DEPOT

Privacy Policy

title: Privacy Policy lastUpdated: 2026-07-04 status: DRAFT

DRAFT — PENDING LEGAL COUNSEL REVIEW, NOT LEGAL ADVICE. This notice is tailored to DEPOT's real architecture but every entity-, jurisdiction-, and retention-specific clause below is marked > COUNSEL: and must be confirmed by a qualified EU data-protection lawyer before publication. Placeholders in {{ }} must be filled once the EU establishment entity is chosen (see the entity brief in docs/audit/).

Privacy Policy

DEPOT is a curated multi-vendor resale marketplace for fashion. This policy explains what personal data we process, why, on what legal basis, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is the controller

The data controller is {{DEPOT_LEGAL_ENTITY_NAME}}, {{REGISTERED_ADDRESS}}, {{MEMBER_STATE}}, company registration {{REG_NUMBER}}, VAT {{VAT_NUMBER}}.

  • Privacy contact / Data Protection point of contact: {{PRIVACY_EMAIL}}
  • EU legal representative (Digital Services Act, Art. 13): {{DSA_LEGAL_REP_NAME}}, {{DSA_LEGAL_REP_EMAIL}}, {{DSA_LEGAL_REP_MEMBER_STATE}}

COUNSEL: The controlling entity does not yet exist — its member state (Ireland / Netherlands / Estonia) is an open founder+counsel decision. Confirm whether a formal DPO appointment under GDPR Art. 37 is required (likely not mandatory at this scale, but the KYC/identity + payment processing should be assessed). Confirm the DSA Art. 13 legal representative placement.

2. What personal data we process

Everyone (buyers and sellers)

  • Account data: email address (used for passwordless magic-link sign-in), display name, and any profile details you provide.
  • Technical data: authentication session cookies, IP address, device/browser information, and security logs generated when you use the service.

Buyers

  • Order data: items purchased, price, delivery/tracking status, dispute and refund records.
  • Payment data: handled by Stripe — DEPOT never receives or stores your full card number. We store a payment reference (Stripe PaymentIntent ID) and the order amount.
  • Delivery data: the shipping address you provide for an order.

Sellers ("traders")

  • Storefront data: business/trading name, handle, bio, logo, banner.
  • Compliance / identity data (collected to meet EU platform obligations — see §4): legal name or legal entity name, registered address, date of birth (individuals), place of birth, business registration number, VAT number, tax-residence country, national tax identification number (TIN), and bank account details (IBAN + account holder) for payouts.
  • Verification status set by our team (Know-Your-Business-Customer review).

We do not intentionally collect special categories of personal data (Art. 9 GDPR). Please do not submit such data in free-text fields (e.g. listing descriptions, messages).

3. Cookies and ranking signals

Strictly necessary

We use strictly-necessary cookies to keep you signed in and to secure the service. These do not require consent.

Personalization & ranking signals

The first time you visit, we set an anonymous session cookie (depot_sid, up to 1 year) and record view and click events against the listings you interact with. We use these signals to rank and personalize the home feed — surfacing items similar to what you've engaged with, computing trending listings, and running the fairness mechanisms described in How DEPOT ranks what you see (new-listing boost, small-seller boost).

  • What: the depot_sid cookie (a random identifier, not tied to your identity on its own) and timestamped view/click events against listing IDs.
  • If you're signed in, these events are also linked to your account, the same way your order history is, so ranking can reflect your activity across devices.
  • Legal basis: Art. 6(1)(f) — legitimate interests. The signal is pseudonymous, used only to rank listings on this platform (never sold, never shared with individual sellers, never used for advertising), and you can opt out at any time without losing the ability to browse or buy.
  • Retention: 12 months. Raw view/click rows in listing_events are deleted by an automated nightly job once they pass this window. Only behavioural ranking signals are affected — no order, payment, or other financial data.
  • Opt out: use the "Ranking personalization" toggle on this page to stop new view/click events from being recorded. This sets a depot_track cookie that both the tracking beacons and our server respect; it does not retroactively delete signals already recorded — request erasure under §8 for that.

COUNSEL: Confirm the Art. 6(1)(f) balancing-test write-up for pseudonymous ranking signals, and whether an ePrivacy consent banner is required for depot_sid given it is functional/ranking rather than strictly-necessary in the narrow sense. If any future use of these signals extends to advertising or cross-site tracking, this section and the lawful basis must be revisited. If any other analytics/advertising cookies are added, the same consent-mechanism requirement below applies to them too.

COUNSEL: If any analytics, advertising, or other non-essential cookies/trackers are added (e.g. Vercel Analytics, Umami, or a marketing pixel), a consent mechanism (banner/CMP) and a standalone Cookie Policy become mandatory under the ePrivacy Directive as implemented in {{MEMBER_STATE}}. Confirm the deployed analytics stack before launch.

COUNSEL: The 12-month ranking-signal retention period is an engineering default, not a counsel-confirmed figure. Confirm the appropriate retention window for pseudonymous behavioural signals (data-minimisation vs. ranking quality) and adjust the events_retention_days config row accordingly.

