Privacy Policy
On this page
Who is responsible
The controller of your personal data is Bilal Sbaiby, an individual resident in Spain, who operates Resale IQ (resaleiq.dev). Email: support@resaleiq.dev. The postal address is in the legal notice.
Chrome extension
On Vinted item pages we read the public title, brand and asking price already on the page, and send that query to resaleiq.dev to look up a buy-below price. We do not read your Vinted account, cookies or messages. If you sign in at resaleiq.dev, the extension stores your session token on this device only (not in Chrome sync) so checks count against your plan. The token is sent only to resaleiq.dev. The extension contacts no other host. If the panel fails to render on a listing page — never on a successful check — the extension separately sends resaleiq.dev a fixed reason code (one of three preset values, never text taken from the page or the error itself) and the two-letter market, so we find out when Vinted changes its layout instead of the panel silently going blank. That report carries no listing content, no session token and no account identifier: it is sent by the extension's background process rather than the page itself, so it carries none of the page's Vinted context either. Like any request our servers receive, it still arrives with the sending device's IP address. On the free plan or without an account, the extension gives 10 checks a day per internet connection (IP address). To count them we store only a keyed hash of the IP address and that day's check count, never the IP address or the query text, and delete it the next day. If a connection sends checks faster than our rate limit, we keep the same hash with a count of refused requests for 30 days to spot scraping. After 10 checks the panel offers Pro or sign-in.
What we collect
Your email address, a securely hashed password (never stored in plain text), your subscription status via Stripe, and product-usage events (searches, watchlist and portfolio entries you create, and what you report after a check: whether you bought the item and at what price, and whether you sold it and for how much). If you connect Telegram alerts, also the Telegram chat ID you enter. We do not collect payment card details — those are handled entirely by Stripe.
Our server also records each check you run: the item text you typed, the result and the time. It keeps a hash of your browser ID with each check and, if your browser sent none, a keyed hash of your IP address (computed with a secret key only we hold, so it cannot be reversed by trying every address), and it links the check to your account if you are signed in. For each page you open it records the page address (including any search text in it), the website that referred you, your language, the campaign tags on the link, the step you reached (for example pricing viewed, sign-up started or checkout started), any error message the page reports and a visitor code that changes every day. We compute that code from your IP address and browser without storing either in the record, so it cannot be linked from one day to the next within this record. That changes when you sign up or buy: we keep that day's code with your account's source note (see “How you found us”), which ties your account to that day's page views, unless your browser sends Do Not Track or Global Privacy Control. This page-view record is separate from PostHog; like PostHog's, it is not recorded when your browser signals Do Not Track or Global Privacy Control. For sign-in and account events (Google sign-in, password reset, email confirmation, price comparisons) it keeps an event log linked to your account, with a keyed hash of your IP address for Google sign-ins. If you answer one of our short exit survey questions (what stopped you at the free-check limit or the paywall, why you left checkout, why you are cancelling, why you pay), we store your answer, your free text, the item you searched, your plan, the page language and that day's visitor code (described above), and we link them to your account if you are signed in.
Email forms: if you enter your email address in one of our forms (the monthly buy list, a price alert, the fees cheat sheet or a spreadsheet download, or a waitlist), we store the address, the form you used (and the item you were checking and its result, if you signed up from a check result) and the time, as the record of your consent. The same list sends you what the form offered and the monthly buy list, at most one email a month; every email has an unsubscribe link.
