Privacy Policy

1. Introduction

This policy explains how Thrifted.mt uses personal data. Joshua Fielding operates Thrifted.mt as a sole trader in Malta. You must be at least 16 to hold an account. At 16 or 17, you can request parent-assisted selling in Account settings by entering a parent or legal guardian’s separate email. Thrifted automatically sends an expiring, single-use private invitation identifying you. The parent needs no separate Thrifted account. After agreement acceptance and the required account and payout checks, you own and operate your account and are the seller, represented by your parent or legal guardian. Buyers see your seller name and the parent’s representative name and the parent receives relevant order and dispute communications. The parent’s seller agreement and OpenAI permission are separate, as explained below. At 18, future sales in your own name require one fresh adult acceptance of the current Terms and any necessary Stripe update; optional AI choices also require fresh adult acceptance. Earlier orders retain their recorded seller, representative arrangement and payout destination. The parent continues helping resolve issues from those sales. The separate ChatGPT connection follows its own notices, permissions and OpenAI eligibility rules. Contact [email protected] if you believe a child under 16 has an account. Please do not put identity documents, sensitive information or other people’s contact details in listings or AI uploads.

2. Data Controller

The controller responsible for Thrifted.mt’s processing described in this policy is:

• Entity: Joshua Fielding (Sole Trader), trading as Thrifted.mt
• Address: 53 Triq Il-Lunzjata, Flat 3 Julian Flats, San Gwann SGN 1312, Malta
• Email: [email protected]

Contact [email protected] for privacy questions and rights requests. Providers such as Stripe, delivery operators and OpenAI may separately be responsible for their own processing, as explained below.

3. Data We Collect

We receive information from you, your use of Thrifted, other members you interact with and connected providers such as authentication, payment and delivery services. This includes:

• Parent-assisted selling: we receive the parent’s email from the teenager. The invitation identifies the teenager by username and, where available, first name. The parent enters their legal given names and surname and declares that they are an adult with parental authority, accept representation, supervision and cooperation duties and authorise occasional sales of used personal belongings rather than stock bought for resale. We record the entered name, email, declarations, agreement acceptance time, terms version and text hash, browser information and relevant audit events, including invitation use, delivery outcomes, account checks and withdrawal. We do not routinely collect a parent ID number, ID image or proof-of-parentage document. Email access and declarations are not documentary proof of parentage. The teen enters their own identity and bank details through Payouts. Stripe may collect guardian details separately; this does not give us the parent’s full identity-check record or prove the family relationship.
• Identity Data: names, username, date of birth and seller verification status. Payouts payout setup also collects the seller’s optional middle name, phone number, address, identity-details confirmation and ID or passport number for the Stripe handoff. The current flow passes the ID number to Stripe from the request without saving a new ID-number record in Thrifted’s database. Legacy verification records may still contain ID numbers or documents (Section 5).
• Contact Data: email address, telephone number, delivery address and seller payout address.
• Financial Data: the initial payout IBAN stored encrypted, an IBAN matching hash, the stored account-holder name, Stripe account identifiers and status, limited bank information, wallet entries and payment references. Listings and orders preserve the teenager’s seller identity and account and the parent’s representative identity and the associated connected-account reference. Card numbers are handled by the payment provider and are not stored by Thrifted. Each order records the seller's name, parent representative's name and arrangement email, agreement acceptance reference and payout destination as they stood when it was placed.
• Transaction Data: orders, offers, purchases, sales, refunds, disputes, shipping choices and tracking information. This includes listing boosts, free boost credits and gift voucher purchases, recipients, messages and redemption records.
• Technical data: IP addresses, sign-in information, browser or app details and security signals. The current application no longer collects its former screen-based device fingerprint. Necessary historical security records may still contain identifiers or hashes, which can remain personal data.
• Profile data: account settings, shopping preferences such as styles, categories and clothing or shoe sizes, saved items, followed sellers, saved searches, email and notification preferences, ratings and feedback. We use the shopping preferences you provide to filter and rank recommendations; you can change or clear them in Preferences. Firebase Authentication manages your authentication credentials.
• Content and Communications: listing photos and descriptions, chat messages and attachments, support requests, reports, appeals and event application answers. Public profile and listing content is visible to other people. Recipients receive the messages and attachments you send them.
• Connected Services: store integration credentials and imported products, ChatGPT connection permissions and the limited account and listing information described in the ChatGPT section.
• Consent Records: records of cookie and analytics choices, email preferences, AI permissions and terms of service acceptance. Separate parent OpenAI records include the permission text and version, grant or withdrawal, arrangement reference, browser information and a keyed IP hash where configured. These are separate from seller agreement records and the teenager’s own listing-assistance choice. A hash or arrangement reference can still be personal data. Recording permission or terms acceptance does not make it GDPR consent for every purpose.
• Private invitation and session security: invitation and session credentials are stored as hashes in our database, with expiry, use and revocation records. A secure, HTTP-only browser cookie supports the parent’s private session. Expiry or revocation stops access; it does not by itself erase agreement, permission or audit records.

