Vestoora privacy policy

Platform operator

Scope and application

Vestoora is an online intermediary marketplace. The sale contract for an item is made directly between the buyer and the seller; the operator is not the seller of user-listed goods.

Only persons aged 18 or older may use the platform. Private and business sellers must provide truthful information and select the correct market.

Operating rules

• The controller processes account, email verification, listing, messaging, transaction, complaint, notice, security and device data needed to provide the service.
• Legal bases include contract performance, legal obligation, legitimate interests in security and claims, and consent where required. Data is not sold.
• Active providers include IONOS for hosting and DNS, Stripe for payments and seller verification, Resend for transactional email, and Groq for the AI operations described below. Each receives only the data needed for its role.
• Individuals may exercise access, correction, deletion, restriction, portability and objection where applicable, and complain to AEPD in Spain or UODO in Poland. Retention follows purpose, limitation periods and tax duties.

AI assistance and Groq

• Groq is the active AI processing provider used by Vestoora's service. The current Vestoora app invokes Groq when a user chooses the optional Smart Sell assistant. That request contains the requested language, country or market selection, listing category, brand, condition, colour, size, whether photos exist, and only whether a city and price were provided. It does not deliberately add photo bytes, the city value, the price amount, an account identifier, email address, phone number, device identifier or Vestoora request identifier.
• Vestoora also supports Groq-assisted translation, listing and message safety classification, and dispute-summary operations. If one of those operations is invoked, Groq receives the relevant raw text, target language, optional listing category, or buyer and seller dispute evidence, each text field limited to 4,000 characters. Such user-written text can contain names, contact details, addresses, transaction references or other personal information supplied by the user.
• The purposes are listing assistance, translation, safety-risk classification and a neutral summary for a human dispute reviewer. Groq does not receive a binding enforcement decision from these operations, and core account access and marketplace browsing do not require the Smart Sell assistant.
• Vestoora does not create a separate durable copy of AI prompt or response content in its AI activity records. For duplicate-request protection, the service holds a cryptographic input fingerprint, request identity and the in-flight or completed response only in temporary process memory, with a code-enforced maximum of one hour. Source listing, message and dispute records remain subject to Vestoora's ordinary retention rules; automated deletion periods for those source records are not yet configured.
• For conservative Google Play disclosure, transfers to Groq are treated as shared with a third party and not ephemeral. Groq's current documentation says ordinary inference inputs and outputs are not retained by default, but may be logged for platform reliability or abuse investigation for up to 30 days; usage metadata is always retained. Groq offers a Zero Data Retention (ZDR) control, but Vestoora has no verified account-level evidence that ZDR is enabled and therefore does not claim zero retention.
• Groq documents that retained customer data is stored in United States Google Cloud Platform buckets and publishes a DPA with controller-to-processor terms and SCCs. Evidence that the Vestoora owner account is bound to the current DPA and configured as required has not been verified, so Vestoora does not rely on a service-provider exception for the store disclosure.

Rights and contact

Questions, complaints, notices of illegal content and privacy requests may be sent to Vestoora's public contact. The message should describe the matter and provide the information needed to identify it, without sending passwords or card data.

A material new version is published under a new number and requires express acceptance for the relevant market, language and role. Silence does not constitute acceptance.

This language version has the same identifier and scope as the Polish and Spanish versions. In case of discrepancy, mandatory law of the applicable market prevails.