Trials, orders and partners: when you start a free trial we store a normalised copy of your email address with the trial dates, so that each person gets one trial, and a keyed hash of your IP address, so that one connection cannot start many trials. The email copy stays with the trial dates; the IP hash is kept for 2 days. For a Founding Lifetime or Tax pack order we store your email address, the amount, the order status (for the Tax pack, also the tax year) and the time you gave the withdrawal acknowledgement at checkout, with a keyed hash of your IP address as proof of that confirmation. If you pay at checkout without signing in (a guest checkout) using the email address of an existing account, we keep the payment details (email address, Stripe references and plan) until the account holder claims them with a link sent to that address. If you use the cancellation form, we store your email address, your name, the contract, the type of cancellation, the end date you ask for, the reason if you type one (up to 500 characters), your language, the time and a keyed hash of your IP address as proof of when you declared the cancellation. If you use the withdrawal form, we store your email address, your name, the contract, your language, the time, a keyed hash of your IP address, and what we did about it (which subscriptions we cancelled and which payments we refunded) as proof of when you declared the withdrawal and what we did. If you join the partner programme we store your email address, name, channel link, partner code and a keyed hash of your IP address at registration, and for each sale made through a partner code its amount, its date and the buyer's email address. If you start a checkout and do not finish it, we send one reminder email, within 7 days, to the address you typed at Stripe Checkout, but only if it belongs to an account here that has not opted out of marketing mail. To know we already sent it, we keep a keyed hash of that address (not the address itself) for 10 days.
How we use it
To provide the service, authenticate you, process your subscription, send account and product emails, email you about Resale IQ plans and offers (every email has an unsubscribe link), and improve the product. Our server keeps a technical log of each request (IP address, browser user agent, page address with any query string, the referring site, and time) to run and protect the service and to count how the site is used. When you complete a checkout, including a free trial, we also use it to note which page your visit started on that day and where you came from (see “How you found us”). The log is deleted after 15 days. When your browser sends Do Not Track or Global Privacy Control, we read its lines in the log only to find faults and errors and to protect the service: they count no visit and make no checkout note. We do not sell your personal data.
From the log we count, per day: visitors, by the page they arrived on and where they came from (search engine, AI assistant, social network, other site or direct); page views; sign-ups and checkouts started; and views of our embeddable widget, by the website that shows it. To count each browser once a day, we make a code from its IP address and user agent while counting and never store it. Our own visits, bots and other automated traffic are left out, and so is a browser on any day it sends Do Not Track or Global Privacy Control, with all its requests that day. The counts hold no IP address or user agent.
Data you create
Watchlists, portfolio items, and searches are private to your account. You can export all your data or delete your account at any time from the account page (GDPR rights to access and erasure).
Third parties
We use Stripe (Stripe Payments Europe Ltd, Ireland; payments), Resend (United States; transactional email), Hetzner Online GmbH (hosting, Helsinki, Finland) and Anthropic Ireland, Limited (Ireland, EU; the software tools we use to read server logs, support mail and, read-only, account and payment records when diagnosing faults, security problems and support requests; it may transfer data to Anthropic, PBC in the United States under standard contractual clauses). Each processes data only to deliver its function, with two exceptions. First, when our software tools run on a consumer Claude plan (Pro or Max) instead of our business (Team) accounts, Anthropic is an independent controller under its own privacy policy (anthropic.com/legal/privacy), which also lets it use the data to prevent fraud and abuse, resolve security issues and meet its legal obligations. On the consumer plan we have switched off the setting that lets Anthropic use our conversations to train its models; its business terms already exclude that. Second, the AI listing tool and the photo check send what you give them to Google's Gemini API. Under Google's terms for developers in the EEA, Google does not use that content to improve its products, but it may log it for a limited time to detect abuse and meet legal disclosure duties. Sign-in with Google and the AI listing tool use Google (Google Ireland Ltd / Google LLC): the tool sends the item text you type to Google's Gemini model to write the description. We keep the description it returns for 30 days, under a hash of the item details you typed and with no link to you, so that the same item is not sent to Google twice. The photo check sends the photo you choose to Google's Gemini model, which returns a guess of brand and item; we do not store the photo or the guess. A guess you tap runs as a normal check and is logged like a typed one. Because the photo goes to Google, do not photograph people or private details. Our eBay research tool sends the item text you type, with the marketplace you pick, to eBay through eBay's Browse API to fetch current listings; eBay receives no account data, contact data or IP address of yours. Google also stores our nightly database backup on Google Drive. Analytics, mail forwarding and advertising measurement are described in the next sections. Transfers outside the EEA rely on standard contractual clauses (Resend, Anthropic) or the EU-US Data Privacy Framework (Google). Telegram alerts are optional: if you connect them on your account page, we store the chat ID you enter and send the alert text through Telegram (Telegram Messenger Inc.), which handles it under its own privacy policy. Telegram is outside the EEA; we send the chat ID and alert text there only at your request, to deliver the alerts you asked for (GDPR art. 49(1)(b)). Disconnecting removes the chat ID. We do not sell personal data and share it with no third parties other than those listed on this page.