Required fields are marked in the relevant form. Without the information needed to authenticate you, fulfil an order or verify a payout, we may be unable to provide that feature. Optional information can be left out.

4. How We Use Your Data & Lawful Basis

The purposes and GDPR Article 6 lawful bases for our processing are:

• Parent-assisted selling: legitimate interests in facilitating the teenager’s request, contacting the parent and preventing misuse (Art. 6(1)(f)) apply before acceptance. After acceptance, performance of the Parent Seller Agreement (Art. 6(1)(b)) supports recording seller authority and managing sales, notices, refunds and disputes. Necessary authority checks, security evidence and claims rely on legitimate interests (Art. 6(1)(f)); specific statutory records rely on legal obligation where applicable (Art. 6(1)(c)). Parent agreement acceptance does not authorise AI or ChatGPT.
• Accounts, listings, messages, orders, payments, delivery and requested connected-store imports: performance of our contract with you (Art. 6(1)(b)). We use the information needed to provide the feature you request. Shopping preferences you provide help filter and rank your recommendations and can be changed or cleared in Preferences; they are separate from optional browsing analytics.
• Seller payout setup: performance of contract (Art. 6(1)(b)). Stripe carries out its own identity, payment and regulatory checks. We also use verification status to prevent fraud under legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) applies where a specific rule requires our own processing.
• AI listing assistance and care-label reading: consent (Art. 6(1)(a)). Selected photos and relevant listing information can be sent to Google Gemini for adult listing assistance, with OpenAI as a fallback; some routes use OpenAI alone. For eligible users aged 16 or 17, assistance requires OpenAI-only routing, recorded parent OpenAI permission and the teenager's own listing-assistance choice. The parent's single OpenAI checkbox covers assistance and background safety together; it is separate from the GDPR basis for safety. You review generated content before publishing, can withdraw listing assistance in AI settings and need a fresh adult choice at 18.
• Marketplace safety and moderation: legitimate interests in preventing fraud, abuse and unsafe content (Art. 6(1)(f)). Background checks may process messages, relevant conversation context, attachments, listings, usernames and other content, with AI supporting rules and review. Before external AI calls involving minors’ content, permission gates check the affected minors, including participants whose content appears in chat context. Without the required parent permission, affected features or content may be held or unavailable. Parent permission required by the provider does not replace this GDPR lawful basis or remove the right to object. Section 6a explains decisions and review.
• Service communications: performance of contract (Art. 6(1)(b)) for order, delivery and requested account communications. Essential security and legal notices also serve our legitimate interests or legal obligations (Art. 6(1)(f) or (c)). Notification settings control optional delivery channels; they do not prevent notices we need to send about your account or transaction.
• Marketing and optional platform updates: consent (Art. 6(1)(a)). New accounts start with marketing and updates switched off. You can unsubscribe or change these choices in notification settings.
• Favourites-related emails, including saved-item price drops, offers, followed-seller updates and saved-search alerts: consent (Art. 6(1)(a)). We send these emails only after you opt in. You can turn them off in your email preferences or unsubscribe at any time. Turning off these emails does not turn off in-app or push notifications, which follow their own settings.
• Browser and app analytics, including Google Analytics and PostHog usage events: consent (Art. 6(1)(a)), controlled by your analytics choice. These events help us understand product use and find problems. Current PostHog events can be linked to account, browser, device or session identifiers; they are not automatically anonymous.
• Server operational events and error diagnostics: legitimate interests in running, securing and improving the service (Art. 6(1)(f)). PostHog receives selected account and transaction events from server requests and webhooks, which can include an account identifier. Sentry receives error and diagnostic data. These are separate from consent-controlled browsing analytics.
• Fraud prevention and dispute handling: legitimate interests in protecting members, investigating abuse and establishing or defending claims (Art. 6(1)(f)). We use transaction, account and connection signals and retain relevant evidence, including gift voucher terms acceptance. Cloudflare and other service providers may process technical information for these purposes.
• Financial and tax records: legal obligation (Art. 6(1)(c)) for records required under applicable Maltese tax law. A statutory period for transaction records does not automatically justify keeping identity document copies, chat content or all account data for the same period.
• Sanctions and payout risk screening: legal obligation (Art. 6(1)(c)) where applicable sanctions rules require it and legitimate interests in preventing prohibited or fraudulent payouts (Art. 6(1)(f)). Where enabled, OpenSanctions checks names and dates of birth against sanctions data. A possible match can hold a payout for review; it is not proof of wrongdoing.
• Event applications: steps at your request before entering an agreement and performance of contract (Art. 6(1)(b)), including application review, participation arrangements and any seller fee. Optional event update emails require their separate opt-in.
• Optional ChatGPT account access: performance of contract (Art. 6(1)(b)) to provide the connection you request. Making eligible public listings discoverable and preventing misuse serve our legitimate interests in operating and protecting the marketplace (Art. 6(1)(f)). Connecting an account is an access permission and does not make consent the basis for every use of the information.
• Photo indexing and photo search have separate choices. New photo-index writes are paused. Where photo search is enabled, eligible adults can consent (Art. 6(1)(a)) to sending a query photo to Google Gemini to create a search representation and find permitted listings in the existing index. Listing-assistance consent and parent OpenAI permission do not enable this Google feature. Pausing new indexing does not erase earlier representations.
• Permission and agreement evidence: legitimate interests in demonstrating authority and choices, securing access and handling complaints or claims (Art. 6(1)(f)). Where the record demonstrates GDPR consent, it supports our accountability obligations. OpenAI’s parental-permission requirement is a provider condition, distinct from the GDPR basis for each purpose. Withdrawing that permission stops future external AI processing of the affected minor’s content for the covered purposes even where moderation relies on legitimate interests.

