Privacy Policy — draft

This notice explains the data used by Reselling AI Assistant. Draft updated 30 September 2026; owner details and operational settings still need confirmation.

Information we process

• Account: email, optional display name, account ID, verification status and sign-in/session information. Supabase manages password authentication.
• Your workspace: uploaded item photos, inventory, prices, measurements, notes, saved AI analyses and listing drafts. An analysis can be saved to cloud history even if you do not save an inventory item.
• Service operation: feature usage records and technical request information processed by our hosting/authentication providers, such as IP addresses, timestamps and errors.
• Support: information you choose to send when a contact channel is available.

Why we use it

We use account and workspace data to provide the service you request (contract). We use limited operational information to secure, troubleshoot and maintain the service (legitimate interests), balancing those interests against your rights. Legal obligations may require some records to be retained. The owner must confirm this lawful-basis assessment and any additional processing before launch.

Photos and AI

Photos are compressed in your browser. When you request analysis or drafts, relevant photos and item details are sent through our server to OpenAI for processing. Avoid faces, addresses, documents or other unnecessary personal information in item photos. Saved photos use private Supabase storage and temporary signed links; anyone given such a link may access it until expiry. They are not public gallery content.

OpenAI, Supabase and Vercel process data to supply AI, authentication/database/storage and hosting services respectively. We do not claim zero retention, a particular processing region or a special training exclusion beyond the providers’ applicable terms and configured settings. The owner must verify provider retention, contracts, regions and international transfer safeguards before launch.

Cookies and browser storage

Essential HttpOnly session cookies keep you signed in: the access cookie follows the session lifetime (normally about one hour; the app caps it at one day), and the refresh cookie lasts up to 30 days. Logging out clears these cookies. This version adds no advertising or optional analytics cookies. Older locally saved inventory may be imported on sign-in; the app removes its legacy browser record after successful migration.

Sharing and marketplace use

The app uses the service providers described above. It does not sell your private inventory or photos. Marketplace account integrations are not yet live. Copying a draft and publishing it yourself shares it under that marketplace’s rules. Future authorised connections will explain their permissions and data flows before you connect.

Retention and deletion

Workspace records are kept while your account is active unless removed. Removing an inventory item does not necessarily remove photo files or separate historical analyses. Completed account deletion removes the account, related active database records and private photo files. Backup, security-log and provider retention may differ; exact schedules are [OWNER TO CONFIRM]. Deletion does not remove listings or copies you placed elsewhere. See the deletion process.

Your UK data protection rights

Depending on the circumstances, you can ask to access, correct, erase, restrict or transfer your personal data, or object to processing. Where processing relies on consent, you can withdraw it. Requests may need identity verification and are normally answered within one month, with permitted extensions explained. Contact the privacy address above once supplied. You can complain to the Information Commissioner’s Office (ICO).

Changes

We will update this notice when processing changes. Material changes should be brought to users’ attention. This draft must be completed and reviewed by the operator before public launch.