Analytics and mail recipients
Analytics: pages on resaleiq.dev send a page-view event through our own relay to PostHog (PostHog Inc., EU Cloud, hosted in Frankfurt, Germany). The event carries the page address, the referrer, your IP address and your browser's user agent, which PostHog uses only to compute a hash that changes every day to tell visits apart; it does not store the IP address or the user agent, sets no cookie, uses no browser storage, and nothing is sent if your browser signals Do Not Track or Global Privacy Control. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). PostHog keeps, for each event, the page address, the referrer, your time zone, language, screen and viewport size and the campaign tags (utm, ref) of the link you came from, and the actions we record: a started check, a finished check, a click on the main call-to-action button (no query text or link target is sent), sign-up, checkout start and checkout completed. PostHog deletes events after 12 months. Mail: messages sent to support@resaleiq.dev are received by Porkbun's email forwarding (Porkbun LLC, United States) and passed on to the operator's own mailbox at Google (Gmail, United States). Transfers outside the EEA rely on standard contractual clauses (Porkbun, PostHog) or the EU-US Data Privacy Framework (Google).
Advertising measurement
If you click Accept in the cookie banner, we load Google Ads conversion measurement (Google Ireland Ltd / Google LLC) to see which ads lead to sign-ups. It runs only with your consent, with ad personalisation signals switched off, and sends no email or account data. If you Reject, or make no choice, it never loads. You can change your choice at any time with the Cookie settings link in the footer. The choice is stored on your device (localStorage) and not sent to us.
How you found us
If you click Accept in the cookie banner, your browser stores (localStorage, on your device, for 90 days) the campaign tag on the link you clicked, the website that referred you, the page you landed on and the date. It holds no identifier of you. If you sign up or start a trial, we save that record against your account so we know which channel earned it; if you never do, it never leaves your device. Legal basis: your consent (GDPR Art. 6(1)(a)), withdrawn at any time with Cookie settings. If you Reject or make no choice, none of this is stored, and a record from an earlier visit is deleted the next time you open a page. Clearing your browser data removes it, and you can ask us to delete the copy on your account. When you sign up, buy or start a trial, we also note which page your visit started on that day, which site sent you there (for example a search engine or a chat assistant) and any campaign tags on that link, and keep it with your account and payment record, so we learn which pages bring customers. We work this out on our own systems from two sources. From our page-view record (described under “What we collect”, deleted after 12 months), the note keeps that day's visitor code. From our server request log, and only when you complete a checkout, even one with nothing to pay that day (such as a free trial), we make a checkout note: when we can match the checkout to your visit, the page, the type of source that sent you (for example Google, ChatGPT, another site or direct) and the date, without campaign tags or a visitor code. The checkout note also keeps the Stripe reference, amount and payment status of that checkout, which we read from Stripe, and is deleted 12 months after the checkout, whether or not a payment follows. No cookie is used and it goes to no one except the recipients listed here.
Do Not Track and Global Privacy Control: while your browser sends either signal, we add nothing about how you found us to your account and credit no partner, even if you clicked Accept earlier; your purchase is not affected. An account created while it does (including with Google) gets no campaign record from your device, no campaign tags, no landing page, no same-day note and no visitor code, and its source is recorded as unknown. A source noted at an earlier sign-up made without the signal stays. If you open a checkout while your browser sends the signal, we send Stripe no campaign or partner details for it, only a flag that the signal was on. If you open one or come back from one while it does, we credit no partner, make no checkout note and undo anything already copied to your account from that checkout; details sent to Stripe when you opened a checkout without the signal stay in Stripe's record of it. To keep it that way, we store a mark for that checkout with its Stripe checkout and subscription references and the time. For most other checkouts, the same record keeps a copy of your account's source note as it was before the checkout, so that we can undo the copy if you come back from that checkout with the signal on. Both stay with your account and are deleted when you delete it; a mark that belongs to no account (a checkout made without signing in that was left unpaid or paid with the email address of an existing account) is deleted after 30 days.
