Revendor
Back to home

Privacy Policy

Last updated : 6 October 2026

1. Data controller

For the personal data concerning you, described in article 2, the data controller is:

  • Name: Alexandre Duro (sole trader)
  • Address: 1 avenue de paillet, 64200 Biarritz, France
  • Company number (SIRET): 90751364200039
  • Email: [email protected]

2. Data we collect

When you use Revendor, we collect the following data:

  • Identification data: first name, last name, email address, display language
  • Connection and device data: IP address, connection logs, browser, push notification subscriptions
  • Payment data: securely processed by our provider Stripe (we do not store your card details)
  • Connected selling accounts: username, email address, country, currency and profile picture of the accounts you link to the service
  • Selling activity: your listings and wardrobe, your sales and purchases, prices, brands, sizes, item photos, parcels and shipment tracking, stock, expenses and invoicing settings
  • Messaging: the content of conversations held from your selling account, their attachments and the offers sent or received
  • Inbox, if you connect it: the access tokens issued by Google and the reading of marketplace notification emails only, in order to extract pickup codes and collection point addresses. This connection is optional and revocable at any time
  • Usage data: usage statistics for the extension and the dashboard
  • Sign-up origin: the page through which you arrived on our site, the site that sent you there, the campaign parameters of the link (UTM, type of advertising identifier, without its value), the pages viewed and the buttons clicked before you created your account. This information stays in the page, with no cookie or storage in your browser, and is only sent to us when you create your account

3. Data concerning third parties

The service also processes personal data relating to the people you interact with on the selling marketplaces: buyers, sellers and people who have contacted you. This covers their username, their country, the content of the messages exchanged with you and their attachments, as well as — where this information is needed for shipping or invoicing — their name, postal address and email address.

For this data, you are the data controller and Revendor acts as a processor, within the meaning of article 28 GDPR. Revendor processes it solely on your instructions and for the purposes of the service, never for its own purposes. The corresponding commitments are set out in our data processing agreement, which forms an integral part of the contract.

It is your responsibility to ensure you have a legal basis for this processing and to inform the people concerned. Anyone wishing to exercise their rights over this data must contact you; you may write to [email protected] for our assistance.

4. Purposes of processing

Your personal data is collected for the following purposes:

  • Creating and managing your user account
  • Providing and improving our services
  • Managing subscriptions and payments
  • Communicating about your account and our services
  • Producing your invoices and accounting records
  • Tracking your shipments and parcels
  • Extracting pickup codes and addresses from your notification emails, if you connect your inbox
  • Customer support
  • Complying with our legal obligations
  • Producing aggregated, anonymised market statistics (see the “Aggregated and anonymised statistics” section)

5. Legal basis for processing

The processing of your personal data is based on:

  • Performance of the contract: to provide our services
  • Your consent: to send marketing communications
  • Our legitimate interest: to improve our services
  • Our legal obligations: to retain certain data
  • Our legitimate interest: to produce aggregated, anonymised market statistics

6. Aggregated and anonymised statistics

From the selling activity of all users, we compute market statistics that we may publish on our website: for example the median sale price per brand, or how sales are spread across the days of the week.

  • Data used: only data describing your items and your sales (brand, price, date). No data about third parties — buyers, people you talk to, addresses, messages — is used in these calculations.
  • Aggregation: a figure is only published if it is computed from at least 20 distinct selling accounts and 100 sales. No result is ever published per user, per account or per item.
  • Anonymity: the published statistics do not make it possible to identify you, your selling accounts or your items.

You can object to your activity being included in these calculations by writing to us at [email protected]: it will be excluded from the next update.

7. Retention periods

Your personal data is retained for:

  • Account data: for the whole duration of your registration, then 3 years after your account is deleted
  • After a deletion request: your account and your data are kept for 30 days, so you can cancel in case of mistake or a hijacked account, then erased. You can waive this delay and ask for immediate erasure
  • Billing data: 10 years (legal obligation)
  • Connection logs: 1 year
  • Selling activity and messaging data: for the whole duration of your registration, then deleted with your account. Raw data returned by the marketplaces is purged automatically once processed
  • Inbox access tokens: until you disconnect your inbox or delete your account

8. Recipients of the data

Your data may be transmitted to:

  • Stripe: for payment processing
  • Vercel: for hosting the site
  • Supabase: for data storage
  • PostHog (hosted in the EU — eu.posthog.com): for site usage analytics, with your consent only
  • DeepSeek: for AI-assisted generation (listing descriptions, listing variations, and automatic messages, when you explicitly enable these features). When the "AI auto-messages" feature is enabled, the title of the item concerned, your correspondent’s username on the marketplace and your custom instructions are sent to DeepSeek to generate the message. No banking data, no email address and no payment information is ever sent to DeepSeek.
  • Cloudflare: for hosting item photos and service images
  • Resend: for sending emails related to your account
  • Upstash: for technical caching and request rate limiting
  • Google: only if you connect your inbox, to read marketplace notification emails there
  • Discord: only if you enable Discord notifications, to deliver them to you

These providers offer appropriate safeguards for the protection of your data. PostHog is hosted in the European Union. DeepSeek may process your data outside the European Union; you can disable the AI features from the extension settings at any time to prevent these transfers.

9. Your rights

Under the GDPR, you have the following rights:

  • Right of access: obtain a copy of your data
  • Right to rectification: correct inaccurate data
  • Right to erasure: request deletion of your data
  • Right to portability: receive your data in a structured format
  • Right to object: object to the processing of your data
  • Right to restriction: restrict the processing of your data

You can exercise the right of access and the right to portability yourself from your account settings: the "Export my data" button gives you a complete JSON file, immediately.

For the other rights, contact us at: [email protected]

You may also lodge a complaint with the CNIL, the French data protection authority, or with the supervisory authority of your own country.

10. Cookies

Our site uses cookies that are essential to the operation of the service:

  • Session cookies: to keep you logged in
  • Preference cookies: to remember your choices

We also use analytics cookies (PostHog) to understand how our site is used. These cookies are only activated after your explicit consent through the cookie banner. You can withdraw your consent at any time by deleting the analytics_consent cookie from your browser.

We do not use advertising cookies or third-party tracking.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction.

12. Changes

We reserve the right to amend this privacy policy at any time. Changes take effect as soon as they are published on this page. We encourage you to review this page regularly.

13. Contact

For any question about this privacy policy or your personal data, contact us at: [email protected]