Privacy Policy for Kraahl

Introduction

Kraahl SASU, 1 Rue des Près Monseigneur, 95400 Villiers-le-Bel, France (RCS Pontoise 938 253 085), is responsible for the personal data described in this policy. This Privacy Policy is intended to give an overview of how Kraahl may collect, use, and protect your personal information. The final content will be updated after legal review.

1. Information We Collect

We collect the information you give us: your name, email address, phone number, username, profile photo, banner, bio and shop notice, your country, your saved and shipping addresses, your listings and their photos, your collections, your messages, offers, bids, wants and reviews, the reports you send and the accounts you block, the messages you send us through the contact form or our feedback survey, and, if you enter a contest, the details you give for it. We keep a record of your orders and sales, with their payments, refunds, disputes, shipping labels and tracking, and of the listings you save, the accounts you follow and your listing alerts. We also keep your settings: your language and currency, your notification choices, your shipping methods and saved packages if you sell, and the categories and role you choose when you join. If you sell, we also keep the references of your PayPal or Stripe account.

When you use our website or app, we also collect technical and usage data: your IP address and the approximate location and internet provider it gives, device and browser information, your phone's notification token, sign-ins, the listings you view and the listings shown to you, your searches and your cart activity. We also receive information about you from others: from PayPal and Stripe (the status of your seller account and of your payments), from Shippo (tracking updates on your parcels) and from other users (for example, the reviews and reports they write about you). Your card and bank account numbers never reach Kraahl's servers: on the website you type them into PayPal's or Stripe's own form, and in the app our card form passes them straight to PayPal on your phone. PayPal and Stripe hold them.

2. How We Use Your Information

We use this information to run Kraahl: to create and secure your account, show your listings, process sales, payments, refunds and shipping, deliver messages and updates, remind you about listings you saved, personalize what you see, keep the records the law requires (see section 6), and improve the service. Unless you turn it off, we may also email you once to invite you to start selling. Our team may also email all accounts with news about Kraahl or a request for feedback, such as a survey; turning off notifications does not stop these emails.

We rely on these legal bases, which we are confirming with our legal counsel: performing our contract with you (your account, listings, sales, payments, refunds, shipping and messages); our legal obligations (the accounting, tax and seller records described in section 6, and requests from authorities); and our legitimate interests (keeping accounts secure, preventing fraud and abuse, personalizing what you see, improving the service, and the email inviting you to start selling, which you can turn off).

We share personal information only in these cases. Other users and the public can see your profile (username, profile photo, banner, bio, shop notice, the country of your main address, your numbers of sales and followers, and the accounts you follow and that follow you), your listings, with the city, state or region and country each one ships from, your collections and active wants, your reviews, and the bids you place on an auction, including through search engines. When you follow someone, they are told that you did. Your messages and offers go to the person you send them to, except a message you post in an auction's live chat: everyone who opens the auction sees it, with your username and profile photo. In a sale, the seller receives your name, shipping address, email address and phone number, and the buyer sees the seller's username; a shipping label bought through Kraahl also carries the seller's address. If you win a contest, your username and Instagram username are shown on the contest results page. Our service providers, our payment and shipping providers, and the carrier that delivers the parcel receive what they need to do their work (listed in section 6). Public authorities receive personal information when the law requires it.

We also analyze and monitor Listings, Posts, communications, and transaction metadata to detect illegal activity, fraud, or attempts to circumvent Kraahl-managed payment flows and fees. This review may include automated signals and manual checks performed under our legitimate interest in keeping the marketplace safe and compliant with applicable laws. It covers messages after they are delivered: a message that shares contact details or a link to another site, or that appears to move a conversation, a payment or a sale outside Kraahl, may be flagged and reviewed by our team. The flag, with an excerpt of the message, is kept with the account, including after the account is deleted, as part of our moderation records (see section 6).

Enforcement outcomes, such as the single-strike lifetime ban described in our Community Guidelines, may be recorded with your account, including after it is deleted, so that we can prevent repeat abuse and protect other users (see section 6).

3. Cookies and Tracking Technologies

We use a few cookies and similar browser storage. Some are needed for Kraahl to work: the cookies that keep you signed in, and one that remembers your language. Our website also stores two random identifiers in your browser: a device ID, sent with your sign-ins (with your time zone, language, screen size and browser) to help us spot unusual activity, and, when you are not signed in, a guest ID, used to keep your cart, count the listings and wants you view, and personalize your feed. We measure site traffic with Vercel Analytics, which does not use cookies. When you pay or set up payouts, PayPal and Stripe (and Apple Pay or Google Pay, if you use them) load their own scripts, which can set their own cookies to process the payment and prevent fraud.