Business contacts (B2B)
We may contact businesses at email addresses they publish publicly, about services relevant to their activity (legitimate interest, GDPR Art. 6(1)(f)). The data we use is the business name, the published email address and the page where we found it. You can opt out at any time by replying STOP or emailing support@resaleiq.dev; we then keep only a suppression record so we never contact you again. If there is no reply, we delete the contact data after 12 months. The controller is Bilal Sbaiby (individual, Spain), support@resaleiq.dev.
Legal bases
Account, sign-in, subscription and support: performing our contract with you (GDPR Art. 6(1)(b)). Invoices and payment records: our legal tax and accounting duties (Art. 6(1)(c)). Account and product emails: the contract. Emails about Resale IQ plans and offers to our customers: our legitimate interest (Art. 6(1)(f)), with an unsubscribe link in every email. The monthly buy list and the other email forms: your consent (Art. 6(1)(a)), given when you submit the form and withdrawn at any time with the unsubscribe link in any email. Trial records, Founding and Tax pack order confirmations and cancellation and withdrawal records: the contract (Art. 6(1)(b)) and our legitimate interest in preventing repeated trials and in proving what you confirmed or declared, and when (Art. 6(1)(f)). The partner programme: the contract with you as a partner (Art. 6(1)(b)). A sale made through a partner's link (its amount, date and the buyer's email address): our legitimate interest in paying the partner what it is owed and handling refunds (Art. 6(1)(f)). Support mail, the server request log, the daily check counter, the abuse rate limit, the free-check allowance records, the check log, the first-party page-view record, the exit survey, the account event log, page-view analytics and the nightly backup: our legitimate interest in running, protecting and improving the service (Art. 6(1)(f)). The visit and usage counts made from the server request log, and the checkout note made from it: our legitimate interest in knowing which pages, sources and tools people use (Art. 6(1)(f)). The mark on a checkout opened, or returned from, while your browser sends Do Not Track or Global Privacy Control: our legal duty to give effect to that objection (Art. 6(1)(c) with Art. 21(5)). The copy of the source note kept with other checkouts: our legitimate interest in being able to undo the copy if that objection follows (Art. 6(1)(f)).
Counting who comes back: we count how many account holders come back in the second week after signing up, to learn whether people find Resale IQ worth coming back to, so that we can improve it. We work it out from the days you sign up, run a check, add to your watchlist, save a search, report whether you bought an item you checked, sign in with Google or compare prices. The count's result is totals only, kept as statistics with no end date; the only other record it keeps is the list of objections described below. A record made by a request whose browser sends Do Not Track or Global Privacy Control is left out of the count; the record is still kept to run your account. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f)).
You can object to this count at any time (Art. 21): write to support@resaleiq.dev from your account's email address, and from then on we leave your account out of the count, earlier activity included. To do that, we keep your account number (an internal number each account has) on a separate list of objections. The list holds nothing else and is used only for that. Legal basis for the list: our legal duty to give effect to your objection (Art. 6(1)(c) with Art. 21(1)). We keep your number on it while your account exists and remove it within a day after you delete your account. An objection does not carry over to a new account: if you open one later, write to us again from its email address.
What you report after a check (whether you bought the item and at what price, and whether you sold it and for how much): the contract, to keep it in your account, and our legitimate interest in checking whether our verdicts were right (Art. 6(1)(f)).
Google Ads conversion measurement: your consent (Art. 6(1)(a)), given with Accept in the cookie banner and withdrawn at any time with Cookie settings. The listing-description tool: the contract, because you ask it to write. The photo check: the contract, because you ask it to read your photo.
How long we keep data
Account data (email, hashed password, watchlists, portfolio, searches, the purchases and sales you report, and usage events): while your account is open; we remove it from our active systems when you delete the account, except that the text of your past checks and your account event log stay without any link to you until they are 12 months old. Payment and invoice records: for as long as Spanish tax and accounting law require, then deleted; Stripe keeps its own records under its own policy. Support mail: while we handle your request and any follow-up or dispute, then deleted. Server request log (IP address, user agent, page address with any query string, referring site, time): 15 days, then deleted. The daily counts made from it (no IP address or user agent) are kept as statistics, with no end date; the checkout note made from it (see “How you found us”) is deleted 12 months after the checkout it records. The checkout mark and the copy of the source note (see “How you found us”): while your account exists, deleted when you delete it; a mark that belongs to no account: 30 days.