5. Seller Verification and Legacy ID Verification

Seller payout verification is handled through Stripe Connect. Our former internal document-upload flow no longer accepts new identity documents.

• Parent seller flow: the parent accepts the Parent Seller Agreement through the private invitation. The teenager enters their own identity and payout details through Payouts for a Stripe Standard account in the teen’s identity and confirms that the payout bank account is theirs. Stripe separately collects whatever guardian verification it requires, which may include an ID document. Thrifted keeps the connected-account reference and operational status, but does not receive Stripe’s full verification record. Thrifted does not collect the parent’s ID number or IBAN in this flow. Neither these checks nor the parent’s declarations establish documentary proof of parentage.
• Initial Stripe setup: Payouts collects legal first name, optional middle name, surname, date of birth, address, phone number, an ID or passport number and the initial payout IBAN and account-holder name. Your account email is also used. We retain the name, date of birth, contact and address details and the identity-details confirmation time. The ID number is forwarded to Stripe from the current request and is not stored as a new ID-number record by Thrifted. The initial IBAN is stored encrypted using AES-256-GCM, with a matching hash; the account-holder name is a separate stored field. Older records may still contain ID numbers or documents.
• Further verification and bank changes: additional documents, business or tax information and replacement bank details are provided directly through Stripe. We receive account identifiers, limited bank details and verification, charges and payout status.
• Use of status: seller verification and payment status affect listing availability and payout eligibility. Stripe’s own privacy notice explains its separate compliance processing.
• Legacy documents: documents submitted through our former internal verification flow were manually reviewed. Restricted legacy storage may still contain encrypted copies and verification audit records. We do not promise that a document has been erased merely because its intended retention period has elapsed.
• Legacy erasure requests: contact [email protected] to request access, restriction or deletion. We assess whether any specific ongoing dispute or legal requirement justifies retaining a record and explain any applicable exception. The retention criteria in Section 8b apply.
• Verification audit records: these can include the action, time, account and reviewer identifiers, technical access information and review notes. They are personal data even where identifiers are masked or hashed.
• Lawful basis: contract for the payout service and legitimate interests in fraud prevention, with legal obligation only where a specific rule applies to Thrifted. Stripe determines the basis for its own regulatory processing.

5a. IBAN (Bank Account Number)

Thrifted collects and encrypts the first payout IBAN for Stripe setup. Later bank changes are made directly in Stripe. Some older encrypted IBAN records remain for legacy payout handling.

• Initial setup: your IBAN and account-holder name are sent to Stripe to establish your payout account. Thrifted stores the initial IBAN encrypted, a matching hash and the account-holder name. A teenager confirms that the account is theirs and the holder name matches their legal name. This is the teenager’s payout account; Stripe’s guardian verification is separate.
• Later changes: Stripe manages replacement bank details. Thrifted receives limited information such as bank name, country, currency, last four characters and status, rather than the full replacement IBAN.
• Access and retention: authorised personnel can access stored bank details where needed to resolve a payout or compliance issue. Ask [email protected] about deletion of a retained IBAN; any exception must relate to a specific payout, claim or legal requirement.
• Lawful basis: performance of contract (Art. 6(1)(b)) for paying you, with legal obligation or legitimate interests only for necessary compliance or claim records.

Physical events and seller applications

For seller applications, we collect the contact, shop or social, inventory, setup, notes, terms and custom answers you submit. Other event features can collect your attendance choice, reminder preference, vendor feedback and event photographs. Photos and written answers can contain information about other people; avoid unnecessary personal or sensitive details.

