Legal
What we collect, why we are allowed to, who else touches it, and the rights you have. Written to be read, not to be skipped.
Last updated 11 October 2026
Vintify is a UK business operating from the United Kingdom, and is the trading name used throughout these pages. Our full registered business details are published here before any paid subscription opens, and are available on request at any time at hello@getvintify.com.
We are the data controller for the personal data described in this policy, except where we say otherwise in “Your buyers’ data”.
For anything about your data, email hello@getvintify.com. We answer data protection requests within one month, as the law requires.
We collect only what the service needs to work:
We never ask for, receive or store a Vinted, eBay or Discord password. Vinted access is through a token you copy from your own browser; eBay access is through eBay’s own sign-in; Discord tells us who you are without sharing your credentials.
The app never reads your Vinted messages and keeps no buyer’s delivery address.
We never receive your card number, expiry date or security code. Payments go directly to Stripe.
We do not buy personal data from anyone, and we do not sell yours to anyone.
Data protection law requires us to have a lawful basis for each purpose. Ours are:
The app keeps no buyer addresses. Even so, data read from your marketplace accounts can contain personal data about other people, such as an order reference or a buyer’s username. For that data, you are the controller and we are your processor: it is your data about your customers, we only hold it to provide the service to you, and we act on your instructions.
As your processor we commit to the following, which together satisfy Article 28 of the UK GDPR and form part of our agreement with you:
Your database sits in the European Economic Area. Some of our providers, including Stripe, Discord and Anthropic, are based in the United States or process data there.
Where data leaves the UK or EEA we rely on the safeguards the law requires: the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or an adequacy decision covering that country. You can ask us for details of the safeguard used for any provider.
We keep your account and trading data for as long as your account is open, because the whole point of the product is the history. After your plan ends you can still sign in to download or delete it.
When you delete your account we delete its data within 30 days, apart from anything we are legally required to keep: invoices and payment records, which we keep for six years to satisfy HMRC.
Technical logs and error reports are kept for up to 90 days. A waitlist email is kept until Vintify opens and you have been told, or until you unsubscribe, whichever is sooner.
Under UK and EU data protection law you can ask us to:
Please tell us first at hello@getvintify.com; we would rather put it right.
You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator: ico.org.uk, or 0303 123 1113. If you are in the EU, you may complain to your own country’s supervisory authority instead.
Everything travels over encrypted connections. There is no password to protect, because sign-in is through Discord. Your Vinted token is encrypted at rest with a key kept outside the database.
Every query in the application is scoped to the account that made it, so one member’s data cannot be returned to another. Public endpoints are rate-limited, and the server only fetches from an allowlist of hosts.
Access to production systems is limited to those who need it. If a breach ever affects your rights and freedoms, we will tell the ICO within 72 hours and tell you without undue delay, as the law requires.
No system is perfectly secure, and we will not pretend otherwise. What we can promise is that we will tell you quickly and honestly if something goes wrong.
We do not make decisions with legal or similarly significant effects about you by automated means alone.
The app does flag things on your behalf, such as a listing that has gone stale or a price that could be dropped, within thresholds you set. Those are suggestions; the app never acts on a marketplace for you.
Vintify is for people aged 18 and over. We do not knowingly collect data about children. If you believe a child has given us personal data, tell us at hello@getvintify.com and we will delete it.
If we make a change that materially affects how we use your data, we will email you at least 30 days beforehand.
Minor clarifications take effect when published. The date at the top always shows the current version.
Questions about this policy? Email hello@getvintify.com or use the contact form.