Privacy Policy

Introduction

This Privacy Policy explains how Resell Vault LLP ("we," "us," or "our") collects, uses, processes, and protects your personal information when you use our services, including our Discord server, website, and related tools.

1. Information We Collect

a. Account & Identity Information

• Discord ID and username (for tool access and subscription management)
• Email address (captured via Supabase Auth or manually)
• Billing address and transaction metadata (via Stripe)

b. Subscription & Tool Data

• Subscription plan, activation, renewal status
• Data entered into our inventory / sales tools (e.g., product names, quantities, dates, purchase and sale prices, expenses)
• Anonymous analytics on feature usage

c. Support & Community Content

• Messages and attachments you send in support tickets (retained as transcripts so we can maintain your support history; AI may be used to help draft responses)
• Success stories and wins you post in designated Discord channels, including your Discord username, display name and avatar, which may be displayed publicly on our website's live feeds and success-stories pages

d. AI Tool Inputs

• Product photos, prompts and listing text you submit to our AI tools (listing generator, photo enhancement, price estimation). These are processed by third-party AI providers (see Section 8) solely to deliver the feature you requested; we do not use your content to train our own models.

e. Data from Minors

• Our Service may be used by individuals under 18. We purposely limit collection to non-sensitive data (e.g., Discord ID, basic tool inputs).

We do not collect:

• Special-category data (health, biometric, etc.)
• Precise IP addresses (we may receive transient IPs in server logs but do not store them separately)

2. How We Use Your Information

• Provide secure log-in and role-based access (Supabase Auth + Discord).
• Manage subscriptions and payments (Stripe).
• Deliver and improve our inventory and sales tools.
• Monitor security, prevent abuse, and diagnose issues.
• Provide customer support and essential service notifications, and send onboarding or service emails.
• Measure the performance of our own advertising campaigns (see Section 7 — limited event data is shared with advertising platforms for this purpose).

We never sell or rent your personal data to advertisers or third parties.

3. Legal Bases for Processing

• Contractual necessity - delivering the Service you subscribe to.
• Legitimate interest - ensuring security, preventing abuse, improving functionality.
• Consent - optional communications or analytics.
• Legal obligation - accounting and tax record-keeping.

4. Data Storage & Security

• Authentication & primary database (Supabase Auth + Postgres): Encrypted in transit (TLS) and at rest; role-based access; daily backups
• Secondary database (MongoDB Atlas): Encryption at rest, network peering, IP whitelisting
• Payments (Stripe): PCI DSS-compliant; we never store full card details
• Discord: OAuth tokens scoped to required permissions only

We restrict data access to authorised staff and run periodic security audits.

5. Data Subject Rights

You can, at any time, request to:

• Access the personal data we hold on you.
• Rectify inaccurate or incomplete data.
• Erase data ("right to be forgotten") where legally permissible.
• Download your inventory/sales data in a portable format.
• Object or restrict certain processing.
• Lodge a complaint with the ICO.

Submit requests via Discord or contact@resellvault.co.uk. We will respond within a reasonable timeframe.

6. Children's Data

• Collect only minimal, non-sensitive data required for functionality.
• Encourage parental oversight.
• Promptly honour deletion requests for minor data.

If you believe we have unintentionally collected inappropriate information from a minor, please contact us.

7. Cookies & Tracking

• Essential cookies - maintain sessions after login (Supabase authentication).
• Preference storage - local browser storage that remembers UI settings, dismissed messages and checklist progress. It never leaves your device.
• Analytics (cookieless) - we use Vercel Web Analytics and Speed Insights to count page views, custom events (e.g., clicks on “Join Discord”) and performance metrics. These are aggregated, do not use cookies, and do not track you across other websites.
• Advertising measurement (TikTok Pixel) - when we run ad campaigns, the TikTok Pixel may set third-party cookies and share limited event data (such as pages viewed and sign-up or checkout clicks) with TikTok so we can measure our own adverts. This data is processed under TikTok's privacy policy.
• Advertising measurement (Google tag) - the Google tag (gtag.js) helps us measure whether our Google adverts lead to sign-ups. Until you choose “Accept all”, it runs in Google Consent Mode with all advertising storage denied — no advertising cookies are set and only anonymised, cookieless pings are sent. If you accept, it may set cookies such as _gcl_au to attribute conversions to our ads, and when you complete a purchase we may share a privacy-protecting hashed (SHA-256) version of your email address with Google to improve conversion measurement (“enhanced conversions”) — your readable email address is never shared. This data is processed under Google's privacy policy.