We use this information to review seller applications and coordinate participation in a physical event.

Authorised administrators and the approved organiser can access verified seller applications for that event. Authorised hosts or co-hosts can see relevant attendance information such as username, avatar and RSVP, and named vendor feedback, with tools to export event feedback. Event photos can be publicly visible. Organisers can be separately responsible for their own use of received information.

If your event application is approved and you rent equipment, we share your name, shop name, email address, phone number, equipment order, charges and payment status with ReStyle to arrange the rental, delivery and invoicing.

We use your contact details to send transactional application emails, and Stripe processes seller-fee payments where a fee is required.

The scheduled seller-application cleanup uses 180 days after the event end date, or the recorded start date when there is no end date, subject to necessary payment records and applicable exceptions. Separate payment and tax records follow Section 8b. This application period does not automatically apply to attendance records, vendor feedback or event photos, which have separate purposes and rights handling.

Use your secure application link to access, correct or withdraw your application. If you applied without an account and cannot access that link, contact [email protected].

Applications linked to your signed-in Thrifted account, including submitted answers and application history, are included in your account data export.

6. Cookies and Consent

We use cookies and similar browser or device storage for authentication, security, choices and optional analytics. You can accept or reject optional analytics and change your choice below.

• Essential authentication and security: the signed, HTTP-only userId session cookie maintains your session. The __Host-thriftedAuthOwner cookie helps prevent cross-account authentication mistakes and contains a hashed account identifier and random browser value. Firebase also stores authentication tokens on your device. A secure, HTTP-only __Host-guardian_seller cookie supports the parent’s private session without a separate account; the server stores a credential hash, expiry and revocation information. These stores support the service you request.
• Analytics: Google Analytics and PostHog browsing events run after analytics consent where enabled. PostHog can link activity to your account, device or session. When web replay is enabled, it can record interactions and page structure on listing creation and onboarding pages. We configure input, text and element-attribute masking; recorded context can still contain personal data. Native replay is disabled. The current PostHog recording setting is 30 days; older recordings can keep their earlier period and physical cleanup is separate from expiry. Withdrawal stops future consent-controlled capture; it does not automatically erase provider history.
• Preferences and experiments: first-party cookies such as tv and afv support layout choices and experiments after analytics consent. Cookies are stored on your device and may be read by Thrifted when you make a request. They do not contain your name, but can still distinguish a browser.
• Consent choice: cookie_consent records your device choice so we can honour it. We also attempt to save an account record where available. The device choice and successful account persistence are separate. Sign-in and security information is processed for its stated security purpose and is not automatically anonymous.

6a. Automated Decision-Making

We use limited automated processing in the following areas:

• Listing and username checks: automated rules and AI can evaluate listing photos and usernames for prohibited, inappropriate or misleading content. Minor-content permission gates apply before external AI processing. An image or listing can be held, hidden, rejected or removed. Contact [email protected] to challenge a decision.
• Optional assistance: AI can draft listing text and read materials from care labels. You review generated content before publishing. Eligible minors need parent OpenAI permission and their own listing-assistance choice. New photo indexing is paused; separately enabled photo search can send an adult's query photo to Google Gemini with the required choice.
• Chat moderation: rules and AI may process message text, attachments and relevant recent conversation context. Chat text uses OpenAI; adult image routes can use Google Gemini or OpenAI. Minor-content permission gates require OpenAI-only routing and the necessary permission for affected participants. Missing permission or unavailable processing can hold content or make a feature unavailable. Safety checks can also block or flag messages; a permission hold is not proof of misconduct.
• Account and payout risk: transaction patterns, limits, bank-name matching, connection signals and sanctions checks can flag activity or hold a payout for review. The current sanctions integration does not perform a general politically exposed person (PEP) search.

You can ask for human review, explain your position and challenge a moderation or payout decision at [email protected] or [email protected]. This includes a hold caused by missing permission or an incorrect age or seller record. A review request does not mean every automated decision is reviewed before taking effect. GDPR Article 22 gives additional protection where a decision is based solely on automated processing and has legal or similarly significant effects, subject to its conditions and exceptions. Offering an appeal does not by itself establish that any such decision is lawful.

7. Third-Party Services & International Transfers

We share information needed to provide the relevant service. A provider may process data on our instructions, act independently for its own purposes or have different roles for different activities. Other members receive information needed for their transaction or conversation; public content is available to people viewing the marketplace. In parent-assisted sales, buyers see the teenager’s seller identity and the parent’s representative name. Parents receive relevant order, refund, cancellation and dispute information, using their arrangement email even if the teenager’s optional email preferences are off.