Allowance and abuse records: the free-check allowance for a browser that has no browser ID (a keyed hash of your IP address and the time), the daily counters of the listing and photo tools (a hash of your browser ID and a keyed hash of your IP address, per day) and the daily limit for free accounts (a keyed hash of your IP address, per day) are deleted after 2 days; the first-free-check record (a hash of your browser ID and the time), after 90 days; the refused-request counters (a keyed hash of your IP address, per day), after 30 days. The listing tool's saved descriptions (stored under a hash of the item details you typed, with no link to you) are deleted after 30 days. Check log and account event log: the hashes that tie a check or a Google sign-in to a browser or an IP address are removed after 35 days. Checks made without an account, page-view records and exit-survey answers are deleted after 12 months, and so are the event-log rows of deleted accounts; your exit-survey answers are also deleted when you delete your account.
Telegram chat ID: until you disconnect Telegram or delete your account. Marketing emails: until you unsubscribe, after which we keep only a suppression record so we do not email you again. List of objections to counting who comes back (your account number only): while your account exists; we remove the number within a day after you delete your account (see “Legal bases”). The extension's daily check counter (deleted the next day), the campaign record on your device (90 days) and business contacts (12 months) are as described above.
Email forms: until you unsubscribe, then we delete the entry after 30 days; it is deleted at once when you delete an account that uses the same email address, and you can ask us to delete it sooner. Trial records: until you delete your account (the IP hash: 2 days). Checkout reminder record (a keyed hash of the address, which shows the one reminder was sent): 10 days, or until you delete your account. Cancellation and withdrawal records: 5 years from the declaration, then deleted. Founding and Tax pack order records, payment details from guest checkouts and the commission records of partners: for as long as Spanish tax and accounting law require, then deleted. Partner registrations: until you ask us to close them. Nightly database backups: the last 3 copies on Google Drive, plus encrypted copies on our own machine at another location (7 daily, 4 weekly), so a deletion reaches every backup within 30 days. Copies we make by hand before removing accounts (an export of the removed rows): deleted after 30 days.
After you delete your account
When you delete your account from the account page, we first cancel any subscription, then delete your account data, your exit-survey answers, your free-trial record and the email-form entry for your address. If you objected to counting who comes back, we also remove your account number from the list of objections within a day. What stays, and why: (1) the text of your past checks and your account event log, without any link to you (no account number and no hash of your IP address or browser), until they are 12 months old, so that we can measure and protect the service; (2) an anonymous record that an account was deleted (its plan, how long it existed and whether it had a subscription; no email address, name or ID), for up to 12 months, and the campaign tags of its sign-up, until 12 months after the sign-up; (3) the records we must or may keep: invoices and payment records, Founding and Tax pack order records, payment details from guest checkouts and cancellation and withdrawal records, for the periods given in the section “How long we keep data” (they include your email address and, for a cancellation, your name), while a partner's commission record keeps its amount and date but no longer the buyer's email address, and the checkout note (see “How you found us”) stays until 12 months after the checkout; (4) a partner registration made with your email address, which is a separate record that we close when you ask us; (5) backups, which rotate out within 30 days. To have a record under (3) or (4) deleted earlier, write to support@resaleiq.dev: we delete whatever the law does not require us to keep.
