Privacy Policy
Version 3.3 · In force from November 16, 2026
This policy explains what personal data Spotitem processes, why, on what basis, with whom it is shared, how long it is kept and how to exercise your rights, in accordance with Regulation (EU) 2016/679 (“GDPR”) and French Data Protection Act No. 78-17 of 6 January 1978 (“Loi Informatique et Libertés”).
1. Data controller
SPOTITEM, SAS with share capital of 1 000 €, 22 avenue Maximilien de Robespierre, 93150 Le Blanc-Mesnil, RCS Bobigny 130 417 116. Contact for any question relating to your data: [email protected]. Spotitem has not appointed a data protection officer; requests are handled under the responsibility of its President.
2. Scope
This policy applies to the spotitem.com website, the Spotitem mobile applications and exchanges with customer service.
3. Data we process
3.1 Account and identity: email address, password (stored only in hashed form), username, first name and surname, profile photo, description, account type (private individual or professional), linked accounts. If you log in through an identity provider (for example Google or Apple): the identifier assigned by that provider and the login tokens it issues.
3.2 Contact details: telephone number and postal address (optional for a private individual, mandatory for a professional), delivery addresses, sellers’ shipping address, contact telephone number for delivery.
3.3 Professionals: business name and official business name, SIREN or SIRET number, result of its verification, activity code (APE), “artisan” label, VAT number, logo and banner.
3.4 Payments and payouts: identifiers assigned by our service provider Stripe. For sellers, the information entered to open the payment account (identity, date of birth, address, telephone number, bank details) is transmitted to Stripe, which retains it; Spotitem keeps only the account identifier, the last four digits of the bank account, the name of the bank and the currency. Spotitem retains neither your IBAN nor your bank card data.
3.5 Transactions: orders, amounts, delivery methods, shipment tracking, disputes, refunds, invoices; price offers and grouped offers; Raccoin movements and purchases (including the date of your waiver of the right of withdrawal); professional subscriptions.
3.6 Content and interactions: listings (photos, videos, descriptions, collection town and postcode); messages exchanged (text, photos, videos); ratings and reviews given and received, including anonymous ratings, whose author is known to Spotitem, and replies to reviews; reports and blocks; wish lists, favourites, “likes”, comments, subscriptions to other users; price drop alerts; purchase requests. When you use photo certification, the precise geographical position of the device at the time the photo is taken, its accuracy and a technical fingerprint of the device.
3.7 Security: PIN code (hashed), two-factor authentication secret (encrypted), device identifier, sessions, login history (IP address, browser or device, date, login method).
3.8 Use of the Platform: listings displayed and viewed, video watch time, favourites and “likes”, “hide” or “not interested” signals, declared interests, viewing history, recommendation scores, log of technical and functional events; “online” status (calculated in memory, never stored in any history); display preferences; badges earned and progress towards the next badge, calculated from your approved listings, your sales and the age of your account.
3.9 Notifications: notification tokens of your mobile devices, notification and email preferences.
3.10 Customer service: messages sent via the help bubble or by email, attachments, and technical information attached to diagnose a problem (recent application errors, request identifier, application version).
3.11 Artificial intelligence agents: authorisations you grant to a third-party agent, with their scope and date.
Spotitem does not collect your date of birth (except for transmission to Stripe for sellers) or any identity document.
4. Where the data comes from
- From you, when you create your account, publish, buy, exchange or contact customer service.
- From your use of the Platform (usage, connection and security data).
- From third parties: the identity provider you choose to log in with; Stripe (verification status of your payment account); the carrier (parcel tracking); the public business directory (data on professionals).
5. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, authenticating you, securing access (PIN, two-factor authentication, linked accounts) | Performance of the contract (Terms of Use) |
| Publishing and moderating listings, messaging, offers, orders, payment, escrow, delivery, disputes, ratings and reviews | Performance of the contract |
| Showing the map of a listing’s pickup town | Legitimate interest (locating the listing) |
| Verifying professional sellers | Performance of the contract; legal obligation (consumer information) |
| Invoicing and accounting | Legal obligation |
| Retention of connection data | Legal obligation |
| Tax reporting by platforms concerning sellers | Legal obligation |
| Handling reports, removing unlawful content, responding to authorities | Legal obligation |
| Recommending listings, personalising the feed, measuring usage to improve the Platform | Legitimate interest (offering relevant listings) |
| Preventing fraud, securing the Platform, detecting technical errors | Legitimate interest |
| Combating fake reviews and rating abuse (keeping the link between an anonymous rating and its author) | Legitimate interest (ensuring that ratings and reviews are reliable) |
| Displaying your “online” status | Legitimate interest (you can hide it) |
| Sending you notifications on mobile | Consent (your device’s system permission) |
| Certifying the location of a photo | Consent (your device’s location permission) |
| Allowing a third-party agent to act on your account | Performance of the contract, at your request |
6. What is publicly visible
- Profile: username, photo, description, sign-up date, status (private individual, professional, certified pro, craft business), business name, town, logo and banner of professionals, number of followers, badges earned, average rating and distribution of ratings received, reviews received, “online” status if you have not hidden it. Your first name and surname are not displayed: a private individual appears under their username, a professional under their business name. Only exception: an account that has no username, whatever the reason (although choosing one is mandatory), appears under its first name followed by the initial of its surname (for example “Camille D.”).
- Listings: photos, videos, description, price, collection town and postcode.
- Ratings and reviews: a signed rating is published with the username and profile photo of its author, its publication date, the date of the experience rated, any comment and any reply from the rated member. An anonymous rating appears under the label “Anonymous member”, with only the month of the experience rated; its author is revealed to no one, not even to the rated member.
Your email address, telephone number, postal address and surname are never displayed publicly; your first name only in the case described above. The buyer’s delivery address is disclosed to the seller and the carrier only after payment, for shipping. Your progress towards the next badge is visible only to you.
7. Who has access to your data
- Authorised members of the Spotitem team, within the limits of their duties (support, moderation, disputes, accounting).
- Other users, for what is public (section 6) and for what is necessary for a transaction (delivery details, messages).
- Our service providers (section 8), which act only on our instructions or, for payment and transport services, in their own capacity.
- Administrative or judicial authorities, upon a legally founded request.
8. Service providers and recipients
| Service provider | Role | Data | Location |
|---|---|---|---|
| OVH SAS | Hosting of servers and database | All Platform data | France |
| Cloudflare, Inc. | Domain name, protection, content delivery | IP address, requests | Global network |
| Cloudflare, Inc. (R2) | Storage of photos and videos; encrypted database backups (Cloudflare does not hold the decryption key) | Published media; encrypted copy of the Platform’s data | European Union |
| Stripe | Payments, seller accounts, regulatory checks, subscriptions | Identity, contact details, payment and bank data, transactions | European Union and United States |
| Sendcloud, Boxtal and the carriers | Labels, transport, tracking (via the seller’s account) | Names, addresses, telephone number, declared contents of the parcel | European Union |
| Mailjet (Sinch) | Sending of service emails (email address verification, password, notifications) | Email address, content of messages | European Union |
| Zoho Mail (Zoho Corporation) | Spotitem’s mailboxes (contacts@ and support@): receiving and answering your messages | Email address, content of your messages | European Union |
| Login with a Google account; notifications on Android | Identifier, email address; device token and content of the notification | European Union and United States | |
| Apple | Login with an Apple ID; notifications on iOS | Identifier, email address; device token | European Union and United States |
| Other identity providers offered on the login page | Login | Identifier, email address, name | Depending on the provider |
| National address database (api-adresse.data.gouv.fr) | Assistance with entering addresses | Address being entered, IP address | France |
| Administrative divisions API (geo.api.gouv.fr) | Assistance with entering the town in the iOS app; locating the pickup town for a listing’s map | Postcode or town, IP address | France |
| OpenStreetMap Foundation | Map of the pickup town shown on a listing | IP address, browsing data when the map loads | United Kingdom |
| Business directory (recherche-entreprises.api.gouv.fr) | Verification of professionals | SIREN or SIRET number | France |
| Virtual tour providers | Display of a tour embedded in a listing, after your click | IP address, browsing data | Depending on the provider |
9. Transfers outside the European Union
Some service providers (Cloudflare, Stripe, Google, Apple, identity providers) may process data in the United States. These transfers are governed by the European Commission’s adequacy decision on the EU–US Data Privacy Framework where the provider has joined it, or failing that by the European Commission’s standard contractual clauses. You may obtain a copy of them on request. The map shown on a listing is provided by the OpenStreetMap Foundation, in the United Kingdom, which the European Commission recognises as ensuring an adequate level of protection.