• Stripe: payments, Connect onboarding, identity verification and payouts, including the teenager’s Payouts handoff and Stripe’s separate guardian verification. Stripe acts independently for some payment, fraud-prevention and regulatory activities and as a processor for others. Thrifted receives connected-account references and limited status and bank information, rather than Stripe’s full guardian verification record. Thrifted does not store full payment card numbers.
• Brevo and Resend: transactional email delivery and related message content, including parent invitations that identify the teenager and relevant parent order and dispute notices. Brevo also manages marketing and updates CRM lists according to preferences. The separate events list is joined through an event-updates opt-in, not simply by submitting an event application.
• Cloudflare: hosting, network security, D1 database storage, R2 files and images, chat infrastructure and Vectorize search representations. The production D1 database and configured R2 buckets use EU jurisdictions; this does not mean all edge processing or support access happens only in the EU.
• Google: Firebase Authentication and Google sign-in for authentication, and Google Analytics where you consent. Google Gemini AI is described separately below. Locations and terms depend on the service. Google Cloud Translation processes text for automatic translations.
• Google Gemini and OpenAI: applicable internal AI routes process selected photos, listing information, messages, context or attachments and return generated content or moderation results. Adult listing assistance can use Gemini with OpenAI fallback; minor permission gates require OpenAI-only routing. Provider, purpose and permission boundaries are described in Sections 4 and 6a. OpenAI API training is off by default unless the API customer opts in; project controls and service terms determine retention and other handling. These API arrangements are separate from the optional personal ChatGPT connection.
• PostHog: consent-controlled browser and app usage analytics, conditional web session replay and separate server operational events. Browsing events can include account, device or session identifiers; server events can also include an account identifier. We use the EU-hosted service, which does not mean every provider operation or support activity is confined to the EU.
• Sentry: error monitoring and diagnostics, which may include an account identifier, username, technical device information and details of a failed request. We apply filtering to reduce personal data in diagnostic records.
• Backblaze B2: backup storage where our backup service is used. D1 export files are encrypted before upload by that backup service. Image and file backup encryption depends on the storage configuration and age of the copy. Backup copies have a separate lifecycle from live records; selected encryption does not establish that every historical backup is encrypted or erased.
• Translation: listing text and chat messages selected for translation are sent to Google Cloud Translation or a paid DeepL service. We cache translated text with its listing or message link so edits and account deletion can remove the relevant copies. Older cache entries also contain original text and lack those links, so historical deletion may need individual review. Provider records are handled separately.
• OneSignal: mobile push delivery. We share device push tokens and account identifiers, notification titles and text, any included image and destination links, notification categories and related identifiers. We may also share notification preferences, such as promotional push opt-in status. Device platform services also participate in delivering notifications.
• MaltaPost: parcel delivery and tracking. We send the recipient and shipment information needed for the service, including name, contact details, selected delivery destination and relevant parcel description or value. MaltaPost also handles delivery records under its own privacy notice.
• Apple and Google sign-in: authentication providers process credentials under their own terms and return the permitted account information to Thrifted. Apple may supply a private relay email address.
• Shopify, WooCommerce, Wix and Squarespace: optional seller store connections, using OAuth or API credentials depending on the integration. We store protected connection credentials and use product, image, price and inventory data to provide the import or synchronisation you request.
• OpenSanctions: where screening is enabled, name and date of birth can be sent for sanctions matching. Parent representative screening can use the parent’s name without a date of birth. This is separate from guardian verification and does not prove parentage. The integration is limited to sanctions data; a possible match is reviewed.
• OpenAI through the member’s optional ChatGPT connection: OpenAI handles returned content under its own relationship with the ChatGPT user or workspace. It is not Thrifted’s processor for this connection. See the dedicated section below.
• Event organisers, advisers and authorities: authorised organisers receive verified applications for their event. Authorised hosts and co-hosts can also access relevant attendance information and named vendor feedback, with tools to export event feedback. Public event photos can be viewed by others. Organisers may have separate responsibilities for their own use. Advisers or authorities may receive necessary information for disputes, legal duties or valid requests.

Some recipients operate internationally, including in the United States. EU storage alone does not prevent an international transfer. We do not promise EEA-only OpenAI processing. Applicable safeguards may include a European Commission adequacy decision, such as the EU-US Data Privacy Framework for an eligible certified recipient and covered service, or Standard Contractual Clauses with any necessary additional safeguards. The applicable OpenAI agreement/DPA and service configuration determine the relevant arrangements; these mechanisms depend on the recipient and service. Ordinary cookie, parent or account permission is not a blanket consent to international transfers.

Contact [email protected] for the recipient and transfer safeguards relevant to your data and to request a copy of applicable safeguards, with confidential information redacted where necessary. Each provider’s own privacy notice explains the processing for which it is independently responsible.

