Privacy Policy

The controller of your personal data is [Company legal name — to be completed], [Registered address — to be completed], registration number [KRS / CEIDG number — to be completed], tax ID (NIP) [NIP — to be completed], operating BuyProject. Contact: info@buyproject.com.

• Account: name, email address and your Firebase user ID (UID).
• Profile: phone number, address, avatar and bio, if you provide them.
• Sellers additionally: tax ID, business name, business type, business registration number, website and PayPal email address.
• Orders and payments: what you bought or sold, amounts, taxes, order status, and payment and payout references from PayPal.
• Chat messages exchanged between buyer and seller on the platform.
• Delivery addresses you save.
• Notification preferences.

• Performance of a contract (Art. 6(1)(b) GDPR): creating and running your account, processing orders, payments, downloads and payouts, and buyer–seller chat.
• Legal obligation (Art. 6(1)(c) GDPR): keeping accounting and tax records.
• Legitimate interest (Art. 6(1)(f) GDPR): keeping the platform secure and preventing fraud and abuse.
• Consent (Art. 6(1)(a) GDPR): marketing emails. This is off by default and you can withdraw consent at any time.

• Google Firebase — authentication, Firestore database and file storage; Google reCAPTCHA is used for phone number verification.
• PayPal — payments and seller payouts. PayPal acts as an independent controller; see the PayPal Privacy Statement.
• Stripe — tax calculation; only your country and postal code are sent.
• Hosting — our API and database are hosted by [hosting provider — to be completed].

Google, PayPal and Stripe may process data in the United States. Such transfers are based on the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.

• Account data: for as long as your account exists.
• Order and invoice data: for the period required by tax law [e.g. 5 years — to be confirmed].
• When you delete your account, your profile is anonymised and your saved addresses are deleted. Order records needed for accounting are kept for the period above.

We do not use analytics or advertising cookies. We use your browser's storage only for things that are strictly necessary for the service you request: your login session (Firebase), your cart, your favourites and your theme setting. Because this storage is strictly necessary, we do not show a consent banner.

On the payment step, PayPal loads its own scripts, which are governed by PayPal's privacy statement.

You have the right to:

• access your data;
• rectify inaccurate data;
• have your data erased;
• restrict processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent at any time, without affecting earlier processing.

You can use "Download my data" and "Delete account" yourself in Profile → Security. For any other request, email info@buyproject.com.

You also have the right to lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (UODO), https://uodo.gov.pl.

We protect your data with access controls, so that users can only access their own data, and with encryption in transit (HTTPS).

Questions about this policy or your data: info@buyproject.com.