10. Retention periods
| Data | Period |
|---|---|
| Account and profile | As long as the account is open; erasure or anonymisation upon its deletion (section 13) |
| IP address and browser in the login history | 1 year, then anonymisation |
| Server technical logs | 12 months at most |
| Encrypted database backups | 12 months at most (copies every 30 minutes kept 12 hours, daily copies 7 days, monthly copies 12 months), then destroyed |
| Orders, transactions and invoices | 10 years (accounting obligations) |
| Listing videos | Deleted 180 days after the end of publication of the listing, unless a dispute is pending |
| Inactive listing drafts | 20 days |
| Deleted purchase requests | 30 days |
| Messages | As long as the account is open; after deletion of the account, only messages from a conversation linked to an order are kept, for 5 years, as evidence in the event of a dispute |
| Ratings and reviews, including the link between an anonymous rating and its author | Until the account of their author or of the rated member is deleted, which erases them (section 13) |
| Usage data (views, watching, interactions, recommendations) | 13 months |
| Viewing history | Until you erase it, and at most 13 months |
| Notification tokens | Until they are revoked or the device is logged out |
| Price alerts | Until you delete them or the account is deleted |
| Exchanges with customer service | 3 years after the request is closed |
| Choices regarding trackers | 90 days |
11. Recommendation and automated decisions
To offer you relevant listings, Spotitem automatically calculates a display order based on your interactions: categories viewed, favourites and “likes” (last 180 days), views and watch time (last 90 days), purchases, “hide” or “not interested” signals (last 180 days), declared interests, and the behaviour of users with similar tastes. The main parameters are detailed in the document “Listing, Ranking and Reviews”.
This processing produces no legal effect concerning you. No decision concerning you (approval or rejection of a listing, sanction, outcome of a dispute) is based solely on automated processing: such decisions are subject to human review. You can erase your viewing history, hide listings and object to personalisation by writing to [email protected].
12. Security
Passwords and PIN codes are hashed. The two-factor authentication secret and the carrier account credentials are encrypted (AES-256-GCM). Communications are encrypted in transit (HTTPS). The database is backed up every 30 minutes, in encrypted form, with a separate host located in the European Union (article 8). Access to data is restricted to authorised persons. In the event of a data breach presenting a risk to your rights, Spotitem notifies the CNIL and, if the risk is high, the data subjects, under the conditions laid down by the GDPR.
13. Deleting your account
You can delete your account from your settings once your orders in progress are completed (payout to the seller or refund). Deletion results in the erasure or anonymisation, in our databases, of your identification, contact, authentication and profile data, your unsold listings, the ratings and reviews you have given or received and your replies to reviews, your usage data and your preferences, as well as the deletion of your media from our storage spaces and the closure of your account with Stripe. The following are retained, solely for the period required by law or necessary for the defence of rights (section 10): orders, transactions and invoices; connection data; messages from conversations linked to an order; sold listings, attached to an anonymised seller. Erased data remains in the encrypted database backups until they are destroyed, at the latest 12 months later; these backups are only used to restore the service after an incident. A deleted account can no longer be used to log in. The Raccoin balance is lost.
14. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability with respect to your data (GDPR, Articles 15 to 22), and the right to set instructions regarding what happens to your data after your death (Loi Informatique et Libertés, Article 85). Where processing is based on your consent, you may withdraw it at any time.
- From your settings: edit your profile and contact details, erase your viewing history, hide your “online” status, manage your notifications, revoke a third-party agent’s access, download a copy of your data in a structured, machine-readable format, delete your account.
- For any other request: [email protected]. We respond within one month, which may be extended by two months for a complex request; we may ask you to prove your identity in the event of reasonable doubt.
You may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
15. Mobile applications
The applications request, at the time the feature is used, access to the camera, your photos and videos, notifications and, for photo certification, your location. You can withdraw these permissions at any time in your device settings.
16. Minors
The Platform is reserved for adults. Spotitem does not knowingly collect data concerning minors; if you believe that a minor has opened an account, write to us.
17. Changes
Spotitem may amend this policy. In the event of a substantial change, you will be informed by email or by a message on the Platform.
The French version of this document prevails over any translation.