Privacy Policy

Facebook and Instagram enquiry forms

If you submit a ReList Instant Form on Facebook or Instagram, Meta provides us with the information you choose to submit, such as your name, email and optional telephone number, together with the form identifier, Meta lead identifier and submission time. We keep these in a private contact-management system to respond to your enquiry and record its progress. Submitting an enquiry does not create a ReList account or subscribe you to unrelated email campaigns.

Where the form explains advertising measurement and records the required permission, we may send the lead identifier and genuine progress events to Meta through its Conversions API. These include receipt of the enquiry, contact and creation of a ReList account. We match a successful website signup using the enquiry email; an authorised reviewer may also record a verified app signup. Email and any telephone number used for matching are normalised and SHA-256 hashed before transmission. Hashing is a security measure, not anonymisation. Private internal notes, passwords and account credentials are not included.

We use enquiry details to take steps you request before entering a contract, or to respond under our legitimate interest in handling enquiries. Optional advertising measurement relies on the permission described in the form. Website cookie choices apply to the separate website Pixel; to withdraw permission for lead-form measurement or request removal of an enquiry, email info@joinrelist.com. Removal stops queued conversion events; it cannot recall events already received by Meta. Meta processes information under its Privacy Policy.

Contact records are reviewed and removed when no longer needed for the enquiry or when a valid removal request is received, unless another retention requirement applies. Access is restricted to the ReList site owner. A previous launch-waitlist signup is not treated as permission for this CRM advertising measurement.

Optional website advertising measurement

With your permission, the ReList website uses Meta Pixel, provided by Meta Platforms Ireland Limited, to measure advertising results, improve Facebook and Instagram campaigns and build relevant advertising audiences. Advertising tracking is optional. Choosing “Reject advertising” leaves essential website features available.

After you allow advertising, Meta can receive your IP address, browser and device information, eligible page URLs, advertising cookie and click identifiers, and events such as a listing view, a search being made, a saved listing, a successful registration or waitlist request, checkout initiation and a confirmed web subscription purchase with its amount and currency. We do not send your search text, form contents, password, private messages, uploaded evidence, card details or bank details through these events. Automatic form-data matching is disabled in our integration.

Meta may connect this information with your activity on its services and process it under its Privacy Policy. This can involve processing outside the EEA and UK. See Meta’s Cookie Policy for its cookie uses and retention.

Our legal basis for this optional measurement and advertising is consent. The Pixel does not load before you allow it. You can change your choice at any time using “Cookie settings”; withdrawal stops future advertising events and removes accessible Meta advertising cookies set on this website. Withdrawal does not undo processing that already occurred. We honour the browser’s Global Privacy Control signal by keeping advertising tracking off.

We remember your advertising choice and the date in this browser for up to six months, then ask again. If you start a web subscription with advertising enabled, this browser temporarily stores the checkout reference, quoted amount and a random conversion identifier to match a confirmed payment and avoid duplicate events. This is used for at most 24 hours and is cleared when you reject advertising. Events are not collected retroactively for activity before consent. The native mobile app does not load this website Pixel.

Launch waitlist and website counts

If you join the launch waitlist, we store your name, email address, signup date and the version of the launch-notification consent you accepted. We use the list to email you about the ReList web app and mobile app launches. The list is accessible only to the site owner and may be exported for sending those announcements.

You can withdraw your request and ask us to remove your email at any time by contacting info@joinrelist.com. We retain the list until the launch announcements have been sent or you ask us to remove your entry.

The website also records aggregate daily page-view counts for the home and workspace pages, without analytics cookies or persistent visitor identifiers. These counts include repeat visits and are not a count of unique people. To limit automated requests, we temporarily store an hourly hash derived from the requesting IP address; we do not store raw IP addresses in the waitlist or page-view database. Expired request-limit records are removed as new requests arrive.

Scope and controller

This Privacy Policy applies to the ReList mobile application, website, web workspace, support channels and related marketplace services (together, the Service). Relist MB, company code 307534579, is the controller of personal data used to operate the Service.

