Privacy Policy for ItemifAI

1. Data Controller

The Data Controller of your personal data is Mariusz Uziębło. For any questions regarding data protection or to exercise your rights, you can contact the Data Controller via email at: mariusz.9dev@gmail.com.

2. Data We Collect and How We Authenticate

• Registration and Authentication Data: You can use the Application as a guest, without providing any personal data — in that case an anonymous account is created for you automatically. If you choose to create a full account, the Application uses a passwordless login system: you only provide your email address, to which a one-time security token (Magic Link/OTP) is sent. The Application does not collect, process, or store user passwords.
• User Content: We process and store materials, texts, or files that you input into the Application to provide its core functionalities. This includes the photographs of items you wish to sell: a copy is kept on your device, and a copy is uploaded to and stored on our servers so that your listing history remains available to you. These images are deleted when you delete the listing or your account.
• Usage and Device Data: We collect basic technical information (operating system version, device model, Application version) and data about your activity within the Application to ensure its stability and improve performance.
• Device Identifier (Hashed): To prevent abuse of the free trial, the Application derives an identifier from your device — on Android the system-provided Android ID (SSAID), and on iOS a random identifier generated once by the Application and stored in the system Keychain. This value is hashed on your device before it is sent to us; the raw identifier never leaves your device. Our server adds a secret salt to the hash before storing it. We use it solely to count how many free generations have been used on a given device. It is not used for advertising, profiling, or cross-application tracking, and it is not shared with third parties.

3. Purpose and Legal Basis for Data Processing

Your data is processed for the following purposes:

• Providing electronic services (authentication, account maintenance) – Basis: necessity for the performance of a contract.
• Generating listing content (title, description, and price suggestion) from the photographs you submit – Basis: necessity for the performance of a contract.
• Subscription management and payment verification – Basis: necessity for the performance of a contract.
• Preventing abuse of the free trial allowance, for example resetting the free quota by reinstalling the Application or creating a new account – Basis: legitimate interest of the Data Controller.
• Providing technical support and communicating with users – Basis: legitimate interest of the Data Controller.
• Fulfilling legal obligations (e.g., tax and accounting requirements for purchases) – Basis: legal obligation.

4. Third-Party Services and Data Transfer

To ensure the proper functioning of the Application, we use specialized external service providers who process data on our behalf (Data Processors):

• Google (Gemini API): The photographs you submit, together with the accompanying instructions, are sent to Google's Gemini API, which generates the listing title, description, and price suggestion. This transfer occurs each time you generate a listing and is the core function of the Application. Google processes this content on our behalf under the paid tier of the Gemini API and, in accordance with the applicable Gemini API Terms of Service, does not use it to train or improve its models.
• Supabase / Amazon Web Services (AWS): Secure hosting of the database, user files, and management olivery system.
• RevenueCat: Subscription logic management, premium account status verification, and in-app purchase validation.
• App Stores (Google Play Store / Apple App Store): Direct execution of payment transactions. Neither the Data Controller nor RevenueCat has access to your credit card details or bank account information.

5. User Rights (GDPR Compliance)

You have the right to:

• Access your data and receive a copy of it.
• Rectify (correct) your data.
• Erase your data ("the right to be forgotten") – you can do this yourself directly within the Application.
• Restrict processing or object to the processing of your data.
• Lodge a complaint with a supervisory authority (e.g., the President of the Personal Data Protection Office in Poland or your local Data Protection Authority).

6. Data Security and Retention

Data is stored for the duration of your active user account. If you decide to delete your account, your data will be permanently erased within 30 days, with two exceptions:

• anonymized transaction data required by applicable tax laws;
• the salted hash of the device identifier described in Section 2. This value is deliberately retained after account deletion, because its only purpose is to prevent the free trial allowance from being reset by deleting an account and creating a new one. It is stored without a direct link to your account, and once your account is deleted nothing remains that would connect it back to you, your email address, or your content.