correct your profile data at any time.
- Erasure — delete your account from Settings. What remains, and why, is in section 5.
- Withdrawal of consent — change your cookie choice from the footer of any page, as easily as you gave it.
- Objection to marketing — unsubscribing from emails takes one click, from any email you receive.
- Restriction — you can ask us to stop using certain data while an objection is being settled.
If you believe we have not handled your data properly, you can lodge a complaint with the Romanian data protection authority (dataprotection.ro). We would like you to try us first, but the right is yours either way.