ReList is established in Lithuania and makes the Service available only in the EEA and United Kingdom countries shown as supported inside the Service. For privacy questions or requests, email info@joinrelist.com, call +370 691 49477, or write to Aušros Vartų g. 13-13, LT-01304 Vilnius, Lithuania.

Before continuous United Kingdom availability begins, ReList will confirm whether a UK GDPR representative is required and publish that representative’s details here before the appointment becomes applicable. Until then, contact Relist MB directly using the details above.

Personal data we collect

Depending on how you use ReList, we process:

• Account and identity data: email, password hash, permanent username, region, language, roles, email-verification state, profile photo and account status. Where Baltic phone verification is required, ReList keeps a protected one-way phone identifier, country code, last four digits and verification timestamp rather than the complete phone number.
• Optional community information: city or town, how you found ReList, referral details, reselling experience, age group and gender if you choose to provide them during registration setup. We use these answers to understand our community and improve marketing. They are not shown on your public profile. Providing them does not subscribe you to marketing emails.
• Optional marketplace profile data: Vinted username, profile link, screenshots or other evidence you choose to submit, and the related consent record. ReList does not treat this as permission to scrape your external account.
• Marketplace content: stock listings, descriptions, prices, product and photo-pack images, availability, listing URLs, final sale information and supplier terms.
• Order and fulfilment data: purchases, credit movements, external sale information, courier labels or references, tracking, delivery status, timestamps, refund evidence and dispute outcomes.
• Product and sale verification: new camera photos, capture and upload times, device/platform details, image hashes and review history. With your permission, we collect location only while you take a supplier photo. Declining location does not by itself disable your account. Precise coordinates and original photo metadata are restricted to ReList reviewers and removed from images shared with other users. Sale videos show the marketplace transaction and are accessible only to the relevant reseller, supplier and authorized ReList reviewers. Record only the relevant transaction, with your microphone off.
• Payment and payout data: payment references, balances, ledger entries, refunds, connected-payment-account status and masked bank or identity-verification status. Stripe and Apple may collect complete payment, bank or verification details directly under their own notices.
• Communications and trust data: transaction messages, support enquiries, reviews, reports, blocks, moderation decisions and appeal information.
• Device and security data: IP address, session and device labels, installation identifier, app version, operating system, push token, notification choices and technical/security logs.

Profile photos and external marketplace details are optional. Email, password, username, region and role information are necessary to create and secure an account and provide the requested Service.

Camera, photo library and optional location

Listing cover photos may be selected from your photo library or files, or taken with the camera. We receive only the file you select; selecting a cover does not require camera or location access. Uploaded covers are checked and a copy without embedded location metadata is used for the listing. The original upload is queued for deletion after processing. Photos delivered to a reseller as a photo pack must be taken through the ReList camera.

When you choose to take a supplier listing or photo-pack picture, ReList asks your browser or device for camera access. The camera is used for that capture session; ReList does not record continuously or use the microphone to take a product photo. A photo you take is uploaded to provide the requested listing or photo pack and to support stock review. Avoid including faces, identity documents, addresses or unrelated personal information.

Original supplier photos, capture details and any supplied location are available to authorised ReList reviewers. A version with original location metadata removed is used for the listing or shared with the relevant photo-pack recipient. Listing images can be seen by other members and authorised recipients can download their photo packs. Original supplier photos and precise capture location are normally removed after 30 days through our deletion process.

Location is optional and is requested only in connection with taking a supplier photo. You may decline it and continue taking the photo. Camera permission enables the requested feature; it does not give blanket consent to unrelated processing. We use the photo to perform the requested service and review stock under our legitimate interest in preventing misleading listings. Optional precise location is used with your consent for that review.

You can revoke camera, photo-library and location permissions in your device settings or the browser’s site settings. If camera access is denied, you can browse and use other available account features, but cannot complete a fresh-camera photo submission until access is enabled. Where a photo picker is offered for a listing cover, avatar or claim, we receive the files you choose, not general access to every photo in your library.

