Privacy policy

[NOME ENTITÀ] ([ORG. NR]), [SEDE], is the data controller for vidaRE. Contact: [EMAIL CONTATTO].

Data we collect

• Account: JU student email, name, password (stored encrypted by our login provider), or your Microsoft 365 sign-in.
• Listings: title, description, price, category, condition, pickup area and the photos you upload.
• Chat and offers: messages, offers and counter-offers, and reports you send.
• Orders and rentals: what you bought, sold or rented, amounts, rental dates and pickup slot, deposit and any amount kept with the reason, payment status, pickup and refund details. Card details are handled by Stripe; we never see them.
• Payout details: Swish number or IBAN and account holder name (sellers, and renters of long rentals so we can return the deposit).
• Notifications and usage: in-app notifications, "Notify me" alerts, listing view counts, and technical logs (e.g. errors, IP address in server logs).
• Forms: Sell instantly and buyout waitlist forms (and earlier Starter Pack interest forms).

Why we use it and legal basis

• Providing the marketplace, chat, payments, pickup and payouts — performance of a contract.
• Keeping order and payment records — legal obligation (Swedish Bookkeeping Act).
• Safety, moderation, fraud prevention and fixing errors — legitimate interest.
• Optional forms and waitlists — consent, which you can withdraw at any time.

Who receives data

• The other party in a chat or order sees your name and messages — never your email or payout details.
• Stripe (payments), our hosting and database provider (Lovable Cloud, EU/US infrastructure), and our login provider and Microsoft (if you use Microsoft sign-in).
• The vidaRE team, only as needed for support, moderation and payouts.
• Authorities, if required by law. We don't sell your data.

Where data is processed outside the EU/EEA, we rely on the EU Standard Contractual Clauses or an adequacy decision.

How long we keep it

• Account, listings, chats: while your account exists. When you delete it, listings and photos are removed and messages anonymised.
• Orders and payment records: 7 years (bookkeeping law), without a link to a deleted account.
• Payout details: deleted with your account.
• Unused photo uploads: deleted after 24 hours; photos of removed listings after 30 days.
• Error logs: up to 90 days.

Your rights

You can ask for access, correction, deletion, restriction, a copy of your data (portability), and object to processing based on legitimate interest. You can change your email/password or delete your account yourself on the Account page. Write to [EMAIL CONTATTO]. You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

Cookies

See our Cookie notice.