Privacy policy

1. Data controller

[PENDING: name], tax ID [PENDING: taxId], with address at [PENDING: address]. Contact for privacy matters: [PENDING: email]. We have not appointed a data protection officer because we are not required to.

2. What data we process

• Data from your Google account when you sign in: identifier, email address and name. We do not store your Google photo: avatars are generated automatically.
• Data you give us when you register: full name, phone number, preferred app to reach you (WhatsApp or call), city and your weekly availability.
• Approximate location, only if you choose to share it: it is rounded to about 1 km in your browser before it is sent, is used only to sort the nearest trusted spots, and is shown to no one. You can remove it at any time.
• Your activity: listings, favourites, bids, interests, deals, meetup proposals, notifications and the ratings you receive. Internal notes a trusted spot leaves about a meetup are seen only by the team.
• Purchases of paid services: item, amount, status and date. Stripe processes the payment and we do not store your card details.
• Technical data: a salted hash of your IP address to limit abuse, and the logs of the hosting servers. If you have not set your city, we use on the spot the approximate city inferred from your connection (without storing it) to show you the listings of your area first.
• If you apply to register a trusted spot: the details of the place and of the contact person you provide.

3. Purposes and legal basis

• Providing the service (creating your account, publishing listings, handling bids, deals and meetups, notifying you): performance of the contract you accept when registering.
• Keeping the platform safe (preventing fraud and abuse, rate limiting, moderating, calculating reputation and deactivating inactive accounts): our legitimate interest.
• Using your approximate location to sort trusted spots: your consent, which you can withdraw at any time without affecting the rest of the service.
• Meeting tax and commercial obligations for paid purchases: legal obligation.

4. Who sees your data

• Other users see your public name (your first name and the initial of your surname), your city, your listings and your reputation (stars, total and average per role). They never see your email, phone number or full name.
• The trusted spot where you have a meetup sees your full name and phone number, only for that meetup and to be able to reach you in case of an incident. It acts as an independent controller of that data and undertakes to use it only for that purpose and not to keep it longer than necessary.
• The Pokemarket team can see the data needed to operate and moderate the service.

5. Providers involved

To provide the service we use providers that process data on our behalf (processors) or as their own controllers:

• Supabase: database and sign-in.
• Vercel: hosting of the application.
• Upstash: rate limiting (technical identifiers only).
• Stripe: payments for optional services (independent controller for its own purposes).
• Google: sign-in with your Google account.
• Providers of card, price and certificate data, and the map service that names your approximate area: they receive only card data or rounded coordinates, never your account data.

6. International transfers

Some of these providers may process data outside the European Economic Area, for example in the United States. In that case we make sure there are adequate safeguards, such as the adequacy decision of the EU-US Data Privacy Framework when the provider is certified, or the European Commission's standard contractual clauses.

7. How long we keep it

• While your account is active.
• If you ask to leave, we delete or anonymise your data, except what we must keep by law or to handle claims. Ratings and deal records are kept anonymised so that other people's reputation is not altered.
• Tax and commercial documents for paid purchases, for the legal periods (generally between 4 and 6 years).
• Technical anti-abuse data, only for as long as strictly necessary.

8. Your rights

You can access your data, rectify it, erase it, object to its processing, restrict it and ask for its portability. Write to [PENDING: email] from your account email and we will reply within one month, extendable in complex cases.

If you are not satisfied with how we process your data, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the authority of your country.

9. Minors

Pokemarket is only for people aged 18 or over. If you know of an account belonging to a minor, tell us at [PENDING: email] and we will close it.

10. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects on you. Deactivating accounts after 180 days without activity is automatic and you are warned in advance. Reputation is based on ratings given by people.

11. Security

We apply reasonable technical and organisational measures: encrypted connections, access to data only from the server with permission checks, rate limiting and separation of what each type of user sees. No system is infallible: if a breach affecting you occurs, we will tell you as the law requires.

12. Cameras at trusted spots

Some trusted spots have video surveillance. They run it as controllers of their own cameras and must inform visitors on their premises.

13. Changes

If we change this policy in a significant way, we will tell you. The date of the last update is shown on this page.