4. Data Security

We implement reasonable security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

5. Platform Monitoring and Enforcement

Kraahl reserves the right to monitor, log, and review on-platform communications and Transactions to enforce our Terms of Service, investigate suspected illegal activity, and comply with legal obligations. Monitoring data is handled in accordance with this Privacy Policy. Section 6 lists what we keep: flagged messages and other moderation and security records are not yet deleted automatically, and we are setting a period with our legal counsel.

6. How Long We Keep Your Data

We aim to keep personal data only for as long as we need it for the purpose we collected it for, or for as long as the law requires. The periods below are provisional, and some records are not yet deleted automatically: we are confirming the periods with our legal counsel and will update this section.

• Your account (name, email address, phone number, username, profile photo, banner, bio, shop notice, collections and saved addresses): for as long as your account is open. An account you stop using is not deleted automatically. If you delete your account, we erase this data about 30 days after you confirm the deletion, on the date we tell you. The erase waits while an order, a refund, a dispute, a shipping label or a payment involving you is still being settled; if one is still open 180 days after you confirmed, our team reviews your account before it is erased. Only the country of each saved address is kept. Your language and currency stay with the erased account, and so do your shipping methods, saved packages, your choice of flat-rate shipping or live rates, and your choice of payout between PayPal and Stripe; your notification settings and your other preferences are deleted. Copies kept for other reasons are listed below.
• PayPal and Stripe references: if you connected PayPal or Stripe to get paid, whether or not you sold, their references stay attached to your erased account, with no end date yet: your PayPal merchant ID with its referral reference and permissions, and your Stripe account ID with its country, currency and status. Refunds of past orders can need them.
• Orders, payments, refunds, disputes and shipping labels: for at least 10 years from the end of the financial year of the transaction, because French commercial law requires us to keep accounting records for that long. The names, shipping addresses, email addresses and phone numbers recorded on each order, the seller's username and the city, state or region and country each item shipped from, and the addresses on a shipping label bought through Kraahl are kept with them. They are not deleted after that period yet; we are confirming with our legal counsel how long the contact details on an order must be kept.
• If you sold on Kraahl: when your account is erased, we keep a copy of your seller details in a restricted archive: your name, email address, phone number, country and username, the addresses saved on your account (with the name, phone number and email address on each), your PayPal merchant ID and Stripe account ID, the dates of your first and last sale, and the number of your sales. We keep it for 10 years after the end of the calendar year of your last sale, or for 10 years after your account is erased if that ends later, because tax and commercial rules, including the EU rules on reporting by digital platforms (DAC7), can require marketplaces to keep records about their sellers. For now we keep it for every seller, whatever their country or number of sales, while our legal counsel confirms who it must cover. It cannot be reached from any account, the website or the app: only staff with administrator access to our database can open it. It is deleted automatically at the end of that period.
• Your listings and their photos: taken off sale and out of search when your account is closed (in the app, a direct link to one still opens it, shown as unavailable; on the website it opens only for buyers who ordered it), and kept after your account is erased, including listings that never sold, with no end date yet. Buyers' orders show the ones they bought. Your active wants are cancelled when you delete your account; they are kept, and their photos are deleted when your account is erased.
• Messages, offers, bids and reviews you exchanged stay in other people's history after your account is erased, shown as "Deleted user", without your name, username or profile photo. What you wrote in them, and the photos you sent in messages, stay as they are. They are not yet deleted automatically.
• Security records (IP address and the location and internet provider it gives, device and browser information, sign-ins) and moderation records (reports, blocks, flagged messages with an excerpt, decisions): we keep them to secure accounts, investigate fraud or abuse, and enforce our rules, including after your account is erased. They are not yet deleted automatically; we are setting a period with our legal counsel.
• Application logs, which can include your IP address and account ID, are kept by Axiom and Vercel under the retention settings of those services; we are confirming the exact period.
• If your account was banned: when it is erased, we also keep a one-way code (a hash) of its email address and phone number. The same email address or phone number always gives the same code, so the code can still be matched with an address or number we already know, and we treat it as personal data. We use it for one purpose only: to stop a banned person from coming back with the same email address or phone number. A new account created with that email address is refused or banned automatically, and that phone number cannot be verified as the phone number of any Kraahl account. It has no fixed end date: we keep it until we decide to lift the ban. If you think this is a mistake, for example because the number used to belong to someone else, contact us.
• Usage data: records of the listings you view are kept for 90 days, then only as totals that do not identify you, and records of the listings shown to you are kept for up to 90 days. Your search history, your cart and the items held for you at checkout are deleted as soon as you delete your account. Other activity records, such as what you added to or removed from your cart, your activity on wants, and the data we use for recommendations, are not yet deleted automatically; we are setting a period with our legal counsel.
• Your in-app notifications are deleted when your account is erased.
• Other records that are not yet deleted automatically, including after your account is erased: the messages you send us through the contact form or when you report a problem with an order in the app (with your name, email address and username, and a link to your account if you were signed in); a sign-up you started but did not finish (the email address, name and username you entered); contest entries (the email address, username and Instagram username you entered); the answers you send to our feedback survey (with your name, email address, phone number and username, and your numbers of purchases and sales at the time); and a record of each email our team sent you (your email address and username).
• Your deletion request: we keep a record of it and its dates, as proof that we handled it.