Optional member connection to ChatGPT

Where the Thrifted app is available in ChatGPT, it can search eligible public listings without an account connection. Results may include titles, descriptions, prices, sizes, conditions, brands, categories, photos through image links and item links. Seller-authored text and images can contain personal data. Do not include other people’s personal or sensitive information in a listing.

To connect a Thrifted account, you must be at least 16 and eligible to use ChatGPT. This connection has its own notice and account-access permissions and is separate from Thrifted’s internal OpenAI listing assistance and safety processing. The parent’s Thrifted OpenAI checkbox does not authorise ChatGPT or establish OpenAI’s separate parental permission. With the relevant connection permissions, ChatGPT can receive your Thrifted username, a pseudonymous identifier specific to this connection and summaries of your own listings, including non-public or sold listings and their status. The identifier can remain the same if you reconnect. These account responses do not include your profile email, phone number, delivery address, payment information or identity documents, although personal information you put in listing text can still be included.

Thrifted receives individual tool requests, their arguments and connection information, rather than general access to your entire ChatGPT conversation. Search terms or arguments can include context from your conversation. We use them to answer the request and protect the service. We keep connection permissions, hashed credentials and limited operational records. The member connection can read information and link you back to Thrifted; it cannot buy, send messages, create shipments or publish listings.

Disconnect through Connected apps on Thrifted or the app controls in ChatGPT to stop future linked-account access. Public listing search remains available. Disconnecting does not delete information already returned to ChatGPT, chats, saved files or memories. Use the relevant ChatGPT controls to manage those separately.

OpenAI handles returned content under its own relationship with you or your workspace. People under 18 need permission from a parent or legal guardian under OpenAI’s applicable ChatGPT terms; Thrifted does not collect or verify that separate permission. For personal ChatGPT plans, content from apps may be used to improve models when the relevant setting is on. Business, Enterprise and Edu content is not used for training by default. Memory and other enabled features can also use it. These rules differ from Thrifted’s API use. OpenAI’s retention, processing locations and transfer safeguards follow its applicable privacy notice and service terms. Disconnecting does not automatically delete information already returned to ChatGPT.

Our access tokens expire after 15 minutes. Refresh credentials have a 14-day idle limit and the connection grant lasts up to 30 days unless revoked earlier. Expiry prevents access; deletion happens separately. Cleanup is designed to remove expired credentials and remove terminated grant records after 30 days, retaining used refresh hashes only as needed to detect reuse during the grant. Account erasure revokes the connection and removes its records from our active database. These periods do not describe OpenAI’s conversation retention.

• OpenAI’s connected-app guidance
• OpenAI’s European privacy policy

Staff listing reviews through ChatGPT

Authorised staff may occasionally use a separate ChatGPT connection to help review adult sellers’ listings against our marketplace rules. This can send unpublished listing details, original photos, seller account identifiers, username and first name, review notes and support-message text to OpenAI.

This staff connection is limited to accounts whose recorded date of birth establishes that the account holder is 18 or over. It blocks under-18 accounts and accounts whose adult age cannot be established, including direct photo access and saved review cases. An authorised staff member must approve each case in Thrifted before the connection can apply its listing decisions, photo removals or strikes and send its in-app support message.

OpenAI processes information returned to the staff ChatGPT workspace under the terms and settings applicable to that workspace. These govern its processing and retention. Blocking later access does not erase information already returned to ChatGPT.

8. Data Security

We use access controls, encrypted connections, protected credentials and encryption for selected sensitive fields and files. Access is limited according to role and need. These measures reduce risk but cannot guarantee that an incident will never occur. Contact [email protected] promptly if you suspect unauthorised account access.

8a. Data Breach Notification

We assess and record personal data breaches. Where a breach is likely to risk people’s rights and freedoms, GDPR Article 33 requires notification to the Malta Information and Data Protection Commissioner without undue delay and, where feasible, within 72 hours of awareness. Where it is likely to create a high risk, Article 34 requires informing affected people without undue delay unless an applicable exception applies.