ENGINEERING: listing_events rows are purged nightly (04:15 UTC) once older than the retention window by private.purge_old_listing_events(), with the window set by the events_retention_days feed_config row (default 365 days = 12 months). The depot_sid cookie's own lifetime is governed separately by its cookie max-age; confirm that is bounded before launch.

4. Why we process your data and the legal basis

Purpose Data Lawful basis (GDPR Art. 6)
Create and operate your account; passwordless sign-in Email, session data Art. 6(1)(b) — performance of a contract
List, sell, buy, ship, and complete orders Order, delivery, storefront data Art. 6(1)(b) — performance of a contract
Hold funds in escrow and pay out sellers Order amount, Stripe reference, seller IBAN Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligation (financial record-keeping)
Trader identification and traceability (DSA Art. 30/31) Seller legal name, address, VAT/registration Art. 6(1)(c) — legal obligation
Tax reporting on sellers (DAC7 / Directive 2021/514) Seller TIN, tax-residence, address, revenue/transaction totals Art. 6(1)(c) — legal obligation
Security, fraud prevention, dispute resolution Technical logs, order + dispute records Art. 6(1)(f) — legitimate interests (a secure, trustworthy marketplace)
Meeting consumer-protection obligations (returns/withdrawal) Order + delivery data Art. 6(1)(c) — legal obligation
Personalize and rank the home feed (trending, fairness boosts) Anonymous session id (depot_sid), view/click events, and your account id when signed in Art. 6(1)(f) — legitimate interests (pseudonymous ranking signal; see §3)

COUNSEL: Confirm the legitimate-interests balancing test for §fraud/security, and confirm the lawful-basis mapping for the KYC/DAC7 identity fields (we have relied on legal obligation).

We do not use your compliance/identity data for marketing. Any future marketing communications will rely on separate, freely-given consent (Art. 6(1)(a)) that you can withdraw at any time.

5. Who we share data with (processors and sub-processors)

We use a small number of carefully-selected processors. The current sub-processor register is maintained at docs/legal/sub-processor-register.md; the key processors are:

  • Supabase — database, authentication, file storage, and backend hosting for the service. Personal data hosted in the EU region. Acts as our processor under a Data Processing Agreement.
  • Stripe — payment processing, escrow (separate charges & transfers), and seller payouts via Stripe Connect. Stripe is an independent controller for its own payment/KYC obligations and our processor for the payment flow.
  • {{HOSTING_PROVIDER}} — application hosting/CDN for the storefront.
  • {{EMAIL_PROVIDER}} — delivery of transactional email (magic-link sign-in, order notifications).

COUNSEL: Confirm the final hosting provider (Vercel staging vs. Hetzner production) and the transactional-email provider, and that a signed DPA (and, where relevant, EU Standard Contractual Clauses for any non-EEA transfer) is in place with each before launch. Stripe's controller/processor split for the KYC data should be characterised precisely.

We do not sell your personal data. We disclose data to public authorities (e.g. tax authorities under DAC7, or a Digital Services Coordinator under the DSA) only where legally required.

6. International transfers

Our primary data store is in the EU region. Where a processor transfers data outside the EEA (for example, certain Stripe processing), that transfer is covered by an adequacy decision or EU Standard Contractual Clauses.

COUNSEL: Confirm the transfer mechanism for each sub-processor; document the SCCs / adequacy basis.

7. How long we keep data

Data Retention
Account data For the life of your account, then deleted or anonymised {{ACCOUNT_DELETION_WINDOW}} after closure
Order / transaction / payout records Retained for statutory financial-record and tax periods
DAC7 seller identity/tax data At least 5 years from year-end of the reporting period (DAC7 minimum)
Rejected seller-application data Maximum 90 days after rejection, then deleted/anonymised, unless you re-apply
Security logs {{LOG_RETENTION}}
Ranking/personalization signals (depot_sid, view/click events) 12 months — view/click events purged nightly once past the window; see §3

COUNSEL: Confirm the exact statutory retention periods for financial records in {{MEMBER_STATE}}, the DAC7 minimum, and the account-closure deletion window. The 90-day rejected-applicant purge and a retention/anonymisation schedule must be operationalised (see the audit's action list).

8. Your rights

Under the GDPR you have the right to: access your data; rectify inaccurate data; erase data ("right to be forgotten", subject to our legal-retention obligations); restrict or object to processing; data portability; and to withdraw consent where processing is consent-based. You also have the right to lodge a complaint with your local supervisory authority ({{LEAD_SUPERVISORY_AUTHORITY}} is our lead authority).

To exercise any right, contact {{PRIVACY_EMAIL}}. We respond within one month.

COUNSEL: Note the tension between erasure requests and DAC7/financial legal-retention duties — confirm the standard response (retain the minimum legally required, erase the rest).

9. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Seller approval and dispute resolution involve human review.

COUNSEL: If AI-assisted listing generation or visual-similarity features later touch personal data or affect seller outcomes, re-assess Art. 22 and update this section.

10. Changes to this policy

We will post material changes here and update the "last updated" date.

Ranking personalization

On — your anonymous views and clicks help rank the home feed for you.