Cookies and browser storage
Before you choose in the cookie banner, no third party receives a request, and we set only the cookies listed here. NEXT_LOCALE remembers your language for one year; the site sets it when you open a page and again when you pick a language, and NEXT_LOCALE_SET (one year) records that you picked the language yourself. When you open the pricing page, we set riq_price_arm (30 days), which keeps the Pro price you were shown the same on each visit; it holds only the letter A or B. The first time you run a free check or use the listing writer or the photo check without an account, we set riq_vid (HttpOnly, 400 days), a signed random browser ID, so the free allowance counts per browser; our server keeps only a hash of it. When you sign in, we set __Host-di_session (HttpOnly, 7 days), which keeps you signed in until you sign out or it expires. Sessions started earlier may still carry it under its old name, di_session; we no longer set that name, and signing out removes it. If you arrive through a partner link (a page address with ?ref=) and have not yet made a choice in the cookie banner, the site holds the partner code in the page's memory for that visit only and never writes it to your device, so a checkout you start on that visit still credits the partner. Only if you click Accept does riq_ref keep the code for 60 days, so the partner is credited if you subscribe later. If you Reject, the code is not used at all and any riq_ref cookie from an earlier visit is deleted. A Do Not Track or Global Privacy Control signal without an Accept has the same effect as Reject. After an Accept the cookie stays, but a checkout opened or returned from while your browser sends the signal credits no partner (see “How you found us”). Our own team's browsers carry riq_internal (one year, set by opening a page with ?internal=1) so our visits are not counted.
In your browser's localStorage, on your device: di_sess (your signed-in state: email address, plan and session expiry; removed when you sign out or when the 7 days are over), riq_capture_email (an email address you typed into a form on our pages, used to pre-fill checkout; kept until you clear your browser data), riq_intent_query and riq_first_check_seed (the item text you last searched, kept to bring you back to your check after sign-up or payment; removed when that is done, riq_first_check_seed after 24 hours at the latest), riq_landing_path (the first page you opened, 90 days, only after Accept), riq_google_signup_tracked (your account ID, so that a Google sign-up is counted once), riq_pending_ledger (a ledger row you started before signing in, 7 days), riq_sales_paste (the sales you pasted into the free sales-sheet tool, kept only if you press Save these sales to my ledger, removed once the sales are imported and when you sign out, and after 7 days at most if neither happens), riq_ft (the 90-day campaign record described above, only after Accept), riq_attribution_v2 (its campaign tags only, 30 days, only after Accept), riq-pwa (whether you dismissed the install-app prompt, with simple counters that decide when to show it), riq_ab_cta_label, riq_ab_seen_cta_label, riq_ab_reg_cta and riq_ab_seen_reg_cta (which wording of a button you were shown, for a test of button text), riq_ab_price_pro (which Pro price you were shown on the pricing page, for a price test) and your cookie choice (riq_consent_ads). Also kept on your device only: Listing Studio drafts and counters, the text you paste into the bulk listing and inventory tools, your store and compare lists, the plan you chose on the sign-up page and the page you were heading to, the billing country you chose at checkout, markers that record which tool or store page you started a sign-up from, free-tool usage counts, the onboarding steps you reached and which banners and survey cards you closed. These stay until you delete them or clear your browser data, unless a period is given above; after that period the site removes the entry the next time you open it. Without an Accept, the three entries marked 'only after Accept' are not written, and any left from an earlier visit are deleted the next time you open a page.
In sessionStorage, which your browser clears when you close the tab, small markers carry a sign-up or checkout step to the next page. Your browser's cache also holds an offline page and copies of the app's scripts, icons, images and public data files (and, for the listing photo tool, its background-removal model file); none of it is personal.
If you click Accept, Google sets _gcl_au (a cookie) and _gcl_ls (localStorage) for ad conversion measurement, and we also keep the partner code (riq_ref) and the campaign record (riq_ft, riq_attribution_v2, riq_landing_path) described above. All of these rest on your consent (GDPR Art. 6(1)(a)). If you Reject or make no choice, none of these is stored. Change your choice at any time with the Cookie settings link in the footer.
Your rights
Under GDPR you can ask for access to your personal data, for it to be corrected or deleted, to receive it in a portable format (you can export it from your account page), to restrict its processing, and to object to processing based on our legitimate interest, such as counting who comes back (see “Legal bases”). Where processing rests on your consent, you can withdraw it at any time; this does not affect what happened before. To use a right, email support@resaleiq.dev; we answer within one month. You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), or to the authority in your own country. Account deletion removes your personal data from our active systems, except the records listed in the section “After you delete your account”.
Contact
For any privacy request, email support@resaleiq.dev or use the data controls on your account page.