Privacy Policy

Scope and controller

This Privacy Policy applies to the ReList mobile application, website, web workspace, support channels and related marketplace services (together, the Service). Relist MB, company code 307534579, is the controller of personal data used to operate the Service.

ReList is established in Lithuania and makes the Service available only in the EEA and United Kingdom countries shown as supported inside the Service. For privacy questions or requests, email info@joinrelist.com, call +370 691 49477, or write to Aušros Vartų g. 13-13, LT-01304 Vilnius, Lithuania.

Before continuous United Kingdom availability begins, ReList will confirm whether a UK GDPR representative is required and publish that representative’s details here before the appointment becomes applicable. Until then, contact Relist MB directly using the details above.

Personal data we collect

Depending on how you use ReList, we process:

• Account and identity data: email, password hash, permanent username, region, language, roles, email-verification state, profile photo and account status. Where Baltic phone verification is required, ReList keeps a protected one-way phone identifier, country code, last four digits and verification timestamp rather than the complete phone number.
• Optional marketplace profile data: Vinted username, profile link, screenshots or other evidence you choose to submit, and the related consent record. ReList does not treat this as permission to scrape your external account.
• Marketplace content: stock listings, descriptions, prices, product and photo-pack images, availability, listing URLs, final sale information and supplier terms.
• Order and fulfilment data: purchases, credit movements, external sale information, courier labels or references, tracking, delivery status, timestamps, refund evidence and dispute outcomes.
• Payment and payout data: payment references, balances, ledger entries, refunds, connected-payment-account status and masked bank or identity-verification status. Stripe and Apple may collect complete payment, bank or verification details directly under their own notices.
• Communications and trust data: transaction messages, support enquiries, reviews, reports, blocks, moderation decisions and appeal information.
• Device and security data: IP address, session and device labels, installation identifier, app version, operating system, push token, notification choices and technical/security logs.

Profile photos and external marketplace details are optional. Email, password, username, region and role information are necessary to create and secure an account and provide the requested Service.

Where data comes from

Most data comes directly from you. We also receive transaction-related information from the other participant in an order, status and payment information from Apple or Stripe, verification results from our email and SMS providers, delivery information you or the other participant submit, and technical information from the device or browser used to access ReList.

If another user provides information about you in a report, review, label or transaction, we use it only for the relevant order, safety, support or legal purpose. We may verify trader, payment or fraud information through service providers or official/public records where permitted by law.

Why we use data and our legal bases

Where we rely on legitimate interests, we consider the impact on your rights and use only data reasonably necessary for the stated purpose. You may object as explained below.

What is public and what is shared

Your permanent username, profile photo, region, ReList roles, ratings, verified reviews and public stock listings can be visible to other users. Your email, password, complete bank data and identity documents are not public.

After a paid transaction, relevant participants can see the information needed to complete it, including usernames, messages, photo sets, order status, courier information and evidence each participant submits. A downloaded photo pack can be retained by its authorised recipient subject to the licence in the Terms.

Support staff can access support conversations. Authorised moderators may access content connected to a report, refund claim or safety review; administrator status does not provide unrestricted access to every private conversation.

Service providers and other recipients

We disclose only the data needed for a recipient’s role. Recipients may include:

• Apple for iOS in-app credit purchases and purchase reversals;
• Stripe for payments, connected accounts, identity/bank verification, refunds and supplier payouts;
• Expo for app delivery and push notifications;
• Railway and S3-compatible infrastructure for the production API, PostgreSQL database, private media storage and delivery where enabled;
• OpenAI Sites for the public website and web workspace;
• Resend for transactional verification and account-recovery emails;
• Twilio Verify for one-time Baltic phone-verification SMS. Twilio receives the complete number to deliver and check the code; ReList retains only the protected identifier and limited display details described above;
• professional advisers, auditors, insurers and authorities where required by law or reasonably necessary to establish, exercise or defend legal claims.

Apple, Stripe and external marketplaces may act as independent controllers for their own legal, payment, fraud or platform purposes. Their own privacy notices also apply.

International transfers

ReList is operated from Lithuania. Some service providers may process data from countries outside the EEA or United Kingdom. Before making a restricted transfer, we require a lawful transfer mechanism, such as an adequacy decision, approved standard contractual clauses with appropriate supplementary measures, or the applicable UK transfer mechanism.

