Privacy and cookie policy

This policy explains what data FlipRadar processes, why, for how long, and your rights under the General Data Protection Regulation (GDPR).

Data controller

Bryan Brumaud, Entrepreneur individuel (French sole trader, micro-enterprise scheme), 39 rue du Brandon, 85500 Les Herbiers, France. Contact for personal data questions: contact@getflipradar.app.

Data processed and purposes

• Account: name, email address, password (stored in hashed form). Purpose: creating and securing your account. Legal basis: performance of the contract.
• Content: product records, photos, comparables, sales, fee profiles. Purpose: providing the service. Legal basis: performance of the contract.
• Analysed photos: sent to the AI provider (Anthropic) only for the identification and price estimate you request. Metadata (including GPS location) is removed before storage and sending. An estimate without a photo only sends it the item's description (name, brand, model, condition…). To look up prices online, the AI sends this provider's search engine queries based on that description alone, without your photos or any data from your account.
• Billing: handled by Stripe. FlipRadar never stores your card numbers, only Stripe technical identifiers and the status of your subscription.
• Security: IP address and user agent of sessions, anti-abuse counters. Legal basis: legitimate interest (security of the service).
• Audience measurement (Vercel Web Analytics and Speed Insights): page visited (address without its parameters or identifiers), referring site, country, device type, operating system, browser and page loading speed. Purpose: knowing how the site is used and improving it, from anonymous statistics. Legal basis: legitimate interest.

FlipRadar never asks for your login details for a resale platform (Vinted or any other) and never sells any data.

Processors

• Anthropic (identifying items, looking up their prices online and estimating their resale prices with AI): United States, covered by standard contractual clauses.
• Stripe Payments Europe (subscription payments, Ireland). Your card data is processed only by Stripe.
• Vercel (application hosting and audience measurement, United States).
• Resend (email sending, servers in Ireland).
• Database: Neon (PostgreSQL database), servers in Frankfurt, Germany.
• Photo storage: Vercel Blob (Vercel Inc.), private storage in Paris, France.

Any transfers of data outside the European Union are covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

Retention periods

• Account data and content: as long as the account is active. Permanently deleted when the account is deleted.
• Sessions: 7 days after last use.
• Billing data: 10 years, in line with accounting obligations, kept by Stripe and the publisher.
• Audience measurement: the temporary identifier that tells visitors apart is erased after 24 hours; only anonymous statistics remain.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. From the app, you can export all your data at any time (Settings → Export my data) and delete your account. For any other request: contact@getflipradar.app. We reply within one month. You can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Cookies

FlipRadar only uses strictly necessary cookies: the authentication session cookie (and its secure equivalent), needed to stay logged in, and a cookie that remembers the site's language (French or English) for one year, chosen with the language button or by opening a page in a given language. The light or dark theme is remembered in your browser's local storage. No advertising or audience measurement cookie is set.

Vercel's audience measurement works without cookies and stores nothing on your device. It tells visitors apart with a temporary identifier calculated from the request and erased after 24 hours, doesn't track your browsing on other sites, is only used forFlipRadar's statistics, and doesn't link them to a person or an IP address. That's why no consent banner is shown.

Security

Encrypted connections (HTTPS), hashed passwords, private photos that only their owner can access, API keys kept on the server only, and limits on login attempts.