Sign in

Legal

Privacy Policy

The policy reflects implemented account, seller, listing, cart, order, message, support, reporting, moderation, notification, upload, translation, and payment data flows.

Effective
2026-07-12
Last updated
2026-07-12
Version
0.3.0
Review status
Legal review required
Legal overviewContact support

Plain-language overview

Explains the personal data handled by the implemented marketplace features.

This overview helps explain the document, but it does not replace the full policy text.

Controller And Contact

The repository does not contain verified public controller identity, address, DPO, or privacy-contact details. Those details must be approved before launch. Support and account workflows still collect and process data needed to operate the marketplace.

Data Categories

  • Account and authentication data: name, email, username, password hash, OAuth account records, sessions, verification and password-reset records.
  • Profile data: buyer details, seller display profile, individual or business seller fields, addresses, phone number, public location, contact preferences, status, and admin notes.
  • Marketplace data: listings, plant references, photos, saved listings/sellers, cart activity, orders, pickup codes, shipping and pickup snapshots, payment attempts, Stripe connected-account identifiers, and ledger records.
  • Communication and safety data: messages, notifications, support requests, listing reports, moderation notes, dispute markers, evidence submitted in support text, and admin status updates.
  • Technical and preference data: session cookies, locale cookie, currency cookie, guest-cart cookie, local seller-listing drafts, upload storage data, logs, and security/rate-limit records.

Purposes And Lawful Bases

PurposeDataLikely basisProvision
Accounts and sessionsAccount, auth, security recordsContract and legitimate interestsRequired for account use
Seller onboarding and listingsSeller profile, business fields, addresses, listing dataContract, legal obligation, legitimate interestsRequired to sell
Orders, payments, refunds, disputesOrder, payment, Stripe, ledger, support dataContract, legal obligation, legitimate interestsRequired for checkout and disputes
Messages, support, reportsMessage/support/report content and metadataContract, legitimate interests, legal obligationRequired when used
Optional public profile detailsBio, image, public contact preferenceConsent or contract, depending on contextOptional

Recipients And Providers

  • Hosting/database infrastructure, file storage, transactional email, authentication, payment providers, support/admin tooling, and security tooling may receive data as needed for their role.
  • The code references PostgreSQL/Neon-style deployment, local or S3-compatible upload storage, Nodemailer/Resend-style email, Auth.js, Stripe, and optional Google OAuth. The final processor list and transfer safeguards require business approval.
  • Stripe may act under its own terms and privacy information for payment, connected-account, dispute, refund, and payout processing.

Retention And Rights

  • Exact retention periods are not implemented as public constants and need approval. Piantera should keep data only as long as needed for the marketplace, legal obligations, accounting, tax, plant-health records, disputes, chargebacks, safety, fraud prevention, and legal claims.
  • Users may request access, correction, erasure, restriction, objection, portability, and withdrawal of consent where those rights apply.
  • Account deletion may not remove records that must be kept for orders, payment, tax, safety, disputes, chargebacks, legal claims, or mandatory records.
  • The competent Slovenian data-protection authority appears to be the Information Commissioner, but final authority wording requires verification with approved operator details.

Automation, Children, Security, And Changes

  • No implemented automated legal decision-making or profiling for eligibility was found beyond search/sort/filtering, validation, rate limits, and admin moderation workflows.
  • Age restrictions and children wording require business approval; the service is not designed for children.
  • Piantera uses reasonable security measures but cannot guarantee perfect security.
  • Material privacy changes should be communicated clearly where required.

Official Sources