Privacy Policy

Saljbar is operated by Frimtech Labs, a Netherlands-registered company (KvK 42040319, VAT NL005449541B23). For privacy questions, write to hello@saljbar.se.

Frimtech Labs is the “data controller” under EU Regulation 2016/679 (GDPR). This policy explains what personal data we collect, why, and what rights you have over it.

• Account data: email address, password (hashed, never stored in clear), display name if you choose to add one.
• Listing data: titles, descriptions, prices, photos and tags of items you upload.
• Platform credentials: authentication tokens for Tradera, Vinted, and Plick, stored encrypted and only used to post on your behalf.
• Usage data: basic analytics like which features you use and how often (anonymous event metrics).
• Communication: emails you send us and our replies.

We process your data for these purposes:

• Service delivery — to show you your listings, post items to marketplaces on your behalf, and detect sold items (legal basis: performance of contract).
• Account security — authentication and fraud prevention (legitimate interest).
• Product improvement — aggregated, anonymised analytics (legitimate interest, opt-in via cookie consent).
• Legal compliance — bookkeeping, tax records and responding to lawful requests.

We do not sell your data. We share only with processors that help run the service, all bound by data-processing agreements:

• Supabase (EU region) — database, authentication and file storage.
• Vercel — application hosting and edge delivery.
• AI processing partners — listing-description generation runs on third-party AI infrastructure; no personal identifiers are sent.
• Resend — transactional email delivery.
• Tradera / Vinted / Plick — only the listing content you choose to publish.
• Mollie — payment processing; we never store card numbers.

Listing and account data is kept as long as your account is active. When you delete your account, all data is removed within 30 days, except records we are legally required to retain (e.g. invoices for 7 years under Dutch tax law).

Under GDPR you can at any time:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion (“right to be forgotten”) — available from your dashboard settings or by email
• Export your data in a portable format (JSON/CSV)
• Withdraw consent for optional processing at any time
• Lodge a complaint with the Dutch Data Protection Authority Autoriteit Persoonsgegevens or Swedish Integritetsskyddsmyndigheten (IMY)

We use essential cookies to keep you signed in and remember your preferences. Optional analytics cookies are only set after you choose “Accept all” in our cookie banner. You can change your choice any time by clearing your browser data.

The official Saljbar browser extension (Chrome Web Store) is the posting engine that publishes listings to Vinted and Plick on your behalf. It is optional — you can use the Saljbar web app without it (Tradera works without the extension).

What the extension does on your device:

• Reads your existing Vinted session cookie on vinted.com / vinted.se / vinted.nl (and other Vinted country domains) to authenticate API calls to your own Vinted account. We never see, transmit or store your Vinted password.
• Opens a hidden Plick tab to pre-fill the new-listing form. The tab closes once the post completes. We never store your Plick password.
• Reads your Saljbar session cookie on saljbar.se to fetch your pending listings and report post outcomes.
• Runs a daily background sync (once per 24h) to detect items you sold or removed on Vinted, so your dashboard stays accurate.

What the extension does not do:

• Track your browsing on other websites
• Collect or transmit your Vinted / Plick login credentials
• Run on any domain other than vinted.* / plick.se / saljbar.se
• Execute remote code — all extension JavaScript ships in the package

You can uninstall the extension any time via chrome://extensions. Uninstalling removes all locally cached data immediately.

Our hosting and storage are in the European Union. We do not transfer your data outside the EEA except where covered by Standard Contractual Clauses or another lawful mechanism (for example AI-description generation may run on infrastructure outside the EEA — no personal identifiers attached).

We will notify you of material changes by email and update the “Last updated” date above. Continued use after notice means you accept the revised policy.