Withdrawing a device permission stops future access. To request removal of a photo or location already submitted, contact info@joinrelist.com; the retention and legal exceptions below apply.

Where data comes from

Most data comes directly from you. We also receive transaction-related information from the other participant in an order, status and payment information from Apple or Stripe, verification results from our email and SMS providers, delivery information you or the other participant submit, and technical information from the device or browser used to access ReList.

If another user provides information about you in a report, review, label or transaction, we use it only for the relevant order, safety, support or legal purpose. We may verify trader, payment or fraud information through service providers or official/public records where permitted by law.

Why we use data and our legal bases

Where we rely on legitimate interests, we consider the impact on your rights and use only data reasonably necessary for the stated purpose. You may object as explained below.

What is public and what is shared

Your permanent username, profile photo, region, ReList roles, ratings, verified reviews and public stock listings can be visible to other users. Your email, password, complete bank data and identity documents are not public.

After a paid transaction, relevant participants can see the information needed to complete it, including usernames, messages, photo sets, order status, courier information and evidence each participant submits. A downloaded photo pack can be retained by its authorised recipient subject to the licence in the Terms.

Support staff can access support conversations. Authorised moderators may access content connected to a report, refund claim or safety review; administrator status does not provide unrestricted access to every private conversation.

Service providers and other recipients

We disclose only the data needed for a recipient’s role. Recipients may include:

• Apple for iOS in-app credit purchases and purchase reversals;
• Stripe for payments, connected accounts, identity/bank verification, refunds and supplier payouts;
• Expo for app delivery and push notifications;
• Railway and its Tigris-backed storage for the production API, PostgreSQL database, private media storage and delivery;
• Cloudflare for the public website and web workspace;
• Meta Platforms Ireland Limited for optional website advertising measurement and audiences, only after you allow advertising, as described above;
• Resend for transactional verification and account-recovery emails;
• Twilio Verify for one-time Baltic phone-verification SMS. Twilio receives the complete number to deliver and check the code; ReList retains only the protected identifier and limited display details described above;
• professional advisers, auditors, insurers and authorities where required by law or reasonably necessary to establish, exercise or defend legal claims.

Apple, Stripe and external marketplaces may act as independent controllers for their own legal, payment, fraud or platform purposes. Their own privacy notices also apply.

International transfers

ReList is operated from Lithuania. Some service providers may process data from countries outside the EEA or United Kingdom. Before making a restricted transfer, we require a lawful transfer mechanism, such as an adequacy decision, approved standard contractual clauses with appropriate supplementary measures, or the applicable UK transfer mechanism.

You may contact us for information about the relevant transfer safeguard. EEA and UK privacy regimes are separate; a transfer permitted under one regime is assessed independently under the other.

How long we keep data

We apply the following retention rules, subject to legal holds, active disputes and longer periods required by law:

• Access credentials and sessions: access tokens are short-lived (approximately 15 minutes); refresh sessions normally expire after 30 days and are removed earlier on logout, revocation or account deletion.
• Active account and marketplace data: kept while the account, listing or order is active and then only for the purposes described below.
• Transaction, refund, fulfilment, invoice, ledger and payout records: generally 10 years after the relevant transaction or contract is completed where needed for Lithuanian accounting, tax, audit, marketplace or legal obligations.
• Verification evidence: original supplier photos and precise capture location are retained for up to 30 days; sale verification videos for up to 90 days. Deletion runs through a retryable background process. Evidence that has expired must be submitted again if it is needed for a later review. Transaction decisions, hashes and audit records may remain for the applicable accounting, dispute and fraud-prevention period.
• Ordinary messages and support content: kept while the relevant order or support issue is active; completed threads are archived. On eligible account deletion, ordinary text is redacted, while transaction or reported content may remain as evidence for the applicable retention period.
• Media: ordinary profile and listing media is removed when no longer needed or on eligible account deletion. Paid photo sets, funded labels and refund/safety evidence may be retained with the transaction or dispute record.
• Reviews and moderation records: reviews remain available to protect marketplace reputation and become pseudonymous if the author deletes their account. Safety and moderation evidence is kept for as long as reasonably necessary in light of severity, repeat-risk and legal limitation periods, and is reviewed periodically.
• Push and device records: kept until the device token becomes invalid, notifications are disabled, the device is removed or the account is deleted.