Service providers process data for us: Supabase (database, sign-in and file storage), Vercel (hosting and site analytics), Axiom (application logs), Resend (email), Prelude (text-message codes), ipinfo.io (location from IP address) and Expo (app notifications, delivered through Apple and Google). Our payment providers (PayPal and Stripe), our shipping provider (Shippo, for labels and tracking) and the carrier that delivers a parcel receive the data needed for a sale. Some images are loaded from other services, which receive your IP address when they load: api.qrserver.com (the QR code on the share sheet), upload.wikimedia.org (the Messenger logo on the share sheet and two country flags), flagcdn.com (country flags), ui-avatars.com (the initials shown in some of our emails) and placehold.co (a blank picture in some emails about a listing with no photo). Most of this data is stored in the United States. Our payment providers (PayPal and Stripe) and our shipping provider (Shippo) also keep some data for their own legal obligations, under their own privacy policies.

7. Your Rights

You have the right to access, correct or delete your personal information, to restrict or object to its use, and to receive a copy of it. You can correct most of your details in Settings and delete your account yourself (see below). To get a copy of your data, or to use any other of these rights, including for the records we keep after your account is erased, write to us at contact@kraahl.com. You can also complain to the CNIL (www.cnil.fr).

You can delete your account yourself. On the website, go to Settings → Account & security → Delete account; in the app, go to Settings → Account → Delete account. Some things must be sorted out first: a paid sale you have not shipped (ship it or cancel it), a refund on one of your sales that is on hold because your PayPal balance is too low, or an email change in progress (finish it or cancel it). Some must end first: an auction of yours that has bids or is waiting for payment, a live auction where you are the highest bidder, an auction you won but have not paid for, or an offer you made or received that was accepted and has not been paid; we show you when each one is expected to end, when we know the date. If a purchase has not reached you yet, a sale you shipped has not reached the buyer, a shipping label is still being processed, a payment is still being checked, or a refund or dispute is still open, we close your account now and erase it once that is settled; a shipped order stops holding the erase back 30 days after it was shipped.

Your account is closed at once: you are signed out, your profile page is gone, your listings are taken off sale and out of search, and nobody can message you. At the same time, your cart, saved listings, follows (both ways), listing alerts and search history are deleted, your pending offers end and your active wants are cancelled. For 30 days you can change your mind with the link in the email we send you: your account and the listings hidden by the deletion come back, but what was deleted or ended does not. Then, on the date we give you, or later once what is still open is settled, your account is erased: your name, email address, phone number, saved addresses, profile photo, banner, bio, shop notice, collections, drafts, notifications, notification settings and preferences are deleted (on your sign-in record, your name and username are removed, and your email address and phone number are replaced by a scrambled code made from them), and your username is replaced by "Deleted user".

Some records are kept after that, most because other people or the law still need them: your orders and payments, with the names, addresses and contact details recorded on them and, on your sales, your username at the time of the sale (for tax and accounting); refunds, disputes and shipping labels; your listings and their photos, off sale, and your wants, without their photos; the messages, offers, bids and reviews other users still see in their own history, and the notifications they received about you, which can still contain your username; security and moderation records, including the sign-in provider's log, which can record your email address and phone number; your language and currency, shipping methods, saved packages and payout choice; your PayPal and Stripe references if you connected one; and, if you sold on Kraahl, your seller details in the restricted archive described in section 6. The usage data, the other records and the record of your deletion request described in section 6 are kept too. If your account was banned, we also keep the one-way code of its email address and phone number. Once your account is erased, we cannot restore it.

If you have any questions or concerns, please contact us at contact@kraahl.com.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page along with the updated effective date.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us at contact@kraahl.com or visit our Contact Page.