Privacy Policy

1. Data controller

The data controller is the operator of Direct Resell identified in the Legal Notice. This policy explains how we process your personal data under the EU General Data Protection Regulation (GDPR) and applicable laws.

2. Data we collect

• Account data, email address, password (stored hashed by our authentication provider), username, profile photo.
• Discord data (if you link Discord or post via our Discord community), Discord ID, username, avatar.
• Profile data you choose to add, social handles (X/Twitter, Instagram, Facebook), region.
• Marketplace activity, offers, photos, messages and photo attachments, orders, reviews and warnings.
• Payment-related data, order amounts, fees, payment status, Stripe identifiers. We never see or store your card number or bank details: they are collected directly by Stripe. Seller identity verification (KYC) is performed by Stripe.
• Technical data, IP address, logs and security signals processed by our hosting providers.

3. Purposes & legal bases

• Providing the marketplace, messaging and payment flow, performance of a contract;
• Fraud prevention, dispute resolution, reputation system, legitimate interest in a safe marketplace;
• Payment processing and seller verification, contract and legal obligations (anti-money-laundering rules applied by Stripe);
• Transactional notifications (e.g. an email or Discord message when you receive a message), performance of a contract; you can unlink Discord at any time;
• Security, logging, abuse prevention, legitimate interest.

We do not sell your personal data and we do not use it for third-party advertising.

4. Recipients & processors

• Supabase, database, authentication and file storage;
• Stripe, payment processing, escrow-style holding, seller KYC and payouts;
• Cloudflare, hosting, content delivery, security and transactional email;
• Discord, community integration and notifications, if you use Discord features.

Some providers may process data outside the EU/EEA; in that case transfers rely on safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions (including the EU-US Data Privacy Framework where applicable).

5. Retention

• Account and profile data, while your account is active, then deleted or anonymised;
• Offers, displayed 7 days, then archived;
• Messages, while both accounts exist;
• Order and payment records, up to 10 years where required by accounting and anti-fraud legislation;
• Logs, short rotation periods set by our providers.

6. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interest, and to withdraw consent where processing is based on consent. Contact us via the details in the Legal Notice or our Discord server. You may also lodge a complaint with your supervisory authority (in France: the CNIL, cnil.fr).

7. Cookies & local storage

The site uses only essential storage: authentication tokens (to keep you signed in) and technical security cookies set by our infrastructure provider. We use no advertising or cross-site tracking cookies, which is why no cookie consent banner is required.

8. Security & minors

Data is transmitted over HTTPS, stored with access controls, and payment data never touches our servers. The Service is not directed at children under 15; if you believe a child provided us data, contact us for deletion.

9. Changes

We may update this policy; the date above reflects the latest version, and material changes will be announced on the site or Discord.