Privacy Policy

1. Who we are

AUBuySellTrade is a student-run marketplace and events board for the Amsterdam University College community, operated from the Netherlands. This policy explains what personal data we collect, why, and your rights under the EU General Data Protection Regulation (GDPR). Questions: privacy@aubuyselltrade.com.

2. What we collect

• Account details: your email address, optional name, and a hashed (never plain-text) password.
• WhatsApp number, only if you choose to add one — it's shown to other logged-in users on your listings and "looking for" posts so they can contact you.
• What you post:listings and their photos, bike rentals, "looking for" posts, events and event photos, messages you send about a purchase, ratings you give, and reports you submit.
• Activity: RSVPs, saved search keywords, purchase and booking requests, game scores, and the dates you were active (used for streaks and achievements).
• Security records: to prevent abuse, we briefly log login, signup, and password-reset attempts, keyed by email address or IP address. These are deleted within 24 hours.

We don't use analytics trackers, advertising cookies, or tracking pixels, and we never sell your data.

3. Why we use it (legal basis)

• To provide the service (contract): running your account, showing your posts, connecting buyers and sellers, sending password-reset emails and the saved-search alerts you asked for.
• To keep it safe (legitimate interest): rate limiting, reviewing reports, and removing content that breaks the Terms of Service.
• Your WhatsApp number (consent): optional, and you can remove it from your dashboard at any time.

4. What other users can see

Your name (or the part of your email before the @, if you haven't set a name), join month, streak, sales count, star ratings, and active listings and events appear on your public profile. Your email address is never shown to other users.

5. Who processes it for us

We use a small number of service providers to run the site:

• Vercel — website hosting
• Neon — database hosting (EU region)
• Cloudflare — photo storage
• Resend — sending emails

Some of these providers are US-based; transfers are covered by the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

6. Cookies

We only use a single strictly necessary cookie to keep you logged in. Because it's essential for the site to work, it doesn't require a consent banner.

7. How long we keep it

We keep your account and posts until you delete them or delete your account. Listings stop being shown after 7 days but stay stored so you can repost them. Password-reset links expire after 1 hour; security records are deleted within 24 hours.

8. Your rights

You can access, correct, or export your data, object to or restrict how it's used, and delete it. You can delete your account yourself at the bottom of your dashboard — this permanently removes your account and everything you've posted. For any other request, email privacy@aubuyselltrade.com. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. Age

AUBuySellTrade is intended for users aged 16 and over.

10. Changes

If we change how we handle your data, we'll update this page and the date above.