プライバシーポリシー

最終更新日: 2026-07-14

This Privacy Policy explains what personal data Sellboard collects and processes, for what purposes and on what legal basis, who we share it with, and what rights you have under the GDPR. Sellboard is a classifieds marketplace where users post and browse listings, message each other, and — for service listings — make bookings. The service may only be used by people who are at least 18 years old.

Data controller

The data controller is Smart Software registered at Gorczyn 64B, 98-100 Łask. For any data-protection matters you can reach us at [email protected].

What we collect

• Account data: e-mail address, display name, a hashed password or a Google/Facebook sign-in identifier, an optional contact phone number, and your chosen interface language.
• Email-verification codes sent when confirming your e-mail address (one-time 6-digit codes).
• Listing content: title, description, price, category and attributes, city/region and a precise map location (coordinates), and photos. Uploaded photos are re-encoded server-side to JPEG, which strips EXIF metadata (e.g. GPS or camera data) — an additional safeguard for your privacy.
• Messages exchanged with other users, and bookings made for service listings.
• Technical data: IP address (obtained via Cloudflare and used for security, rate-limiting, and abuse prevention), browser type and user-agent, and listing view counts.
• Moderation data: reports about listings, and records of any account suspension (suspensions are reversible).
• Cookies — see the Cookie Notice for details.

Purposes and legal bases

• Providing the service (account creation and management, listings, messaging, bookings) — performance of a contract (Art. 6(1)(b) GDPR).
• Security, fraud and abuse prevention, content moderation, basic cookieless analytics, and backups — our legitimate interest (Art. 6(1)(f) GDPR).
• Complying with legal obligations, e.g. responding to lawful authority requests — legal obligation (Art. 6(1)(c) GDPR).
• Where you choose to sign in via Google or Facebook — your consent (Art. 6(1)(a) GDPR). We do not currently send marketing communications.

Who we share data with

We rely on a small number of trusted service providers (processors), who only receive data to the extent needed to run the service:

• Cloudflare, Inc. — CDN, secure tunnel, TLS encryption, DDoS/WAF protection; Cloudflare Web Analytics (a cookieless tool that collects no personal data and needs no consent); Cloudflare Turnstile — anti-bot protection that may set a short-lived security cookie.
• Google — Google sign-in (OAuth), for users who choose to use it.
• Meta / Facebook — Facebook sign-in (OAuth), for users who choose to use it.
• Email/SMTP provider — sends verification codes and transactional e-mails (processes your e-mail address).
• OpenStreetMap Foundation — supplies map tiles; when a listing's map loads, your IP address is sent to OSM's tile servers.
• Backblaze (B2) — encrypted, off-site backups of the database and images.
• Hosting provider (VPS) — hosts the server, located within the EU.

International transfers

Some of the providers above (including Google, Meta, Cloudflare, and Backblaze) may process data outside the European Economic Area. Where this happens, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission.

Retention

We keep account and listing data for as long as your account exists. When you delete your account, personal data is erased or anonymized; records shared with other users (messages, bookings) are retained in anonymized form. Backups are rotated automatically — kept for 7 daily and 4 weekly generations — and then permanently purged.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict the processing of, and port your data, and to object to processing, as well as the right to withdraw consent at any time (without affecting the lawfulness of processing carried out before withdrawal). You can delete your account yourself at any time from your profile page. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), if you believe our processing violates data-protection law.

Contact

For any privacy-related question, contact us at [email protected].