8b. How long we keep data

• Parent representation records: agreements, declarations, acceptance evidence, seller and representative identities and relevant audit records remain while needed for the arrangement or earlier orders, refunds, disputes, tax, accounting or specific claims. Withdrawing seller authority stops future parent-assisted selling; it does not erase earlier obligations or change the legal seller on earlier orders. Turning 18 likewise does not replace those records. We review whether full identifying details remain necessary when these purposes end. Invitation and session expiry or revocation prevents use, rather than guaranteeing record deletion.
• Account and service data: kept while needed to provide your account, listings, messages and requested services. Closing an account starts the deletion process in Section 10; some transaction, recipient and legal records have a separate purpose and lifecycle.
• Tax and accounting records: Maltese income-tax rules require relevant business records for at least nine years after the transactions, acts or operations are completed. VAT records generally require at least six years from the end of the relevant year, with longer or restarted periods in some cases. We apply the longer applicable requirement to the records it covers, not automatically to every photo, message or identity document.
• Claims, fraud and security records: the relevant incident, unresolved obligation, dispute or legal claim determines what must be retained and for how long. We consider applicable limitation periods, the need to defend a specific claim and whether less identifying information is sufficient. You can ask us to explain the reason for retaining a particular record.
• Consent and permission evidence: retained where needed to demonstrate a choice, handle a complaint or honour withdrawal. Parent OpenAI records may remain as evidence of a grant or withdrawal after future processing stops. Retaining evidence does not authorise new AI use. A suppression record may remain after account deletion to prevent further unwanted email.
• Event applications and feedback: the specific cleanup periods are described in their sections. Cleanup is a separate process from making a record inaccessible or an account inactive.
• Backups and providers: erasure from our live systems and disposal of restricted backup copies happen separately. Our routine database recovery window is 30 days. Immutable storage locks can delay permanent disposal. A restored backup must remain closed until recorded erasure instructions have been applied and checked; missing or incomplete evidence blocks its return to service. Providers may hold records under their own retention arrangements. Contact us about a specific deletion request and any remaining copies or justified exceptions. These arrangements do not promise that every copy is erased within 30 or 35 days.
• Internal AI provider records: applicable Google Gemini and OpenAI processing can create provider service, safety or temporary records under the relevant terms and controls. Relevant OpenAI requests use store:false to request no response storage for later API retrieval. This does not establish Zero Data Retention or remove all safety logs, caches, image/file review exceptions or legal records. Withdrawal does not recall information already sent; questions about earlier provider copies are handled separately.

9. Your Rights

Depending on the purpose, lawful basis and applicable exceptions, you can:

• Ask for access to your personal data and information about how it is used.
• Ask us to correct inaccurate or incomplete information.
• Ask for erasure where the GDPR conditions apply. Some records may remain where needed for a legal obligation or an applicable exception.
• Object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing at any time.
• Ask us to restrict processing where the GDPR conditions apply.
• Receive eligible data you provided in a portable format where processing is automated and based on consent or contract.
• Download the account data available through Preferences. This self-service download is not the limit of your right of access: email [email protected] for other records, context or assistance.
• Withdraw consent as easily as giving it. Withdrawal affects future processing under that consent and does not make earlier processing unlawful.
• Contact [email protected] to exercise these rights. We normally respond within one month. If a permitted extension of up to two further months is needed because of complexity or the number of requests, we will explain it within the first month. We may request proportionate information to verify your identity.
• Parents and teenagers can exercise rights over their own information even if the parent has no Thrifted account. Contact [email protected] about parent agreements, permissions, audit evidence or records missing from the teenager’s self-service export. We may need proportionate identity checks and must also protect the other person’s information.
• A parent can withdraw seller authority or the separate, combined OpenAI permission through the private parent page. Contact [email protected] if the link is unavailable. The teenager can withdraw their own listing-assistance consent in AI settings. Withdrawing parent AI permission stops future external processing of the affected minor’s content for both covered purposes and may hold affected features; withdrawing seller authority stops future parent-assisted selling. Earlier records and processing are assessed under their own purposes and retention rules. At 18, future adult sales and optional AI require fresh acceptance.
• Lodge a complaint: You can complain to the Malta Information and Data Protection Commissioner (IDPC), or the competent supervisory authority where you live or work. Current contact details and the complaint process are available at idpc.org.mt.

10. Account Deletion and Retained Data

How to request deletion

1. Sign in and open your Profile page.
2. Open the account deletion option in your account settings.
3. Review any outstanding transactions or payout requirements.
4. Follow the confirmation steps to submit your request.

If you cannot access your account, email [email protected] using your account email where possible. If you no longer control it, explain this so we can arrange proportionate identity verification.

What the deletion process removes

• Identifying profile fields, including name, username, avatar, date of birth and stored payout details, subject to necessary records described below.
• Saved items, saved searches, account notifications and signed-in feedback.
• Store credentials and linked ChatGPT account permissions.
• Listing visibility and related personal content through the applicable cleanup processes. Removal from public view and physical deletion are separate steps.
• Legacy verification information where no specific retention exception applies.