You may contact us for information about the relevant transfer safeguard. EEA and UK privacy regimes are separate; a transfer permitted under one regime is assessed independently under the other.

How long we keep data

We apply the following retention rules, subject to legal holds, active disputes and longer periods required by law:

• Access credentials and sessions: access tokens are short-lived (approximately 15 minutes); refresh sessions normally expire after 30 days and are removed earlier on logout, revocation or account deletion.
• Active account and marketplace data: kept while the account, listing or order is active and then only for the purposes described below.
• Transaction, refund, fulfilment, invoice, ledger and payout records: generally 10 years after the relevant transaction or contract is completed where needed for Lithuanian accounting, tax, audit, marketplace or legal obligations.
• Ordinary messages and support content: kept while the relevant order or support issue is active; completed threads are archived. On eligible account deletion, ordinary text is redacted, while transaction or reported content may remain as evidence for the applicable retention period.
• Media: ordinary profile and listing media is removed when no longer needed or on eligible account deletion. Paid photo sets, funded labels and refund/safety evidence may be retained with the transaction or dispute record.
• Reviews and moderation records: reviews remain available to protect marketplace reputation and become pseudonymous if the author deletes their account. Safety and moderation evidence is kept for as long as reasonably necessary in light of severity, repeat-risk and legal limitation periods, and is reviewed periodically.
• Push and device records: kept until the device token becomes invalid, notifications are disabled, the device is removed or the account is deleted.

When data is no longer required, we delete, redact, anonymise or securely isolate it. Residual copies may remain temporarily in protected backups until overwritten under the provider’s normal cycle.

Cookies, SDKs and analytics

The web workspace uses strictly necessary, HttpOnly authentication cookies to keep you signed in and protect the session. The access cookie is short-lived and the refresh cookie normally lasts 30 days. These cookies are not used for advertising.

The mobile app uses device storage and service SDKs needed for authentication, payments, media selection and optional push notifications. ReList does not use marketing analytics, behavioural advertising, ad identifiers or cross-app tracking at launch. If this changes, we will update this Policy and obtain consent where required before enabling non-essential technologies.

Automated rules and human review

ReList uses rule-based automation to calculate fees and deadlines, detect duplicate photo files, update order states and create a deadline review when a confirmed supplier deadline is missed. Fraud and security signals may temporarily restrict a transaction or require additional verification.

We do not intend to make decisions that produce legal or similarly significant effects solely by automated processing. You can contact support to request human review of a deadline, duplicate-content, refund, moderation, payout or account decision.

Your privacy rights

Depending on the processing and your location, you may request access, correction, deletion, restriction, portability or a copy of your data, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.

Your right to object: you may object to processing based on our legitimate interests. ReList does not conduct direct marketing at launch; if direct marketing is introduced, you may object to it at any time and we will stop using your data for that purpose.

The app provides a JSON export and account-deletion process. Deletion can be delayed where an active paid order, refund, dispute, non-zero balance, withdrawal or failed payment operation must first be resolved. Eligible deletion revokes sessions, removes credentials and public profile data, and pseudonymises records that must be retained.

Send a request to info@joinrelist.com. We may ask for proportionate information to verify that the request concerns your account. We normally respond within one month, subject to extensions permitted by law.

Complaints to a supervisory authority

Please contact us first so we can try to resolve the issue. You may also complain to the Lithuanian State Data Protection Inspectorate, the authority where you live or work in the EEA, or the UK Information Commissioner’s Office if the matter concerns UK data-protection law.

Security

We use access controls, password hashing, short-lived access tokens, revocable device sessions, private object storage, signed media links and operational monitoring intended to protect personal data. Payment and full bank-verification details are handled by specialised payment providers rather than displayed publicly in ReList.

No system is completely secure. Keep your password and verification codes private, use a unique password, and tell us promptly if you believe your account or data has been compromised.

Adults only

ReList is for people aged 18 or older and is not directed to children. Do not create an account or submit another person’s personal data if you lack the legal capacity or authority to do so. If we learn that an under-18 account was created, we may suspend it and delete or restrict the associated data as required by law.

Changes and contact

We may update this Policy when the Service, providers or law changes. Material changes will be notified through the Service or by email before they take effect where required. The effective date and version at the top identify the current notice.

Contact Relist MB at info@joinrelist.com, +370 691 49477, or Aušros Vartų g. 13-13, LT-01304 Vilnius, Lithuania.