Privacy Policy
Information notice pursuant to Art. 13 of EU Regulation 2016/679 (GDPR)
Key Points
Data Controller
The Data Controller is Luviele, reachable at support@luviele.com. A Data Protection Officer (DPO) has not been appointed, as it is not required for the type and scale of this service.
Personal data processed
- Data provided directly by the user: email address, display name, profile photo, bio, country and city, WhatsApp number, links to social profiles and websites.
- Data generated by use of the service: published listings, images attached to listings, language and currency preferences, profile creation and update timestamps.
- Technical data collected automatically: IP address, browser type, pages visited (via Vercel Analytics, in anonymous and aggregated form).
- Google authentication data: if you sign in via Google, we receive your name, email address and profile photo from your Google account. We do not access any other data from your account.
Purposes and legal bases for processing
We process your personal data for the following purposes and on the following legal bases pursuant to Art. 6 GDPR:
| Purpose | Legal basis | Data involved |
|---|---|---|
| Account creation and management | Performance of a contract — Art. 6(1)(b) | Email, name, password hash |
| Public profile and listings | Performance of a contract — Art. 6(1)(b) | Profile, listings, images |
| Google authentication | Performance of a contract — Art. 6(1)(b) | Email, name, Google photo |
| Service communications | Performance of a contract — Art. 6(1)(b) | |
| Service security and fraud prevention | Legitimate interest — Art. 6(1)(f) | Technical logs, IP |
| Anonymous statistical analysis | Legitimate interest — Art. 6(1)(f) | Anonymous aggregated data |
Retention periods
Account and profile data is retained for as long as the account remains active. Upon account deletion, data is removed within 30 days. Uploaded images are removed when the related listing or profile is deleted. Anonymous technical logs are retained for a maximum of 90 days. Data required for legal or tax obligations is retained for the applicable statutory periods.
Recipients of data
- Supabase Inc. (USA) — database and authentication provider, acting as Data Processor pursuant to Art. 28 GDPR. Data is stored in European data centres (EU-West). Transfer to the USA is covered by Standard Contractual Clauses (SCCs) approved by the European Commission.
- Vercel Inc. (USA) — PWA hosting infrastructure. Processes technical data in anonymous form. Transfer to the USA is covered by SCCs.
- Google LLC — used for optional OAuth authentication. They apply their own privacy policy.
International transfers
Transfers of data to third countries (USA) are made in compliance with the guarantees provided by Arts. 46–49 GDPR, via Standard Contractual Clauses (SCCs) adopted by the European Commission. To request a copy of the safeguards adopted, write to support@luviele.com.
Data subject rights
As a data subject, you have the following rights under Arts. 15–22 GDPR: right of access (Art. 15), rectification (Art. 16), erasure (“right to be forgotten”, Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing (Art. 21). To exercise these rights, send a request to support@luviele.com. We will respond within 30 days. You also have the right to lodge a complaint with the competent supervisory authority.
Automated decision-making and profiling
We do not carry out any processing involving automated decision-making, including profiling, with legal or similarly significant effects on the data subject pursuant to Art. 22 GDPR.
Changes to this policy
We reserve the right to update this policy. In case of material changes, we will notify you via an in-app notice or by email.
🏛️ Supervisory authority: Garante per la protezione dei dati personali — www.garanteprivacy.it (Italy)
✉️ Contact: support@luviele.com