What we may retain and why

• Financial records: necessary order, payment and wallet ledger records remain for applicable tax, accounting and claim requirements described in Section 8b. Closing an account does not erase an outstanding balance or obligation.
• Conversations and disputes: account closure after a deletion request blocks further access through our chat service to photos and other attachments you sent. The deletion process replaces the text of messages you sent with an account-deleted notice and removes those attachment files, including copies created or cached by our services. File cleanup is separate from account closure; failed steps are retried and completion is checked. Records needed for a specific dispute or legal requirement may remain under Section 8b, and we explain any pending cleanup or retention exception. Backups and provider records follow the separate arrangements in Section 8b. We cannot recall copies someone has already downloaded or saved, including screenshots.
• Fraud-prevention identifiers: the retained account record may contain the Firebase user ID and connection metadata such as IP addresses and device fingerprint hashes. These support recognition of a closed account and fraud investigations under legitimate interests (Art. 6(1)(f)), subject to necessity and your right to object. They are not anonymous.
• Audit and moderation evidence: retained where necessary for a specific security incident, dispute or legal requirement under the criteria in Section 8b.
• Email suppression list: a minimal suppression record can survive account deletion to honour an unsubscribe, hard bounce or spam complaint. It is used to prevent unwanted messages, not to send marketing. The basis is legitimate interests in respecting those choices and protecting delivery (Art. 6(1)(f)).
• Independent recipients: Stripe, delivery providers and OpenAI may have their own records and legal obligations. We handle the processing for which we are responsible and can help identify the relevant recipient for a further request.
• Parent arrangements and AI permission evidence: necessary agreement, grant, withdrawal and audit records and the seller and parent representative identities on earlier orders may remain under the purposes and criteria in Section 8b. Account deletion or withdrawal is not a guarantee of immediate erasure from Thrifted, Stripe, OpenAI or backups.

Account closure, cleanup and provider erasure are separate steps. We will explain any pending work or lawful exception when handling your request; a disabled account is not proof that every copy has been erased. Deleted accounts cannot be reactivated through the account interface. Contact support promptly if you made a mistake, but recovery of deleted content is not guaranteed.

11. Contact Us

If you have any questions about this privacy policy or our privacy practices, please contact us at [email protected]. We update the date above when this policy changes and provide additional notice where a material change requires it.

12. Feedback

At key moments in your journey (your first listing, a completed sale, a delivered order) we may show a short in-app feedback prompt so we can find and fix what is not working. This is separate from ratings and reviews. Our lawful basis is legitimate interest in understanding and improving the service (GDPR Art. 6(1)(f)); it is never a marketing channel.

If you are signed in, your feedback is linked to your account. Our permanent Feedback page also accepts general feedback without an account: no name or email is collected, and you cannot be contacted about it.

The written comment is optional. Please do not include names, email addresses, postal addresses or sensitive personal information. For help with a particular order or account, use support instead.

How we handle it

• Storage: your rating, chosen categories and any written comment are stored in our database, with the written comment encrypted (AES-GCM).
• Staff access: only authorised administrators can read written comments to review and act on feedback. You can view your own signed-in feedback through your feedback history.
• Replies: you can read an administrator's reply in your feedback history. A generic in-app notification may also tell you that a reply is available. The notification does not contain the reply, and we do not send the reply by email or push.
• Behavioural analytics: with your separate analytics consent and only while our analytics gate is enabled, we may record that a prompt was shown or dismissed. Outcome events used to monitor the health of the feedback system itself (for example, whether the system succeeded or failed) are not tied to you personally and do not require that consent.
• Reward: completing certain seller feedback prompts can unlock one free listing boost. Eligibility is based only on completing the prompt, never on your rating, chosen categories or written comment.

Retention

• Written content and links: comments and replies are scheduled for deletion 12 calendar months after submission. The cleanup also removes selected account, subject and administrator links from the submission. Structured ratings and categories can remain until the submission's separate deletion date. Deleting text or removing direct links does not establish that every remaining record is anonymous.
• Submission and reward records: the structured submission is scheduled for deletion 24 calendar months after submission. Reward, redemption and invitation evidence has separate clocks and can outlast removal of the submission's account links. Selected links on redeemed or revoked rewards are scheduled for removal 12 months after their terminal event. Redeemed reward records are scheduled for deletion 24 calendar months after redemption. Other reward records follow a recorded deletion date where one is set; the current rules establish no fixed deletion period for available unused rewards. Scheduled dates do not prove that historical cleanup has completed.
• General feedback withdrawn with its management code: a minimal record of two keyed codes is kept for 24 months after withdrawal to prevent resubmission. That record does not contain the management code you received, written content, a submission ID or account, device or network information. Its privacy treatment depends on whether it can reasonably be linked to a person; the label 'anonymous' alone does not exclude applicable rights.

Your feedback and this data

• Signed-in feedback is included in your account data export and is deleted when you delete your account.
• You can delete an individual piece of signed-in feedback at any time from your feedback history.
• Anonymous general feedback is not tied to an account. You get a one-time management code when you submit it: keep it if you want the option to withdraw that submission later, since we have no other way to find it for you.

The feedback controls do not limit your GDPR rights described in Section 9.