When data is no longer required, we delete, redact, anonymise or securely isolate it. Residual copies may remain temporarily in protected backups until overwritten under the provider’s normal cycle.

Cookies, SDKs and analytics

The web workspace uses strictly necessary, HttpOnly authentication cookies to keep you signed in and protect the session. The access cookie is short-lived and the refresh cookie normally lasts 30 days. These cookies are not used for advertising.

The website’s optional Meta advertising cookies, including _fbp and _fbc where applicable, are separate from authentication and are enabled only with your advertising consent. The mobile app uses device storage and service SDKs needed for authentication, payments, media selection and optional push notifications. This website Pixel is not included in the native mobile app.

Automated rules and human review

ReList uses rule-based automation to calculate fees and deadlines, detect duplicate photo files, update order states and create a deadline review when a confirmed supplier deadline is missed. Fraud and security signals may temporarily restrict a transaction or require additional verification.

We do not intend to make decisions that produce legal or similarly significant effects solely by automated processing. You can contact support to request human review of a deadline, duplicate-content, refund, moderation, payout or account decision.

Your privacy rights

Depending on the processing and your location, you may request access, correction, deletion, restriction, portability or a copy of your data, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.

Your right to object: you may object to processing based on our legitimate interests and to direct marketing. You can withdraw optional website advertising consent through “Cookie settings” and request removal from the launch mailing list using the contact details above.

The app provides a JSON export and account-deletion process. Deletion can be delayed where an active paid order, refund, dispute, non-zero balance, withdrawal or failed payment operation must first be resolved. Eligible deletion revokes sessions, removes credentials and public profile data, and pseudonymises records that must be retained.

Send a request to info@joinrelist.com. We may ask for proportionate information to verify that the request concerns your account. We normally respond within one month, subject to extensions permitted by law.

Complaints to a supervisory authority

Please contact us first so we can try to resolve the issue. You may also complain to the Lithuanian State Data Protection Inspectorate, the authority where you live or work in the EEA, or the UK Information Commissioner’s Office if the matter concerns UK data-protection law.

Security

Connections to the ReList website, production API and media storage use HTTPS/TLS encryption in transit. The production API also uses an encrypted connection to its database. Our media-storage provider encrypts stored files at rest, including uploaded listing photos and private verification evidence.

We use access controls, password hashing, short-lived access tokens, revocable device sessions, private object storage, signed media links and operational monitoring intended to protect personal data. Payment and full bank-verification details are handled by specialised payment providers rather than displayed publicly in ReList.

This is transport and storage encryption, not end-to-end encryption. ReList and its authorised infrastructure providers can process content as needed to deliver the service, review stock, handle reports and meet legal duties. Encryption does not restrict a recipient from using an authorised downloaded copy under the applicable licence.

No system is completely secure. Keep your password and verification codes private, use a unique password, and tell us promptly if you believe your account or data has been compromised.

Adults only

ReList is for people aged 18 or older and is not directed to children. Do not create an account or submit another person’s personal data if you lack the legal capacity or authority to do so. If we learn that an under-18 account was created, we may suspend it and delete or restrict the associated data as required by law.

Changes and contact

We may update this Policy when the Service, providers or law changes. Material changes will be notified through the Service or by email before they take effect where required. The effective date and version at the top identify the current notice.

Contact Relist MB at info@joinrelist.com, +370 691 49477, or Aušros Vartų g. 13-13, LT-01304 Vilnius, Lithuania.