You can block or delete non-essential cookies in your browser settings without losing core functionality, though tool UX may degrade.

8. Third-Party Services

We integrate securely with:

• Supabase – authentication, primary data storage, file storage, and real-time APIs.
• Stripe – secure payment processing and invoicing.
• Discord – OAuth sign-in, role management, and bot-delivered tools.
• MongoDB Atlas – supplemental storage for certain tool features.
• Vercel – website hosting, cookieless analytics and performance monitoring.
• Resend – transactional and onboarding email delivery.
• Trustpilot – review invitations for new subscribers.
• TikTok – advertising measurement via the TikTok Pixel (see Section 7).
• Google – advertising measurement via the consent-gated Google tag (see Section 7).
• AI providers (including OpenAI, Google and xAI, plus specialist image-processing services) – process the prompts, photos and support messages you submit to our AI features, solely to deliver those features.
• Market-data APIs (e.g., RapidAPI) – price and sold-listing lookups; product queries only, no account data.

Each third-party complies with its own privacy and security standards; data transfers outside the UK are protected by appropriate safeguards (e.g., Standard Contractual Clauses).

9. Data Retention

• Account and billing information: Retained for up to 6 years for financial compliance and legal purposes.
• Web app data (inventory/sales data): Not automatically deleted upon cancellation. It remains stored indefinitely unless you specifically request deletion.
• V1 Vinted Monitor data: Deleted immediately upon losing subscription access.
• V2 Vinted Monitor data: Retained with a grace period, then automatically removed.
• Support ticket transcripts: Retained so we can maintain your support history and resolve disputes; deleted on request.
• AI tool inputs: Processed to deliver the requested feature. Third-party AI providers may retain data per their own policies; we do not use your content to train our own models.
• Discord account link: You can unlink your Discord account at any time with the /unlink command, which removes your linked record; inactive links are also removed periodically.
• Data deletion requests: You can request immediate deletion of your personal data by contacting us at contact@resellvault.co.uk. Deletion is subject to legal retention requirements for financial and compliance purposes.

10. Automatic Checkout (ACO) Service Data

10.1 What We Collect

When you use the ACO service, you voluntarily submit login credentials, session cookies, and/or payment method details for third-party platforms ("ACO Data"). We do not solicit this data — it is provided entirely at your discretion. Your Discord username is logged for operational and audit purposes when you interact with the ACO service.

10.2 How We Use It

ACO Data is used solely to execute purchase tasks you have authorised, acting as your agent on the specified third-party platform. Discord usernames are retained in service logs to attribute activity, manage access, and investigate disputes.

10.3 Local Storage Only

ACO Credentials (login credentials, cookies, payment details) are stored locally on the machine running the ACO service — this is a technical requirement for the service to function. They are never:

• Transmitted to or stored in any central Resell Vault database
• Included in logs, analytics, or monitoring systems
• Accessible to any Resell Vault staff other than the botter(s) directly operating the service

Your Discord username, however, is retained in operational log channels as noted in 10.2.

10.4 Retention

ACO Credentials are deleted from the local machine when you stop or cancel the service.

Discord usernames are retained in log channels indefinitely but will be purged upon request — contact us to request deletion.

10.5 Legal Basis

Processing is based on your explicit consent (GDPR Article 6(1)(a)) and, where applicable, the performance of a task carried out at your specific request (GDPR Article 6(1)(b)).

10.6 Your Rights

ACO Credentials are deleted from local storage when you stop the service. To revoke consent at any time, stop or cancel your active ACO service by contacting us. For your Discord username in log channels, you may request deletion at any time by contacting us — we will purge the relevant entries promptly.

10.7 Third-Party Platforms

We are not responsible for how third-party platforms (e.g., retailers) process data arising from automated purchases made on your behalf. You remain bound by their own privacy policies and terms of service.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. We will notify users of any significant changes by posting the new policy on our website, announcing it in our Discord server, or contacting users directly when appropriate.

We encourage users to review this Privacy Policy periodically. Continued use of our services after any modifications constitutes acceptance of the updated policy.